Privacy Policy

1 Information We Collect

We collect nonpublic personal information ("NPI") and other information about you from the following sources and categories:

1.1 Information You Provide Directly

• Identifying Information: Full name, date of birth, Social Security Number (SSN), government-issued ID numbers, marital status, number of dependents
• Contact Information: Current and previous addresses, phone numbers, email address
• Employment & Income Information: Employer name, address, position, length of employment, salary, self-employment information, W-2s, tax returns, pay stubs
• Financial Information: Bank account numbers and statements, asset information, investment accounts, retirement accounts, debts and liabilities
• Property Information: Address, purchase price, property type, intended use (primary residence, secondary residence, investment), estimated value
• Loan Application Data: Loan amount requested, loan purpose, down payment amount, co-borrower information

1.2 Information We Receive from Others

• Consumer Reports: Credit reports, credit scores, and other consumer reports obtained from consumer reporting agencies (Equifax, Experian, TransUnion) pursuant to your authorization and the Fair Credit Reporting Act (FCRA)
• Verification Services: Employment and income verification from your employer or third-party verifiers; asset verification from financial institutions
• Public Records: Title records, property tax records, court records, and other publicly available information
• Appraisal and Inspection Reports: Property valuation and condition reports from licensed professionals
• Flood and Insurance Information: Flood zone determinations, homeowner's insurance information

1.3 Information Collected Automatically

• Device & Technical Data: IP address, browser type and version, operating system, device identifiers
• Usage Data: Pages visited, time on site, links clicked, referring URL, search terms used to find our site
• Cookies and Tracking Technologies: See Section 7 for details

2 How We Use Your Information

We use the information we collect for the following purposes:

2.1 Loan Origination Services

• Processing and evaluating your mortgage loan application
• Communicating with you about your loan status, requirements, and terms
• Ordering and reviewing appraisals, inspections, title searches, and other required services
• Obtaining required verifications (employment, income, assets)
• Preparing and delivering loan disclosures required by federal and state law
• Submitting your loan to lenders and investors for approval

2.2 Legal and Regulatory Compliance

• Complying with applicable federal and state mortgage laws, including RESPA, TILA, ECOA, HMDA, and state licensing laws
• Responding to court orders, subpoenas, or other legal processes
• Cooperating with federal, state, and local government authorities as required by law
• Meeting recordkeeping requirements under applicable law
• Reporting as required by the Home Mortgage Disclosure Act (HMDA)

2.3 Fraud Prevention and Security

• Verifying your identity and preventing identity theft
• Detecting, investigating, and preventing fraud, money laundering, and other financial crimes
• Complying with the Bank Secrecy Act and anti-money laundering (AML) requirements
• Protecting the rights and property of our company and our customers

2.4 Business Operations

• Managing our customer relationship with you
• Improving our products, services, and website
• Internal analytics and business planning
• Training and quality assurance

2.5 Marketing (With Opt-Out Rights)

• Informing you of other loan products or financial services that may be of interest to you
• Sending you our newsletter or promotional materials (where you have consented or where permitted by law)

You have the right to opt out of marketing communications at any time. See Section 4 for instructions.

3 How We Share Your Information

Federal law gives you the right to limit some but not all sharing. The table below summarizes our information sharing practices in compliance with the Gramm-Leach-Bliley Act (GLBA).

3.1 Required Sharing for Loan Processing

To process your mortgage loan, we must share your information with certain third parties. These include:

• Lenders and Investors: Mortgage lenders and secondary market investors to whom we submit your loan application
• Appraisers and Inspectors: Licensed real estate appraisers and home inspectors
• Title Companies and Settlement Agents: Title insurance companies, escrow officers, and closing agents
• Credit Reporting Agencies: Equifax, Experian, TransUnion, and specialty consumer reporting agencies
• Government Agencies: FHA, VA, USDA, Fannie Mae, Freddie Mac, and state mortgage regulatory agencies as required
• Flood Zone Determination Services
• Mortgage Insurance Companies (where applicable)

3.2 Service Providers

We may share your information with service providers who assist us in operating our business (e.g., loan origination software vendors, document management services, IT providers). These providers are contractually required to use your information only to provide services to us and are prohibited from using it for their own purposes.

3.3 Legal Requirements

We may disclose your information when required by law, regulation, court order, or as necessary to protect our legal rights or the rights of others.

4 Your Rights and Choices

4.1 Opt-Out of Marketing

You have the right to limit our sharing of your information for marketing purposes. To opt out of our marketing communications, you may:

• Email us: justin@mhlendingservices.com with subject line "PRIVACY OPT-OUT"
• Call us: (949) 351-4802
• Write to us: 5201 Great American Pkwy, Ste 320, Santa Clara, CA 95054

We will process your opt-out request within a reasonable time. Please allow up to 30 days for your request to take effect. Note that opting out of marketing does not affect our ability to share your information for everyday business purposes or as required by law.

4.2 Your FCRA Rights

If we use a consumer report in connection with your application, federal law provides you with the following rights:

• The right to know if a consumer report was used in a decision about you
• If adverse action is taken based on your consumer report, the right to receive an adverse action notice identifying the consumer reporting agency used
• The right to a free copy of your consumer report from each reporting agency once per 12-month period at AnnualCreditReport.com
• The right to dispute inaccurate information in your consumer report directly with the reporting agency
• The right to seek damages for FCRA violations

4.3 Accessing and Correcting Your Information

You may request access to the personal information we hold about you, or request that we correct inaccurate information, by contacting us using the information in Section 10. We will respond to verified requests within 45 days (or as otherwise required by applicable law).

4.4 Email Opt-Out (CAN-SPAM)

If you receive marketing emails from us, you may opt out of future marketing emails by clicking the "unsubscribe" link in any such email or contacting us directly. Transactional emails related to your loan application cannot be unsubscribed from while your application is pending.

5 California Privacy Rights (CCPA/CPRA)

5.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information from California consumers:

• Identifiers: Name, alias, address, SSN, driver's license number, email, IP address
• Personal Information (Cal. Civ. Code § 1798.80(e)): Name, SSN, address, telephone number, financial account information, employment history
• Protected Classification Characteristics: Race, national origin, sex, marital status, familial status (collected only as required by HMDA and ECOA)
• Financial Information: Bank account numbers, credit card numbers, income information
• Internet/Electronic Activity: Browsing history on our website, interactions with our online services
• Geolocation Data: General location based on IP address
• Professional/Employment Information: Employment history, income
• Inferences: Profile data drawn from above information to assess creditworthiness (shared with lenders only as necessary)
• Sensitive Personal Information: SSN, driver's license, financial account information, racial or ethnic origin (HMDA/ECOA only)

5.2 Purposes for Collection

We collect personal information for the purposes described in Sections 2 and 3 of this Privacy Policy. We do not sell or share your sensitive personal information for purposes other than those specified above.

5.3 Your California Rights

As a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request that we delete personal information we have collected about you, subject to certain exceptions (e.g., information required to complete a loan transaction, information required by law).
• Right to Correct: You have the right to request that we correct inaccurate personal information about you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: You have the right to direct us to limit use of your sensitive personal information to that which is necessary to perform the services you have requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

5.4 Do Not Sell or Share My Personal Information

5.5 How to Submit a California Privacy Request

To exercise your rights as a California resident, you may submit a verifiable consumer request by:

• Email: justin@mhlendingservices.com — subject line: "CALIFORNIA PRIVACY REQUEST"
• Phone: (949) 351-4802
• Mail: 5201 Great American Pkwy, Ste 320, Santa Clara, CA 95054

We will respond to verifiable requests within 45 days. We may extend the response period by an additional 45 days when reasonably necessary, with prior notice. We may need to verify your identity before processing your request. You may designate an authorized agent to submit a request on your behalf.

5.6 Financial Information Exemption

Please note that certain personal information collected and processed in connection with your mortgage loan application is subject to the GLBA and may be exempt from some CCPA/CPRA requirements. To the extent your information is governed by both GLBA and CCPA/CPRA, the GLBA generally controls for loan-related processing activities.

5.7 California "Shine the Light" (Cal. Civil Code § 1798.83)

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes without your consent. To submit a request under Cal. Civil Code § 1798.83, contact us at the address in Section 10.

6 Data Security

We implement and maintain reasonable administrative, technical, and physical security measures to protect your nonpublic personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of sensitive data in transit (TLS/SSL) and at rest
• Access controls limiting access to NPI to employees and service providers with a legitimate business need
• Employee training on privacy and data security practices
• Regular review of our data collection, storage, and processing practices
• Written information security program (WISP) as required under applicable state and federal law

Despite our security measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately using the information in Section 10.

6.1 Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with applicable law, resolve disputes, and enforce our agreements. Mortgage loan records are generally retained for a minimum of 3 years from the date of application or consummation, as required by applicable federal and state law. Some records may be retained longer as required by law or legitimate business purposes.

7 Cookies and Online Tracking

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the website to function properly. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics). This data is aggregated and anonymous.
• Functional Cookies: Remember your preferences (e.g., form completion progress).
• Marketing Cookies: Used to deliver relevant advertisements. We do not currently use third-party advertising cookies on this site.

7.2 Managing Cookies

You can control and/or delete cookies through your browser settings. For instructions, visit aboutcookies.org. Disabling certain cookies may affect the functionality of our website.

7.3 "Do Not Track" Signals

Some browsers have a "Do Not Track" feature that signals to websites that you do not want to have your online activities tracked. Our website does not currently respond to "Do Not Track" signals. California law (CalOPPA) requires us to disclose this.

7.4 Third-Party Analytics

We may use third-party analytics services (such as Google Analytics) that use cookies and similar technologies to collect information about your use of our website and to report website trends. Google's use of this data is governed by Google's Privacy Policy. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

8 Children's Privacy

Our website and services are not directed to children under the age of 13. We do not knowingly collect personal information from children under the age of 13. If you are under 13, please do not use our website or submit any personal information. If we learn that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly.

If you believe we have inadvertently collected information from a child under 13, please contact us immediately using the information in Section 10.

This notice is provided in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.

9 Changes to This Policy

We reserve the right to update or change this Privacy Policy at any time. If we make material changes to this Policy, we will notify you by:

• Posting the updated Policy on our website with a new "Last Updated" date
• Sending an email notification to the email address associated with your account or application (where applicable)
• Providing a prominent notice on our website homepage for a reasonable period

Your continued use of our website or services following the posting of changes constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically.

For California residents: We will provide notice of material changes at least 30 days in advance when required by the CCPA/CPRA.

10 Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your information is being handled, please contact us:

Regulatory Complaints

If you believe your privacy rights have been violated, you may also file a complaint with the appropriate regulatory authority:

• Federal (CFPB): Consumer Financial Protection Bureau — consumerfinance.gov/complaint or (855) 411-2372
• California: California Privacy Protection Agency — cppa.ca.gov
  California Department of Real Estate — dre.ca.gov
• Arizona: Arizona Department of Insurance and Financial Institutions — difi.az.gov
• Idaho: Idaho Department of Finance — finance.idaho.gov
• Oregon: Oregon Division of Financial Regulation — dfr.oregon.gov or (888) 877-4894
• Washington: Washington State Department of Financial Institutions — dfi.wa.gov or (877) 746-4334