Privacy Policy

Information you give us directly. When you request a rate quote, submit the DSCR quiz, apply for a loan, use our secure borrower portal, or contact us, we may collect your name, email address, phone number, mailing address, date of birth, Social Security number, income and employment information, credit history and score (or a self-reported credit range if you have not yet had your credit pulled), property information, asset and liability information, uploaded documents (such as pay stubs, W-2s, tax returns, and bank statements), and other details necessary to evaluate a mortgage application or provide the service you requested.

Payment information. If you are asked to pay a fee (for example, a credit report fee), we collect your payment card information through Stripe, Inc., our PCI-compliant payment processor. We do not receive or store your full card number, CVV, or magnetic-stripe/chip data — that information goes directly to Stripe. We retain only a card's brand, last four digits, and expiration month/year, along with a Stripe-issued token that lets your loan officer initiate an authorized charge without ever handling your raw card data. See Section 4 for more on Stripe's role.

Information collected automatically. Like most websites, we automatically collect certain technical information when you visit our Services, including your IP address, browser and device type, pages viewed, referring pages, and approximate location, through cookies, pixels, and similar technologies. See Section 3 for details.

Information from third parties. We may receive information about you from credit bureaus, verification services, our lending partners, marketing and referral partners (including affiliated loan officers), and publicly available sources to process your application or verify the information you provide.

We use cookies and similar technologies to recognize repeat visitors, remember your preferences, and understand how our Services are used.

Cookies fall into two categories:

• Necessary/session cookies. If you log in to our secure borrower or loan officer portal, we set a session cookie that keeps you signed in and is inherently tied to your account. This cookie is required for the portal to function and is not used for advertising or analytics.
• Analytics and verification cookies. We use Google Analytics to understand aggregate site traffic and usage patterns, and Cloudflare Turnstile to verify that form submissions are from a human and not automated software. Outside of a logged-in portal session, these cookies are not linked to your identity unless you submit a form. These providers may set their own cookies and process technical data subject to their respective privacy policies.

Most browsers let you refuse or delete cookies. Doing so may limit some features of our Services, such as staying signed in or resuming a saved quote.

We do not sell your personal information. We are the sole owners of the information collected through our Services and only share it as described here:

• Your assigned loan officer, who works on your behalf to prepare quotes and process your application.
• Wholesale lenders and investors we partner with to price, underwrite, fund, and service your loan.
• Credit bureaus and verification vendors used to confirm income, assets, employment, and creditworthiness.
• Service providers that support our operations, each contractually restricted from using your data for anything other than providing services to us:
  • Stripe, Inc. — processes payments you authorize (such as a credit report fee) and stores your payment card details on our behalf under its own PCI-DSS-compliant systems. See Stripe's Privacy Policy at stripe.com/privacy.
  • Neon, Inc. — hosts our application database, including your loan application data, in an encrypted environment.
  • Vercel Inc. — hosts our website, portal application, and supporting infrastructure (including short-lived caching/rate-limiting infrastructure used to protect login and form submission from abuse).
  • Resend — delivers transactional and notification emails on our behalf.
  • Google (Google Analytics) and Cloudflare (Turnstile) — provide website analytics and bot/fraud verification.
• Regulators and legal authorities when required by law, subpoena, or to protect our rights, property, or safety.

Any third party receiving your information for these purposes is contractually restricted from using it for anything other than providing the applicable service.

As a mortgage lender/broker, Freedomstar is subject to the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations. Consistent with GLBA, if you apply for or obtain a loan through us, we may collect nonpublic personal information about you from applications, transactions, and consumer reporting agencies, and we may share it with affiliates and nonaffiliated third parties as necessary to service your loan, as permitted by law, or as you authorize.

We do not share your nonpublic personal information with nonaffiliated third parties for their own marketing purposes. Where the law gives you the right to limit sharing, we will honor opt-out requests submitted using the contact information in Section 14.

Freedomstar currently serves consumers in California, Colorado, Florida, Georgia, Texas, and Virginia. Depending on where you live, you may have additional rights under state privacy laws (such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and the Virginia Consumer Data Protection Act), including the right to:

• Know what personal information we have collected about you.
• Request a copy of, or correct, that information.
• Request deletion of your personal information, subject to legal and regulatory recordkeeping requirements applicable to mortgage lenders.
• Opt out of the sale or sharing of personal information (we do not sell your data).
• Not be discriminated against for exercising these rights.

To exercise any of these rights, contact us using the details in Section 14. We may need to verify your identity before fulfilling your request. Note that federal and state mortgage lending laws require us to retain certain loan-related records for a minimum period regardless of a deletion request.

You may, at any time, contact us to:

• Opt out of future marketing emails, calls, or texts.
• See what data we hold about you, if any.
• Correct or update inaccurate data.
• Request deletion of data we hold about you, where applicable.
• Raise a concern about how we use your data.

You can also unsubscribe from marketing emails using the link included in every message we send.

We use administrative, technical, and physical safeguards designed to protect your information. Sensitive information submitted through our Services is encrypted in transit using HTTPS/TLS. Certain highly sensitive fields, such as your Social Security number, are additionally encrypted at rest using industry-standard AES-256 encryption, and are only decrypted server-side, on demand, by systems that need them — the decrypted value is never logged or exposed in transit to your browser in plaintext. Your full payment card number and CVV are never stored on our systems at all; they are handled directly by our PCI-compliant payment processor, Stripe. Access to personally identifiable information is limited to personnel who need it to perform their job (for example, loan processing or customer service), and our systems are hosted in secured environments.

No method of transmission or storage is 100% secure. If you believe your information has been compromised or that we are not abiding by this policy, contact us immediately using the details in Section 14.