Who We Are / Data Controller

Mortgages For America, NMLS #993846, is the entity that collects and controls personal information submitted through this Website. Mortgages For America is also the entity that may contact individuals who submit enquiries through the Website.

Iron Oak Lending is the Website operator and publisher. Iron Oak Lending is intended to operate as an assumed name of Mortgages For America, pending DBA or assumed-name registration [confirm before publishing]. Iron Oak Lending does not hold its own NMLS company registration and is not presented as a separately licensed entity.

Information We Collect

We collect information that you provide through Website forms and information that may be collected automatically when you use the Website.

Information You Provide

The Website forms may collect:

• Identifiers, such as your full name, email address, and telephone number;
• Commercial information, such as the loan or enquiry type and the property or loan amount sought; and
• Message content, including any information you choose to include in an optional free-text message.

The full name, email address, telephone number, and loan or enquiry type fields are intended to be required fields. The property or loan amount sought and free-text message fields may be optional.

The Website currently does not include a payment form or document-upload feature. We do not collect Social Security numbers or full financial account numbers through this Website. Please do not submit sensitive financial documents or other sensitive information through a Website form.

Information Collected Automatically

When you visit or use the Website, we may automatically collect technical and usage information, such as:

• Internet Protocol (“IP”) address;
• Device type;
• Browser type and operating system;
• Pages viewed and actions taken on the Website;
• Referring URL;
• Approximate location derived from technical information, if available;
• Date and time of access; and
• Cookie identifiers and similar technologies.

[CONFIRM: the categories of technical information actually collected by the hosting provider, analytics tools, and other Website technologies.]

Information About Children

We do not knowingly collect personal information from children under 13. If you believe that a child under 13 has submitted personal information through the Website, please contact us using the information in the “How to Contact Us” section.

How We Use Information

We may use personal information to:

• Respond to questions, requests, and loan enquiries;
• Evaluate and route loan scenarios to appropriate third-party lenders or investors;
• Communicate about lending products, services, or related opportunities;
• Coordinate with third-party lenders and investors that may evaluate or originate a loan;
• Comply with legal, regulatory, licensing, recordkeeping, and reporting obligations;
• Prevent, detect, and investigate fraud, security incidents, and other unlawful activity;
• Maintain, secure, troubleshoot, and improve the Website and our services;
• Understand how visitors use the Website; and
• Carry out other purposes disclosed at or before the time information is collected or otherwise permitted by law.

We do not sell personal information. We do not use personal information for purposes materially different from those described in this Privacy Policy without providing notice as required by applicable law.

How We Share Information

We may share personal information with the following categories of recipients:

• Third-party lenders and investors, and their service providers, for purposes of evaluating, arranging, underwriting, processing, or originating a loan or other financing;
• Website and technology service providers, including providers that host the Website, process or deliver email, maintain Website functionality, provide security services, or provide analytics;
• Affiliates, including Mortgages For America;
• Service providers and contractors that perform services on our behalf and are authorized to use information only for permitted business purposes;
• Parties involved in a business transfer, such as a merger, acquisition, financing, reorganization, sale of assets, or similar transaction;
• Government authorities, regulators, law enforcement, courts, professional advisers, or other parties when required or permitted by law; and
• Other parties when reasonably necessary to protect rights, safety, property, the Website, users, or the public.

We do not sell your personal information.

We may disclose information to third parties that assist with evaluating or originating a loan. Those third parties may have their own privacy policies and legal obligations. [CONFIRM: the complete categories and names of lenders, investors, affiliates, and service providers that should be identified in the final version.]

GLBA Notice / Gramm-Leach-Bliley Act

This section provides privacy-notice information for purposes of the Gramm-Leach-Bliley Act and Regulation P, 12 CFR Part 1016. It is intended to describe our information practices in plain language. The licensed entity’s compliance department and a licensed attorney must confirm whether this section accurately satisfies all applicable requirements before publication.

Categories of Nonpublic Personal Information We Collect

Depending on the information you provide and how you use the Website, we may collect or obtain categories of nonpublic personal information, including:

• Identifying and contact information, such as name, email address, telephone number, and IP address;
• Information about a loan or financing enquiry, such as loan or enquiry type and the property or loan amount sought;
• Information contained in an optional message;
• Website usage, device, browser, referring URL, and cookie information;
• Information provided directly by you through the Website; and
• Information obtained from third parties in connection with evaluating, routing, arranging, or originating a loan, where applicable.

The Website does not include a payment form or document-upload feature. We do not collect Social Security numbers or full financial account numbers through this Website.

Categories of Nonpublic Personal Information We Disclose

We may disclose categories of nonpublic personal information such as:

• Identifying and contact information;
• Loan or financing enquiry information;
• Property or loan amount information;
• Information contained in an enquiry or message;
• Website, device, browser, and technical information; and
• Other information that is reasonably necessary to evaluate, arrange, process, or originate a loan or to provide requested services.

Categories of Parties to Whom We Disclose Information

We may disclose nonpublic personal information to:

• Mortgages For America and other affiliates;
• Third-party lenders and investors;
• Loan-origination, underwriting, processing, servicing, and settlement participants;
• Service providers and contractors that perform services or functions on our behalf;
• Website hosting, email, analytics, security, and technology providers;
• Professional advisers and auditors;
• Government authorities, regulators, courts, and law enforcement; and
• Parties involved in a business transfer or other transaction involving the business.

Confidentiality and Security Practices

We limit access to nonpublic personal information to personnel, affiliates, lenders, investors, service providers, and other parties who need the information for a permitted business purpose or as required or permitted by law.

We maintain reasonable administrative, technical, and physical safeguards designed to protect the confidentiality and security of nonpublic personal information against unauthorized access, use, alteration, or disclosure. The specific safeguards may include access controls, confidentiality obligations, secure systems, monitoring, and procedures appropriate to the nature of the information.

[CONFIRM: the actual confidentiality and security practices that should be described in this notice.]

Opt-Out Position

We do not sell personal information.

We may share information with third-party lenders, investors, and service providers as reasonably necessary to evaluate, arrange, process, or originate a loan or to provide a service you request. We may also make disclosures that are permitted or required by law. Some disclosures may not be subject to an opt-out right.

If we disclose nonpublic personal information to a nonaffiliated third party in a manner that gives you a right to limit that disclosure under applicable law, we will provide the required notice and a reasonable method for exercising that right. To ask about available choices or submit an opt-out request, contact us at seth@ironoaklending.com or 214-817-0636.

Annual Privacy Notice

As required by applicable law, we will provide an annual privacy notice to customers when required. The annual notice will describe our current information-collection, information-sharing, confidentiality, security, and opt-out practices and will be updated when required.

Business-purpose borrowers are generally not “consumers” for purposes of Regulation P. Because the Website is positioned for business-purpose investor and commercial lending, this GLBA notice is provided as a matter of policy and for any consumer-purpose activity that may be subject to applicable privacy requirements.

Cookies and Analytics

Cookies are small text files or similar technologies that are placed on or accessed through your browser or device. They may help a Website remember information, maintain functionality, understand usage, and improve performance.

The Website may use the following categories of cookies or similar technologies:

• Strictly necessary technologies, which support Website operation, security, form functionality, and basic features;
• Functional technologies, which remember preferences or settings;
• Analytics technologies, which help us understand Website traffic, page views, and how visitors use the Website; and
• Advertising or marketing technologies, if any are installed and used, which may help measure campaigns or display relevant communications.

[CONFIRM: list the analytics, advertising, cookie, session-management, security, and other tracking tools actually installed on this Website.]

You can control or delete cookies through your browser settings. Disabling cookies may affect some Website functions. [CONFIRM: whether the Website uses a cookie banner, consent-management platform, or opt-out mechanism.]

Your Rights and Choices

Depending on applicable law, you may have the right to:

• Request access to personal information we maintain about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of personal information, subject to legal and operational exceptions;
• Opt out of marketing emails, calls, or text messages;
• Ask about available choices regarding certain disclosures of personal information; and
• Withdraw consent for communications where withdrawal is permitted.

To submit a privacy request or opt out of marketing communications, contact:

Email: seth@ironoaklending.com
Phone: 214-817-0636

We may need to verify your identity before completing certain requests. We will respond within the time required by applicable law.

California Residents

[CALIFORNIA NOTICE — FINALIZE WITH COUNSEL BEFORE PUBLICATION]

California residents may have rights under the California Consumer Privacy Act and California Privacy Rights Act (“CCPA/CPRA”), including rights to:

• Know or access categories and specific pieces of personal information collected, used, or disclosed;
• Delete personal information, subject to exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit certain uses or disclosures of sensitive personal information, where applicable; and
• Receive equal treatment and not be discriminated against for exercising privacy rights.

We do not sell personal information. The required California-specific notices, definitions, disclosures, request methods, verification procedures, response procedures, and other statutory language must be finalized by counsel before publication.

Other State Privacy Laws

[OTHER STATE PRIVACY NOTICE — FINALIZE WITH COUNSEL BEFORE PUBLICATION]

Residents of other states may have rights under applicable state privacy laws, which may include rights to access, correct, delete, obtain a copy of, or opt out of certain processing or targeted advertising. [CONFIRM: the states whose laws apply, the rights available in each state, applicable thresholds and exemptions, verification procedures, appeal procedures, and required notice language.]

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information.

No method of transmission or storage is completely secure. Email is not a secure channel for sensitive information. Applicants should not send Social Security numbers, full financial account numbers, tax returns, bank statements, or other sensitive documents by email or through a Website form.

The Website does not currently provide a document-upload feature. [CONFIRM: the approved secure method, if any, for submitting sensitive documents during a later stage of the lending process.]

Data Retention

We retain personal information for as long as reasonably needed for the purposes described in this Privacy Policy, including responding to enquiries, evaluating and routing loan scenarios, providing requested services, maintaining business and transaction records, resolving disputes, preventing fraud, complying with legal and regulatory obligations, and satisfying applicable recordkeeping requirements.

Actual retention periods may vary depending on the type of information, the purpose for which it was collected, applicable legal requirements, and operational needs. [CONFIRM: the retention periods or retention schedule required by the licensed entity’s compliance department.]

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our Website, services, information practices, legal obligations, or technology.

When we make changes, we will post the updated policy on the Website and revise the effective date above. [CONFIRM: whether additional notice, such as email notice or a Website banner, will be provided for material changes.]

How to Contact Us

If you have questions about this Privacy Policy, our information practices, or your privacy choices, contact us at:

Iron Oak Lending
Website operator and publisher for Mortgages For America, NMLS #993846
Email: seth@ironoaklending.com
Phone: 214-817-0636
Website: www.ironoaklending.com