Privacy Policy

This Privacy Policy explains what information MortgageDoor (mortgagedoor.net and the related borrower portal) collects, how that information is used, who we share it with, and the choices you have. We are a California-licensed mortgage broker, and we are committed to handling your information responsibly.

Heads up: mortgage applications involve sensitive financial data. Where the law (federal Gramm-Leach-Bliley Act, the California Consumer Privacy Act / CPRA, and similar) gives you specific rights, this policy describes how to exercise them.

1. Information we collect

1.1 Information you give us directly

• Contact information — name, email address, phone number, mailing/property address.
• Loan application information (the 1003) — date of birth, Social Security number, employment, income, assets, liabilities, marital status, dependents, citizenship status, military status, and other financial details required for an underwriting decision.
• Documents you upload — pay stubs, W-2s, tax returns, bank statements, identification, real estate contracts, insurance declarations, and other supporting files.
• Communications — emails, text messages, voicemail recordings, and call recordings that you send to or receive from us through the portal, our Twilio business phone number, or our published email addresses.
• Account credentials — your portal username (email), a salted password hash, and two-factor authentication setup data. We never store your password in plain text.

1.2 Information we collect automatically

• Device & usage data — IP address, browser type and version, operating system, pages viewed, referring URL, time stamps. Used for security logging and to improve the site.
• Cookies & similar technologies — We use necessary cookies for sign-in, security and session state. With your cookie choice, configured analytics and advertising measurement technologies may also load. You can change that choice through Cookie Settings.
• Email engagement — when you open or click links inside emails we send, our system records that event so we can confirm delivery and follow up appropriately. You can opt out at any time (see Section 6).
• SMS and voice metadata — when we exchange texts or calls with you through our Twilio business line, we record sender / recipient phone numbers, time stamps, message content, and (for inbound calls) call recordings and automated transcripts. Our outbound voice greeting discloses that calls may be recorded; by remaining on the line you consent to that recording.

Public AI assistant

When you open or use Michael’s AI assistant, we record a browser-session identifier, IP address, browser information, timestamps, language, the public page you are using, and your questions and the assistant’s answers. We use these records to provide support, review answer quality, and investigate misuse. An IP address is a network identifier and does not by itself identify a person. If you are signed into the borrower portal, an existing account identifier may be associated with the activity.

Questions that need AI processing and recent conversation context are sent to our OpenAI service provider. The public assistant does not read your private loan file or calculator inputs. Do not enter passwords, Social Security numbers, account numbers, or documents into the chat. Common sensitive-number patterns are redacted in our service log, but automated redaction cannot identify every kind of sensitive information.

Access to this service history is restricted to administrators. The history view covers 90 days; full IP addresses expire from that view after 30 days. Routine cleanup removes older chat records and clears older IP addresses as the service is used. Your browser keeps the conversation in its current tab for up to two hours of inactivity. “Clear chat” removes that browser copy; it does not delete the service history. Use the privacy request options below for a records request.

Private loan assistant and follow-up answers

Inside your signed-in borrower portal, the loan assistant uses a limited set of your own saved loan details, portal status and borrower-visible document requests, along with your recent conversation, to answer questions through our OpenAI service provider. It does not read raw documents, Social Security numbers, bank credentials, private staff notes or another borrower’s file. Saved portal information may require confirmation by your loan officer.

When the assistant cannot verify an answer, it saves your question for Michael and requests an SMS notification through Twilio. The notification links to a signed-in review page; it does not include your loan facts or question text. Michael’s answer is posted to your private chat. Your recent questions, clarification requests and his replies help adjust explanation detail and identify topics where further guidance may help. This is support personalization, not a lending or eligibility decision. A personal answer is not added to shared bot knowledge automatically; an administrator must review and publish reusable guidance separately.

Private assistant questions, answers and follow-ups are retained for up to 90 days, with cleanup as the service is used. They are available to you and authorized administrators. Private conversations are loaded from your authenticated account, not saved as message text in browser storage. You can use the privacy request options below to request your records.

1.3 Information we collect from other sources

• Credit reporting agencies — when you authorize it, we pull credit reports (soft or hard) from Equifax, Experian, and TransUnion.
• Asset, income, and account-data providers — when you authorize it, we may verify assets, income, employment, balances, accounts, or transactions through third-party services such as Plaid or a verification vendor.
• Referrals — basic contact information may come from a real-estate agent, financial advisor, prior client, or marketing partner who referred you. If you came in this way, that party will be identified to you on first contact.
• Imported contact lists — if your contact information was previously stored in a third-party CRM such as HubSpot (a prior tool we used), it may have been imported into MortgageDoor. You can request removal at any time.

2. How we use information

We use the information described in Section 1 for the following purposes:

• To provide mortgage brokering services — pre-qualification, loan origination, lender shopping, submission to wholesale lenders, processing, underwriting support, closing coordination, and post-closing follow-up.
• To communicate with you — about your loan, conditions, documents, signing appointments, status changes, and time-sensitive matters that affect your file.
• To send optional non-SMS marketing — only to people who have provided contact information for that purpose. MortgageDoor SMS Program messages are handled separately in Section 6.2 and are limited to informational and customer-care communications about mortgage inquiries and applications.
• To meet legal and regulatory obligations — including federal and state lending laws, anti-money-laundering rules, fair-lending rules, and audit / record-retention rules.
• To protect the site and prevent fraud — including logging IPs and unusual activity, rate-limiting, and revoking access where appropriate.
• To improve our service — aggregated, non-identifying analytics to understand which pages people use and where applications drop off.

3. Who we share information with

We do not sell your personal information. We share it only in the following situations:

3.1 Service providers we use to run the business

• Amazon Web Services (AWS) — document storage (S3), database hosting infrastructure, and transactional email delivery (Amazon SES). Documents are stored in encrypted S3 buckets in the United States.
• Twilio, Inc. — SMS sending and receiving, voice call routing, voicemail recording, and automated transcription, all routed through our business phone number.
• Railway — application hosting and the production database (PostgreSQL).
• Plaid — financial-account connection, balance, account, and transaction data when you authorize a connection through Plaid Link. MortgageDoor does not receive or store your bank username, bank password, or bank MFA code.
• Public website assistant — your chat, unfinished message and open/minimized preference are kept in this browser tab’s session storage so you can continue across our public pages. Saved chat expires after two hours without activity. Use “Clear chat” to remove the conversation and draft. Navigation shortcuts do not require AI. For AI answers, your message, recent conversation and the name of the public page you are viewing are sent to OpenAI’s API. The public website assistant does not read calculator inputs or private loan records. The separate signed-in loan assistant uses the limited loan information described above. Do not enter Social Security numbers, account numbers or documents in chat; use the secure borrower portal. OpenAI does not use API data to train its models.
• Authenticator services — staff/admin and borrower portal access may require two-factor authentication. A TOTP secret is stored by MortgageDoor and the codes are generated by your authenticator app of choice (e.g., Google Authenticator, Authy, 1Password). No authenticator passcode is stored in plain text.

3.2 Lenders, investors, and settlement partners

To shop and close your loan, we share your application and supporting documents with the wholesale lenders we submit to on your behalf, and with the title company, escrow officer, notary, appraiser, and homeowners-insurance carrier involved in your transaction. We only share information with the parties needed to close the loan you have selected.

3.3 Credit and verification vendors

We share what is needed to pull a credit report or verify income / assets / employment, after you have given written authorization.

3.4 Legal & safety

We may disclose information when required by law (subpoena, court order, regulator request), to enforce our agreements, to protect the rights and safety of MortgageDoor and others, or in connection with an investigation of suspected fraud.

3.5 Business transfers

If MortgageDoor is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. The successor will be bound by this Privacy Policy or a successor policy that is no less protective.

4. How we protect information

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information:

• TLS / HTTPS encryption in transit for the website, the borrower portal, and the admin app.
• At-rest encryption for stored documents in Amazon S3 and for the production database.
• Server-side encrypted storage for Plaid access tokens where Plaid is enabled, with Plaid Link handling bank authentication directly.
• Access controls that limit document and application access to authorized staff and the lenders working on your file.
• Soft-delete with audit trail for borrower and loan records before permanent purge.
• Two-factor authentication for production staff/admin accounts and borrower portal accounts.

No system is perfectly secure, and we cannot guarantee that information will never be compromised. If we ever become aware of a security incident that affects your data, we will notify you as required by California Civil Code § 1798.82 and any other applicable law.

5. How long we keep information

We retain loan-related records for the period required by federal and California lending regulations — generally five years after closing or denial, longer for certain document types. After that, records are securely destroyed unless we are required to keep them longer for tax, audit, or legal reasons.

If you never complete an application, we typically retain lead information for up to three years so we can respond if you return, after which it is purged.

Business finance, tax, receipt, transaction, allocation, and reconciliation records may be retained for at least seven years where needed for accounting, tax, audit, or business-reporting purposes. Disconnecting a linked financial account stops future sync for that connection, but previously synced records may remain where retention is required.

6. Your choices

6.1 Email

Every marketing email contains an unsubscribe link. Transactional emails about an active loan file (e.g., a missing document, a closing-disclosure reminder) cannot be turned off while your file is open, because they are required for the transaction.

6.2 SMS and Mobile Information

If you opt in to the MortgageDoor SMS Program, we may send informational and customer-care text messages regarding your mortgage inquiry, application, appointments, document requests, loan-status updates, and related customer-service communications. You may opt out of further texts at any time by replying STOP to any text from our business line. Reply HELP for assistance. Message frequency varies and will not exceed 10 messages per month. Message and data rates may apply.

No sharing of SMS mobile information. Mobile information will not be shared with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with third parties, except with service providers that assist MortgageDoor in delivering and operating the text messaging service.

For SMS compliance and audit purposes, MortgageDoor may retain your mobile telephone number, consent status, consent timestamp, form or page where consent was collected, IP address, user agent, version of the consent disclosure, opt-out status, and opt-out timestamp.

Loan application contact information may still be shared with lenders, investors, and settlement providers as described in Section 3 when needed to process the mortgage service you requested. Those parties are not permitted to use SMS opt-in data from the MortgageDoor SMS Program for their own unrelated promotional campaigns.

6.3 Calls

You may ask to be added to our internal do-not-call list at any time by replying to any text, calling (858) 531-2442, or emailing michael@mortgagedoor.net.

6.4 Cookies

You can configure your browser to refuse cookies. The site will still load, but the sign-in flow and certain forms will not work without strictly-necessary cookies.

7. California residents — CCPA / CPRA rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know — what categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose, and the categories of third parties we share it with.
• Right to delete — request that we delete your personal information, subject to legally required retention (see Section 5).
• Right to correct — request that we correct inaccurate personal information.
• Right to limit sensitive personal information — direct us not to use sensitive categories (e.g., SSN, financial-account number) beyond what's needed to perform the service.
• Right to opt out of "sale" or "sharing" — we do not sell or share personal information for cross-context behavioral advertising, but you may still request confirmation in writing.
• Right to non-discrimination — we will not deny you service, charge a different price, or provide a lower level of service because you exercised these rights.

To exercise any of these rights, email michael@mortgagedoor.net with the subject line "CCPA request" and a description of the right you are exercising. We will respond within the 45-day window required by law (extendable once by 45 days where allowed). We may need to verify your identity before fulfilling the request.

8. Children's privacy

The MortgageDoor website and services are intended for adults who are seeking mortgage financing. We do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently received information from a minor, we will delete it.

8.1 Other US state privacy laws

Several US states now have comprehensive privacy laws comparable to California's. If you are a resident of any of the following states, you have privacy rights under your state's law in addition to (or in some cases overlapping with) what we describe in Section 7:

• Colorado — Colorado Privacy Act (CPA)
• Connecticut — Connecticut Data Privacy Act (CTDPA)
• Virginia — Virginia Consumer Data Protection Act (VCDPA)
• Utah — Utah Consumer Privacy Act (UCPA)
• Texas — Texas Data Privacy and Security Act (TDPSA)
• Oregon — Oregon Consumer Privacy Act (OCPA)
• Montana, Tennessee, Iowa, Indiana, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Rhode Island — and other states with similar laws now in effect

The rights are similar in shape — access, deletion, correction, opt-out of targeted advertising / "sale", limits on processing sensitive personal information, and the right to appeal a denial. Response windows differ (typically 45–60 days). To exercise any of these rights, use our privacy request form or email michael@mortgagedoor.net and include the state you reside in. Where state law also offers an appeal right, you may appeal a denial by replying to our response email.

A note for borrowers nationwide: nonpublic personal information you give us in connection with a mortgage application is also protected under federal law (see Section 9 below). The state laws above generally do not displace federal financial-privacy protections — they sit alongside them.

9. Federal financial privacy (GLBA)

As a mortgage broker, we are also a "financial institution" under the Gramm-Leach-Bliley Act. We do not share customer nonpublic personal information — including phone numbers, SMS opt-in data, or any other contact details — with third parties or affiliates for their own marketing purposes. The information we do share with service providers and lenders is described in Section 3 and is limited to what's needed to provide the service you have asked for.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" at the top of the page will change when we do. If we make material changes that affect how we use information you have already given us, we will notify you by email or a prominent notice on the site.

11. Contact us

Privacy questions, requests, complaints — please reach out:

MortgageDoor  ·  Michael Banan, Broker/MLO · NMLS #251505 · CA DRE #02238350 · Company NMLS #2597373
Email: michael@mortgagedoor.net
Phone: (858) 531-2442

You can verify our licensing through the NMLS Consumer Access portal.