Privacy Policy

This Privacy Policy explains what information MortgageDoor (mortgagedoor.net and the related borrower portal) collects, how that information is used, who we share it with, and the choices you have. We are a California-licensed mortgage broker, and we are committed to handling your information responsibly.

Heads up: mortgage applications involve sensitive financial data. Where the law (federal Gramm-Leach-Bliley Act, the California Consumer Privacy Act / CPRA, and similar) gives you specific rights, this policy describes how to exercise them.

1. Information we collect

1.1 Information you give us directly

• Contact information — name, email address, phone number, mailing/property address.
• Loan application information (the 1003) — date of birth, Social Security number, employment, income, assets, liabilities, marital status, dependents, citizenship status, military status, and other financial details required for an underwriting decision.
• Documents you upload — pay stubs, W-2s, tax returns, bank statements, identification, real estate contracts, insurance declarations, and other supporting files.
• Communications — emails, text messages, voicemail recordings, and call recordings that you send to or receive from us through the portal, our Twilio business phone number, or our published email addresses.
• Account credentials — your portal username (email) and a salted password hash. We never store your password in plain text.

1.2 Information we collect automatically

• Device & usage data — IP address, browser type and version, operating system, pages viewed, referring URL, time stamps. Used for security logging and to improve the site.
• Cookies & similar technologies — strictly necessary cookies for sign-in, CSRF protection, and session state. We do not currently use third-party advertising cookies.
• Email engagement — when you open or click links inside emails we send, our system records that event so we can confirm delivery and follow up appropriately. You can opt out at any time (see Section 6).
• SMS and voice metadata — when we exchange texts or calls with you through our Twilio business line, we record sender / recipient phone numbers, time stamps, message content, and (for inbound calls) call recordings and automated transcripts. Our outbound voice greeting discloses that calls may be recorded; by remaining on the line you consent to that recording.

1.3 Information we collect from other sources

• Credit reporting agencies — when you authorize it, we pull credit reports (soft or hard) from Equifax, Experian, and TransUnion.
• Asset and income verification providers — when you authorize it, we may verify your assets, income, or employment through third-party services such as a verification of employment vendor or a deposit / asset verification platform.
• Referrals — basic contact information may come from a real-estate agent, financial advisor, prior client, or marketing partner who referred you. If you came in this way, that party will be identified to you on first contact.
• Imported contact lists — if your contact information was previously stored in a third-party CRM such as HubSpot (a prior tool we used), it may have been imported into MortgageDoor. You can request removal at any time.

2. How we use information

We use the information described in Section 1 for the following purposes:

• To provide mortgage brokering services — pre-qualification, loan origination, lender shopping, submission to wholesale lenders, processing, underwriting support, closing coordination, and post-closing follow-up.
• To communicate with you — about your loan, conditions, documents, signing appointments, status changes, and time-sensitive matters that affect your file.
• To send marketing messages — only to people who have provided contact information for that purpose or consented (for SMS) on a form that included specific opt-in language. You can opt out any time.
• To meet legal and regulatory obligations — including federal and state lending laws, anti-money-laundering rules, fair-lending rules, and audit / record-retention rules.
• To protect the site and prevent fraud — including logging IPs and unusual activity, rate-limiting, and revoking access where appropriate.
• To improve our service — aggregated, non-identifying analytics to understand which pages people use and where applications drop off.

3. Who we share information with

We do not sell your personal information. We share it only in the following situations:

3.1 Service providers we use to run the business

• Amazon Web Services (AWS) — document storage (S3), database hosting infrastructure, and transactional email delivery (Amazon SES). Documents are stored in encrypted S3 buckets in the United States.
• Twilio, Inc. — SMS sending and receiving, voice call routing, voicemail recording, and automated transcription, all routed through our business phone number.
• Railway — application hosting and the production database (PostgreSQL).
• Anthropic, PBC — when you ask our website chatbot a general question, your message and our system prompt are sent to Anthropic's Claude API to generate a reply. We do not send sensitive financial information to the chatbot. Anthropic does not use API content to train models.
• Authenticator services — if you enable two-factor authentication for staff/admin access, a TOTP secret is stored locally and the codes are generated by your authenticator app of choice (e.g., Google Authenticator, Authy, 1Password). No second-factor data leaves your device.

3.2 Lenders, investors, and settlement partners

To shop and close your loan, we share your application and supporting documents with the wholesale lenders we submit to on your behalf, and with the title company, escrow officer, notary, appraiser, and homeowners-insurance carrier involved in your transaction. We only share information with the parties needed to close the loan you have selected.

3.3 Credit and verification vendors

We share what is needed to pull a credit report or verify income / assets / employment, after you have given written authorization.

3.4 Legal & safety

We may disclose information when required by law (subpoena, court order, regulator request), to enforce our agreements, to protect the rights and safety of MortgageDoor and others, or in connection with an investigation of suspected fraud.

3.5 Business transfers

If MortgageDoor is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. The successor will be bound by this Privacy Policy or a successor policy that is no less protective.

4. How we protect information

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information:

• TLS / HTTPS encryption in transit for the website, the borrower portal, and the admin app.
• At-rest encryption for stored documents in Amazon S3 and for the production database.
• Access controls that limit document and application access to authorized staff and the lenders working on your file.
• Soft-delete with audit trail for borrower and loan records before permanent purge.
• Optional two-factor authentication on staff/admin accounts.

No system is perfectly secure, and we cannot guarantee that information will never be compromised. If we ever become aware of a security incident that affects your data, we will notify you as required by California Civil Code § 1798.82 and any other applicable law.

5. How long we keep information

We retain loan-related records for the period required by federal and California lending regulations — generally five years after closing or denial, longer for certain document types. After that, records are securely destroyed unless we are required to keep them longer for tax, audit, or legal reasons.

If you never complete an application, we typically retain lead information for up to three years so we can respond if you return, after which it is purged.

6. Your choices

6.1 Email

Every marketing email contains an unsubscribe link. Transactional emails about an active loan file (e.g., a missing document, a closing-disclosure reminder) cannot be turned off while your file is open, because they are required for the transaction.

6.2 Text messages (TCPA) and mobile information

You may opt out of further texts at any time by replying STOP to any text from our business line. Reply HELP for help. Message and data rates may apply. Standard frequency: up to 10 messages per month for marketing; transactional messages are sent as needed to close the loan.

No sharing of mobile information. We do not share, sell, rent, or otherwise transfer your mobile phone number or your SMS consent (opt-in) status to third parties or affiliates for their marketing or promotional purposes. The only parties that may see your mobile number are: (a) our SMS / voice carrier Twilio, strictly to deliver messages and calls on our behalf; (b) the wholesale lender and settlement providers (title, escrow, appraiser, insurance) that are processing your specific loan transaction, only where their participation requires a callback number; and (c) law enforcement or regulators where required by law. Mobile information collected through our text-message program is never made available to data brokers, lead-resale platforms, or unrelated advertisers.

Your phone number and SMS consent are tied to your specific opt-in event on this site. Withdrawal of consent (replying STOP, or asking us in writing) ends both marketing texts and any voluntary SMS reminders. Transactional notices required to close an in-flight loan may continue through other channels (email or portal).

6.3 Calls

You may ask to be added to our internal do-not-call list at any time by replying to any text, calling (858) 531-2442, or emailing michaelb@mortgagedoor.net.

6.4 Cookies

You can configure your browser to refuse cookies. The site will still load, but the sign-in flow and certain forms will not work without strictly-necessary cookies.

7. California residents — CCPA / CPRA rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know — what categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose, and the categories of third parties we share it with.
• Right to delete — request that we delete your personal information, subject to legally required retention (see Section 5).
• Right to correct — request that we correct inaccurate personal information.
• Right to limit sensitive personal information — direct us not to use sensitive categories (e.g., SSN, financial-account number) beyond what's needed to perform the service.
• Right to opt out of "sale" or "sharing" — we do not sell or share personal information for cross-context behavioral advertising, but you may still request confirmation in writing.
• Right to non-discrimination — we will not deny you service, charge a different price, or provide a lower level of service because you exercised these rights.

To exercise any of these rights, email michaelb@mortgagedoor.net with the subject line "CCPA request" and a description of the right you are exercising. We will respond within the 45-day window required by law (extendable once by 45 days where allowed). We may need to verify your identity before fulfilling the request.

8. Children's privacy

The MortgageDoor website and services are intended for adults who are seeking mortgage financing. We do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently received information from a minor, we will delete it.

8.1 Other US state privacy laws

Several US states now have comprehensive privacy laws comparable to California's. If you are a resident of any of the following states, you have privacy rights under your state's law in addition to (or in some cases overlapping with) what we describe in Section 7:

• Colorado — Colorado Privacy Act (CPA)
• Connecticut — Connecticut Data Privacy Act (CTDPA)
• Virginia — Virginia Consumer Data Protection Act (VCDPA)
• Utah — Utah Consumer Privacy Act (UCPA)
• Texas — Texas Data Privacy and Security Act (TDPSA)
• Oregon — Oregon Consumer Privacy Act (OCPA)
• Montana, Tennessee, Iowa, Indiana, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Rhode Island — and other states with similar laws now in effect

The rights are similar in shape — access, deletion, correction, opt-out of targeted advertising / "sale", limits on processing sensitive personal information, and the right to appeal a denial. Response windows differ (typically 45–60 days). To exercise any of these rights, use our privacy request form or email michaelb@mortgagedoor.net and include the state you reside in. Where state law also offers an appeal right, you may appeal a denial by replying to our response email.

A note for borrowers nationwide: nonpublic personal information you give us in connection with a mortgage application is also protected under federal law (see Section 9 below). The state laws above generally do not displace federal financial-privacy protections — they sit alongside them.

9. Federal financial privacy (GLBA)

As a mortgage broker, we are also a "financial institution" under the Gramm-Leach-Bliley Act. We do not share customer nonpublic personal information — including phone numbers, SMS opt-in data, or any other contact details — with third parties or affiliates for their own marketing purposes. The information we do share with service providers and lenders is described in Section 3 and is limited to what's needed to provide the service you have asked for.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" at the top of the page will change when we do. If we make material changes that affect how we use information you have already given us, we will notify you by email or a prominent notice on the site.

11. Contact us

Privacy questions, requests, complaints — please reach out:

MortgageDoor  ·  Michael Banan, Broker · NMLS #2597373 · CA DRE #02238350
Email: michaelb@mortgagedoor.net
Phone: (858) 531-2442

You can verify our licensing through the NMLS Consumer Access portal.