Privacy Policy

1. Who this policy covers

Understanding our role depends on which of these you are.

Loan officers (our customers)

If you create an account, you are our customer. We collect your information directly from you, and we are responsible for how we handle it. This policy describes that handling.

If your account was set up for you by your company, that company pays for it and administers it. Its administrator sets the company name, NMLS, and address that appear on your profile, can see your name, email address, NMLS number, role, how many borrower reports you have published, how many times you have published or updated one, and when you last published, and where you stand on billing (section 6 lists exactly what that shows), and can remove your access. They cannot read the contents of your reports or the borrower information in them. Everything else in this policy applies to you exactly as it does to a loan officer who signed up alone: your reports, contacts, and settings are yours, and they stay with your account if you leave the company.

Borrowers (our customers' clients)

If you are a borrower, we did not get your information from you — your loan officer entered it. We store and process it on their behalf and on their instructions, so they can build you a loan comparison. In privacy terms, your loan officer (and their company) decides what is collected and why; we are their service provider.

Practically, that means: if you want your information corrected or deleted, start with your loan officer — they control the record and can change or delete it directly. You can also contact us at support@ask.mortgage and we will help, but in most cases we will need to work through the loan officer who holds the relationship with you.

Real estate agents

A loan officer can save a real estate agent’s details and show them on a marketing comparison, for example one made for an open house. As with borrowers, the loan officer entered that information, not us, and we hold it on their behalf. What is stored is listed in section 3G. Anything shown on a published marketing comparison is public, as section 4 explains.

Website visitors

If you use a form or the chat on ask.mortgage, you give us your information directly, and this policy describes how we handle it. Section 3H lists what we collect, and section 16 covers text messages.

2. What we do not do

It is easier to trust a privacy policy that says what isn't happening. As of the effective date above, all of the following are true of our software:

• We do not sell personal information. Not to lenders, not to advertisers, not to lead buyers, not to data brokers, not to anyone.
• We do not use advertising or tracking technology. There is no Google Analytics, no advertising pixel, no remarketing tag, no session-replay tool, and no cross-site tracking anywhere in our product.
• We do not market to borrowers or real estate agents. If a loan officer entered your information, we will not email you, text you, or advertise to you.
• We do not collect borrower income. There is no income field, and no household size, assets, employment, Social Security number, or date of birth field anywhere in the Service. We designed it that way deliberately.
• We do not pull credit or obtain credit reports. We are not a consumer reporting agency. Any credit score in the Service was typed in by a loan officer.
• We do not show a company administrator the contents of their loan officers' reports. On a company plan an administrator sees counts, dates, and each officer’s billing status, not the reports themselves and not the borrowers in them.
• We do not build profiles across sites or sell insights derived from your data.
• We do not share text-message opt-in data or consent records with anyone for marketing, promotional, or any other purpose unrelated to providing our services. Section 16 explains who receives them and why.
• We do not use your data to train AI models, and the provider behind our in-app assistant does not use what we send it to train its models.

If any of this changes, we will update this policy — and, where consent is required, ask for it — before the change takes effect.

3. Information we collect

A. Loan officer account and profile information

Provided by you when you register and set up your profile:

• Name, email address, and password (stored only as a salted hash by our authentication provider — we never see or store your plaintext password).
• Business details: company name, team or DBA name, company address, company website, phone numbers, and your loan application URL.
• Licensing details: your NMLS number, your company's NMLS number, and the states you are licensed in.
• Branding images: headshot, personal logo, company logo, team/DBA logo. See the note below — these are stored publicly.
• Your default fee assumptions, scenario templates, and fee templates.
• The wording you save for the copy-ready emails that share a report — a subject, greeting, introduction and closing, in English or Spanish. We store the wording only: the draft opens in your own email program, so we never send it and keep no copy of what you sent.
• Display choices you make for the reports you publish: the colors, any links you add to your profile (each a label and a web address), and the welcome paragraph and short bio you write for the borrower page — these are shown to anyone who opens a report you publish. If you belong to a company, it may set these for you — see the Terms of Service, section 4.
• If you are on a company’s Team plan: which company you belong to, your role in it, and any invitations you have received or answered.
• Your free trial dates, when you last signed in, and how many borrower reports you have published.
• Support requests you send us, including the page you were on, your browser type, and the IP address the request came from.

B. Borrower information — entered by loan officers

To build a comparison, a loan officer may enter, and we may store:

• Borrower name and contact information — only if the loan officer chooses to enter it. This can include email address, phone number, current address, the address of the property involved, the loan officer’s notes, and a status the loan officer assigns. These fields are optional. They exist so a loan officer can keep their own client list organized, not because the comparison needs them. A report can be built without any borrower identity at all. Email addresses, phone numbers, and notes are never shown on a borrower report.
• A credit score used for pricing. See the note below — this is not what it may sound like.
• Veteran status, VA entitlement usage, and whether the borrower is exempt from the VA funding fee because of a service-connected disability, where relevant to VA loan pricing.
• Whether the borrower has an existing FHA loan.
• Subject property details: address, ZIP code, state, property type, occupancy type, estimated value or purchase price, property taxes, homeowners insurance, and HOA dues.
• For a refinance: the balance, interest rate, monthly payment, mortgage insurance, original amount, term, and closing date of the current mortgage, and the balance and payment of any second mortgage.
• Other debts the loan officer chooses to include, such as in a debt-consolidation comparison: a description, the balance, and the monthly payment of each.
• Loan assumptions and outputs: loan amounts, rates, points, fees, closing costs, cash to close, payment figures, and the resulting comparison scenarios and saved reports.

That is the complete list. It is stored so loan officers can save, revisit, and share the comparisons they build, and we use it for nothing else.

C. Billing information — loan officers with a paid plan

If you subscribe to a paid plan, payments are processed by Stripe. What each party holds is different, and the distinction matters:

• Stripe holds your payment details. Card number, expiry, security code, and billing address are entered directly with Stripe. We never receive, transmit, or store them, and they do not pass through our servers at any point.
• We hold a record of your subscription: your Stripe customer and subscription identifiers, the plan you chose, your subscription status, the date your current paid period ends, and whether you have cancelled.
• We hold the end date of your free trial. This is the only billing-related thing we store for accounts that have never subscribed, and it is a single date. Starting a trial requires no payment method, so there is nothing else to hold — no card, no Stripe customer, no billing address.
• We record your agreement to the billing terms: the version of the Terms of Service in effect when you subscribed, and the IP address the subscription was started from. This is kept so that both sides have a record of what was agreed and when.

We use this only to determine whether your account has an active plan, to provide support, and to meet our tax and record-keeping obligations. Stripe processes payment information as an independent controller under its own privacy policy.

D. Technical information collected automatically

When you use the Service, our hosting and infrastructure providers generate ordinary operational records — IP address, browser and device type, timestamps, requested pages, authentication events, and error logs. We use these to keep the Service running, secure, and debuggable. We do not use them to profile, target, or track anyone across sites.

When something in the Service fails, we also record the failure in our own database so we can fix it: the error message, the page path (never the rest of the address, which can contain a report link), the browser type, the version of the app, and the account that was signed in, if any. Email addresses and link codes are removed before an error is saved.

E. Information we do not receive

We do not receive credit reports, loan origination system feeds, CRM or contact-list feeds, pricing engine data, or other third-party financial data. No other system sends us information about you. A loan officer may upload their own spreadsheet of real estate agents (section 3G) — that is a file they choose to give us, not a feed from another system. If we ever add such an integration, we will update this policy before it goes live.

F. Feedback you send us

If you tell us why you decided not to subscribe, by choosing reasons on our feedback page or writing a note, we store your answer with your account and add it to your record in our customer relationship tool (see section 6). Sending feedback is optional.

G. Real estate agent information — entered by loan officers

A loan officer may save a real estate agent’s name, brokerage, license number, phone number, and email address. If the loan officer shows that agent on a marketing comparison, those details appear on it, and the comparison keeps its own copy of them even if the saved agent is later deleted.

H. Website visitors

The forms on ask.mortgage collect what you type into them, such as your name, email address, company, and the loan origination system you use. The chat on the website collects what you type into it, including your name, email address, and phone number if you give them, and records your text-message choice as described in section 16. Both go to our customer relationship tool (see section 6). To limit abuse of the forms, we keep a one-way scrambled (hashed) form of your IP address for up to seven days, which cannot be turned back into the address.

If you schedule an appointment or meeting with us through the chat, we keep its details. Our website hosting and chat providers also record your IP address, browser and device type, and the pages you request, to operate and secure the website; section 8 describes what the chat keeps in your browser and what it passes to us about how you arrived.

We are a software company, not a lender or mortgage broker, and we cannot take loan applications. We do not collect payment information, Social Security numbers, credit information, or loan applications through the website or its chat. Please do not enter Social Security numbers, bank account or login details, or financial documents in the forms or the chat.

I. The in-app assistant

If a loan officer uses the assistant, the instruction they type and the comparison they have open are sent to our AI provider to work out the requested change (see section 6). We do not store the instruction. We keep a usage record — when the assistant was used, whether it succeeded, how many changes it made and to which fields, and whether they were undone — for up to 90 days, to enforce usage limits and to see whether the feature works.

J. A message a borrower sends their loan officer

On some borrower report links there is a Send button that lets you write a question — or tell your loan officer which option you would like to discuss — and have it reach them without opening your own email program. If you use it, we email what you typed to your loan officer, together with your name and the property address as they already appear on the report they prepared for you — the page asks you for nothing about yourself. We do not store what you write. It is delivered through our customer relationship tool (see section 6), so a copy sits in your loan officer’s records there, alongside the rest of their correspondence with you. If you are telling them which option you prefer, we send the option’s details as they appear in the report they published, not as anything the page could have altered, along with any note you add. We keep only a count of how many messages have been sent from a link, and when the last one was, so that a link cannot be used to send unlimited email. Using the button is optional: every one of these pages also offers your own email program and your loan officer’s phone number.

4. Borrower report links are public by design

A report's link also stops working immediately if the loan officer archives or deletes the report. Report data is never carried inside the link itself — the link is only a reference to a stored report, which is what allows it to be expired and revoked. Loan officers can see how many times each link has been opened, and when it was first and last opened. We do not record who opened a link, their IP address, or their device. If you believe a link has been exposed, contact us at support@ask.mortgage and we can deactivate it.

5. How we use information

We use the information described above only to:

• Create and authenticate accounts and keep you signed in.
• Operate the Service — generate comparisons, build reports, save contacts and templates, and serve borrower report links.
• Provide support when you contact us, and send you transactional messages about your account, security, and material changes to the Service or our policies.
• If you signed up yourself: send you emails about getting started and about your free trial — a reminder to finish your profile, a notice before and when your trial ends, and a request for feedback if you decide not to subscribe. Each has an unsubscribe link. Unsubscribing does not stop transactional messages about your account.
• Keep track of our relationship with loan officers and with people who contact us through the website, and answer them — including, if you opted in, by the text messages described in section 16.
• If you opted in through the chat, send you promotional text messages about Ask Mortgage software (section 16); and send marketing email to people who gave us their email address on the website, which you can stop with the unsubscribe link in any of them.
• Apply the changes a loan officer asks the in-app assistant to make.
• Keep the Service secure, available, and working — monitoring, troubleshooting, backups, and abuse prevention.
• Investigate fraud, abuse, or violations of our Terms of Service.
• Comply with the law and respond to lawful requests.

We do not use borrower or real estate agent information for our own marketing, product analytics, advertising, or model training.

6. How we share information

We share information in the situations below, and no others:

• Infrastructure providers. The Service runs on Supabase (database, authentication, file storage) and Cloudflare (hosting and content delivery). They process data on our behalf to run the Service. They are not permitted to use it for their own purposes.
• Account email. Sign-in, password-reset, and company-invitation emails are sent through Google (Google Workspace) from support@ask.mortgage.
• Payment processing. If you subscribe to a paid plan, Stripe processes your payment and holds your card details. We send Stripe your email address and an internal account identifier so your subscription can be matched to your account. For a Team plan we also send the company’s name and the email address of the person managing it. When you subscribe we record, on the Stripe subscription, the version of the Terms you agreed to and the IP address you subscribed from. No borrower information is ever sent to Stripe.
• Customer relationship management. We use HighLevel (LeadConnector) to manage our relationship with loan officers and website visitors, to send the emails described in section 5, to run the website chat, and to send text messages to people who opted in (section 16). For each account we send it your name, email address, phone number, company name, NMLS number, account status (for example, on a trial or on a paid plan), your trial dates, when you last signed in, how many borrower reports you have published, and any feedback you send us. It also receives what you enter in the website forms and chat. No borrower or real estate agent information is sent to HighLevel, with one exception: a message a borrower chooses to send their loan officer from a report link (section 3J) is delivered through it, together with the borrower’s name and property address as they appear on that report. It processes this information on our behalf and is not permitted to use it for its own marketing.
• The in-app assistant. When a loan officer uses it, the instruction and the open comparison are sent to Anthropic, our AI provider, to work out the change. That can include a borrower’s name, the property address, credit score used for pricing, veteran details, current mortgage and debt figures, and the loan options and fees. It never includes borrower email addresses or phone numbers, or contact records. Anthropic processes it to provide the assistant and does not use it to train its models.
• Support requests. A support request sent from the app is stored in our database and also forwarded to a workflow-automation server operated for us by MCTB Tech, a company under the same ownership as Ask Mortgage, so that it reaches us. It carries only what an email needs: your message and the topic you chose, your name, and your email address. It does not carry your profile details, your account identifier, or the page you were on — those stay in our database. MCTB Tech uses it only to route your request to us.
• With the borrower's loan officer. Borrower information is visible to the loan officer who entered it — that is the entire point of the product.
• With your company, if your account is on its Team plan. A company administrator can see, for each loan officer on their roster, that officer's name, email, NMLS, role, whether they have accepted their invitation, how many borrower reports they have published, how many times they have published or updated one, and when they last published, and where that officer stands on billing: whether the company is paying for their seat, they pay for their own subscription, they have complimentary access, they are on a free trial (and how many days of it remain), or they have not subscribed. They cannot read those reports or any borrower information in them. This is visibility inside the company that pays for the account rather than disclosure to an outside party, and it exists so a brokerage can manage the seats it is being billed for.
• Legal and safety. We may disclose information when required by law, subpoena, court order, or legal process, or when we reasonably believe disclosure is necessary to investigate fraud, prevent harm, or enforce our agreements.
• Business transfers. If Ask Mortgage is involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction, subject to confidentiality protections. We will not allow personal information to be used in ways inconsistent with this policy without giving notice first.

Published reports. A loan officer who publishes a report makes it available to anyone with the link, as section 4 explains. That includes a real estate agent’s details shown on a marketing comparison.

We do not share information with lenders, advertisers, lead buyers, or data brokers.

None of the sharing above includes text-message opt-in data or consent. Those are shared only as section 16 describes: with the providers that deliver our text messages and support them, and with no one else.

7. Financial privacy, GLBA, and Regulation P

Mortgage-related information — credit score, income, assets, employment, loan terms — can be “nonpublic personal information” under the Gramm-Leach-Bliley Act and Regulation P. Those rules generally require a covered financial institution to give consumers a privacy notice and to limit how it discloses their information.

Ask Mortgage is not a lender, broker, or financial institution. We are a software provider to mortgage professionals, and we process borrower information as their service provider. The obligation to give borrowers a GLBA/Regulation P privacy notice rests with the loan officer's licensed company, not with us — and using Ask Mortgage does not satisfy or replace that obligation.

8. Cookies and similar technologies

We use only what is necessary to make the Service work, stored in your browser rather than in cookies. Specifically, we store:

• a login session, so you stay signed in;
• that a borrower has acknowledged the report disclosure, for the duration of their visit;
• on the borrower page, which loan options you have selected to discuss — kept in your own browser and never sent to us;
• your display theme, whether you dismissed the reminder to finish your profile, and when you last sent a support request (to prevent accidental repeats);
• a temporary copy of a report you open for preview or printing, so the new tab can show it. It stays in your own browser and is never sent anywhere.

On the ask.mortgage website, the chat window is provided by HighLevel. It keeps a conversation identifier and a record of your visit in your browser so the chat works as you move between pages, and when you send a message it passes HighLevel how you arrived: the page you were on, the site that referred you, any campaign tags in the web address, your browser type, and your IP address. HighLevel’s security provider may set a short-lived bot-protection cookie on HighLevel’s own domain, and the chat loads its fonts from its own providers. The pages load fonts from Google Fonts, which receives your IP address as part of delivering them. Neither is loaded in the product or on borrower reports.

We do not use advertising cookies, marketing pixels, or third-party analytics or tracking cookies of any kind. There is no cookie banner because there is nothing to consent to beyond the strictly necessary session storage described above. If we add analytics or any tracking technology later, we will update this policy — and add any legally required consent mechanism — before turning it on.

Blocking browser storage entirely will prevent you from staying signed in, and may stop the website chat from working.

9. Data retention

Here is exactly how long we keep things, and how to make them go away sooner.

• Your account and everything in it — profile, contacts, reports, templates — is kept for as long as your account is open.
• Closing your account starts a 30-day grace period, after which a scheduled job permanently deletes your data — normally within a day of the grace period ending — apart from the exceptions noted below. When you close your account we prepare a download of your records, and deletion waits until that download exists, so your records are never deleted without one being available to you. You can close your account yourself under Settings → Billing; you do not have to email us, though you still can at support@ask.mortgage if you would rather. Closing stops future charges immediately. The 30 days is a grace period in case the closure was a mistake — you can sign in and cancel it at any point before the date shown in your account, and you will see that date every time you sign in. After it passes the data is gone and cannot be recovered.
• Deleting a contact removes it immediately, along with everything prepared for that person. No recycle bin and no grace period. The contact record, any properties saved under it, and any reports prepared for that contact are all deleted, and the borrower links those reports published stop working at once. Archiving a contact, which is reversible, leaves all of it in place; deleting does not.
• Archiving a report immediately kills its borrower link. The report itself stays in the loan officer’s account so they can refer back to it, and archiving can be undone.
• Deleting a report removes it immediately, and kills its borrower link with it. No recycle bin and no grace period. Loan officers can do this themselves in the app — deletion is not something you have to email us for. Publication records are the one exception and are kept as described below.
• Borrower report links on client reports expire 120 days after the report was last published. Marketing comparisons contain no borrower information, so their links do not expire.
• Billing records. When an account is deleted we keep a record of its subscription — your email address, the Stripe identifiers, the plan, its status, and the paid-through date — for 7 years. Tax and accounting rules require it. Invoices, receipts, and the Terms version and IP address recorded when you subscribed are held by Stripe, together with your card details, under Stripe’s own retention policy. Closing your account still stops all future charges immediately.
• Your record in our customer relationship tool (HighLevel) is not deleted when you close your account. It is kept until you ask us to delete it, which you can do at any time by email. Feedback you sent us is deleted from our database with your account.
• Support requests are deleted when your account is deleted. Requests sent without an account are kept as long as we need them to answer and follow up.
• Assistant usage records are kept for up to 90 days, and hashed IP addresses from the website forms for up to 7 days.
• Operational and security logs (IP addresses, request records) are generated by our hosting providers and kept only as long as needed to run the Service securely and investigate abuse. Our own error records (section 3D) are deleted 90 days after the error last occurred.
• Backups. Deleted data may persist in our provider's encrypted backups for a short period before those backups rotate in the ordinary course. We do not restore a backup to recover data someone asked us to delete.

10. Security

We use reasonable administrative and technical safeguards appropriate to the sensitivity of the information we handle, including encryption in transit, encryption at rest through our infrastructure providers, authenticated access with row-level authorization so that loan officers can only reach their own records, and hashed password storage.

No system is perfectly secure, and we cannot guarantee absolute security. The most likely way borrower information is exposed through this Service is not a breach of our systems — it is a report share link being sent or forwarded to the wrong person. Please re-read section 4.

If a security breach affects personal information we hold, we will notify the affected loan officers, and anyone else we are required to notify, without undue delay after we become aware of it, and as required by applicable law.

If you discover a vulnerability, report it to support@ask.mortgage. We will not pursue legal action against researchers who report issues in good faith and give us a reasonable chance to fix them.

11. Your choices and requests

Loan officers can view and edit profile information, contacts, reports, and templates directly in the app, and can archive or delete reports and contacts at any time. You can also close your account yourself under Settings → Billing, which schedules deletion of your data as described in section 9. If you would rather we did any of this for you, email support@ask.mortgage.

Website visitors can ask us to access, correct, or delete what they gave us by emailing support@ask.mortgage, can ask how we process their information, can stop marketing email with the unsubscribe link in any email, can stop text messages by replying STOP, and can withdraw consent to future communications at any time. We keep a record of consent and opt-out choices so that we can show we honored them.

Real estate agents should contact the loan officer who saved their details, or email us and we will help.

Borrowers should contact the loan officer who prepared their report — they control the record and can correct or delete it. If you cannot reach them, or you do not know who entered your information, email us at support@ask.mortgage and we will help you identify and reach the right party.

We will honor requests as required by applicable law, subject to our need to verify identity and to retain certain records for legal, security, and backup purposes. We will never charge you or discriminate against you for making a privacy request.

12. Children's privacy

The Service is a professional tool and is not directed to children. We do not knowingly collect personal information from anyone under 18 through the Service. If we learn we have, we will delete it.

13. Third-party links

Borrower reports may link to destinations a loan officer configures, such as their own loan application page or company website. The landing page may link to other resources. The chat window on our website is operated for us by LeadConnector (HighLevel), and links inside it may lead to that provider’s own terms and privacy policy, which cover its service rather than ours. We do not control those sites and are not responsible for their privacy practices. Review their policies directly.

14. Changes to this policy

We may update this policy. If we make material changes — particularly any change to what we collect, how we use it, or who we share it with — we will update the “Last updated” date, post the revised policy here, and notify account holders by email or in-product notice. Website visitors will find the revised policy here, marked by its new date. Earlier versions of this policy are published at ask.mortgage/legal, and we will send any of them on request.

15. Contact

Privacy questions, deletion and correction requests, support, and security reports all reach us by email. We read every message sent here.

Borrowers: if your question is about information a loan officer entered about you, contact that loan officer first — they control the record and can correct or delete it directly. If you cannot reach them, write to us and we will help.

16. Text messages (SMS)

Who this applies to. Only people who opt in themselves through the chat on our website. It does not change section 2: if a loan officer entered your information so they could build you a loan comparison, we will not text you.

Two separate consents. The chat window on our website, ask.mortgage, offers two text-message consents, each with its own checkbox, and both are unchecked until you check them. The first covers informational and transactional messages from Ask Mortgage Technologies LLC: replies to your inquiries, appointment and meeting scheduling and reminders, service updates, and customer support. The second covers promotional messages about Ask Mortgage software. The consent language beside each box authorizes us to text or call the number you enter, possibly using automated means, for that kind of message. You may check either box, both, or neither. Consent is not a condition of purchase.

How you opt in. Enter your mobile number in the chat’s phone field and check one or both consent boxes before you send your message. The full consent language is shown beside each box. You receive text messages only if you have opted in this way. Starting a chat does not opt you in, and neither does reading or accepting this policy or our Terms of Service. We keep a timestamped record of every opt-in.

What we send. Informational and transactional messages relate directly to the inquiry, meeting, or support request you contacted us about. Promotional messages go only to people who checked the separate promotional box — checking the informational and transactional box alone does not sign you up for them. Message frequency varies with your interactions with us.

What we collect. Your mobile number, whether you agreed or declined, the date and time of that choice, the text of the disclosure shown to you, the page you were on, your STOP and HELP requests, and the messages and calls sent to and received from you. We use it to send the messages you agreed to receive, to honor STOP and HELP requests, and to keep a record of your preference.

How you stop. Reply STOP at any time. You will receive one final message confirming your opt-out, and no further messages unless you opt in again through the chat.

Help. Reply HELP for assistance, call (888) 271-4275, or email support@ask.mortgage.

Carrier information. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

SMS data protection statement. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. The providers that deliver messages on our behalf — our chat and messaging provider, HighLevel, and the carriers and aggregators it uses — receive what they need to do that and use it for nothing else. Mobile numbers and consent records are never sold.

We send text messages in accordance with the Telephone Consumer Protection Act (TCPA) and applicable law. We use reasonable safeguards to protect SMS consent records, and we retain them for as long as we need them to show that consent was given and honored.