TPOTALK Privacy Policy

1. Introduction

TPOTALK, LLC ("TPOTALK," "we," "our," or "us") operates an information distribution platform designed exclusively for mortgage industry professionals located in the United States, including loan officers, lenders, vendors, and account executives (the "Platform" or "Services").

This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use our Platform. By accessing or using our Services, you agree to this Privacy Policy and our Terms of Service.

Important Notice: TPOTALK is designed exclusively for use by businesses and licensed professionals located in the United States. We do not target, market to, or knowingly accept registrations from individuals located outside the United States. We are not a lender, do not offer loans or financing, and do not provide services to consumers seeking personal financing.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

• Create an Account: Name, email address, phone number, company name, job title, business address
• Professional Credentials: NMLS number, state licenses, professional certifications
• Profile Information: Professional biography, areas of expertise, profile photo, business card information
• Payment Information: Billing address, payment method details (processed by our secure payment processor, Stripe)
• Communications: Messages sent through the Platform, support inquiries, feedback, suggestions
• Content: Program information, documents, images, videos, broadcasts, and other materials you upload or distribute
• Preferences: Communication preferences, notification settings, display preferences

2.2 Information Collected Automatically

When you use our Platform, we automatically collect:

• Device Information: IP address, browser type and version, operating system, device type, device identifiers, screen resolution
• Usage Data: Pages viewed, features used, time spent on Platform, click patterns, scroll behavior, search queries
• Log Data: Access times, referring URLs, exit pages, error logs, API calls
• Location Data: General location derived from IP address (city, state level)
• Performance Data: Page load times, response times, crashes, errors
• Cookies and Similar Technologies: Session cookies, preference cookies, analytics cookies, authentication tokens

2.3 Information from Third Parties

We may receive information from:

• NMLS and state licensing databases to verify professional credentials
• Payment processors regarding transaction status and fraud prevention
• Analytics providers regarding Platform usage patterns
• Other users who may reference or interact with your content
• Publicly available business directories and databases

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Platform Operations

• Provide, maintain, operate, and improve our Platform and Services
• Verify your professional credentials and eligibility to use the Platform
• Process your transactions and manage your subscription
• Facilitate information distribution between Platform users
• Provide customer support and respond to inquiries

3.2 Communications

• Send you service-related communications, updates, and announcements
• Send promotional and marketing communications (subject to your preferences)
• Notify you about changes to our Terms or policies
• Respond to your comments, questions, and requests

3.3 Analytics and Improvement

• Monitor and analyze usage trends to improve user experience
• Conduct research and analytics to understand how users interact with the Platform
• Develop new products, services, features, and functionality
• Train, develop, and improve machine learning and artificial intelligence models
• Create aggregated, anonymized, or de-identified data for analytics and reporting

3.4 Safety and Security

• Detect, prevent, and address fraud, security issues, and technical problems
• Protect the safety and security of users and the Platform
• Enforce our Terms of Service and other policies
• Comply with legal obligations and law enforcement requests

3.5 Business Purposes

• For internal business operations, record keeping, and audits
• To exercise our rights and defend against legal claims
• For any other purpose disclosed to you at the time of collection or with your consent

4. How We Share Your Information

4.1 With Other Platform Users

As an information distribution platform, certain information you provide (such as your professional profile, company information, business card, and content you distribute) is shared with other authorized users of the Platform as part of our core service functionality. Your profile information and content may be visible to other registered users.

4.2 With Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud hosting and data storage: Firebase/Google Cloud Platform
• Payment processing: Stripe
• Email delivery services: Resend, SendGrid
• Analytics services: For usage analysis and reporting
• Customer support tools: For help desk and ticket management
• Caching and performance: Vercel, Upstash

These providers are contractually obligated to use your information only for the purposes of providing services to us and in accordance with this Privacy Policy.

4.3 For Legal Purposes

We may disclose your information when we believe disclosure is necessary to:

• Comply with applicable laws, regulations, or legal processes
• Respond to lawful requests from government authorities, including law enforcement
• Protect the rights, property, or safety of TPOTALK, our users, or the public
• Enforce our Terms of Service and other agreements
• Detect, prevent, or address fraud, security, or technical issues
• Respond to an emergency involving danger of death or serious physical injury

4.4 Business Transfers

If TPOTALK is involved in a merger, acquisition, reorganization, bankruptcy, dissolution, sale of assets, or other business transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.5 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, marketing, or other business purposes.

4.6 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Your Privacy Rights

5.1 Rights for All Users

All users have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information, subject to legal retention requirements and our license rights
• Opt-Out of Marketing: Opt out of promotional and marketing communications at any time
• Data Portability: Request your data in a commonly used, machine-readable format
• Account Termination: Close your account at any time through your account settings

5.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (including our license rights under the Terms of Service).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You may opt out of the "sale" or "sharing" of your personal information. TPOTALK does not sell your personal information for monetary consideration. We may share information with service providers as described in this policy.
• Right to Limit Use of Sensitive Personal Information: You may limit the use and disclosure of sensitive personal information to what is necessary to perform our services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of Personal Information Collected: In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, phone number, IP address)
• Professional information (NMLS number, licenses, job title, company)
• Commercial information (subscription history, transaction records)
• Internet and network activity (usage data, browsing history on our Platform)
• Geolocation data (derived from IP address, state/city level only)
• Audio, electronic, and visual information (profile photos, uploaded media)
• Inferences drawn from the above (user preferences, interests)

Categories of Personal Information Disclosed for Business Purposes: We have disclosed Identifiers, Professional information, and Commercial information to our service providers for hosting, payment processing, email delivery, and analytics.

Categories of Personal Information Sold or Shared: We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising.

5.3 Other State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with privacy laws have similar rights to access, correct, delete, and obtain a copy of their personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. To exercise these rights, please contact us using the information provided in Section 11.

5.4 How to Exercise Your Rights

To exercise any of your privacy rights, you may:

• Submit a request through our Contact Form
• Manage settings through your account preferences
• Email us at: legal [at] tpotalk [dot] com

We will verify your identity before processing your request. We may require you to provide additional information to verify your identity, such as confirming information we have on file. We will respond within the timeframes required by applicable law (generally 45 days for California residents, with a possible 45-day extension for complex requests).

5.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. To do so, you must provide the agent with written authorization, and the agent must submit proof of authorization when making the request. We may still require you to verify your identity directly.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your use of our Platform. Cookies are small data files stored on your device that help us improve your experience.

6.1 Types of Cookies We Use:

• Essential Cookies: Required for Platform functionality (authentication, security, session management). These cannot be disabled.
• Functional Cookies: Remember your preferences, settings, and choices
• Analytics Cookies: Help us understand how users interact with our Platform, measure performance, and improve services
• Performance Cookies: Help us monitor and improve Platform performance

6.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or alert you when cookies are being sent. Note that disabling certain cookies may affect Platform functionality and your user experience.

6.3 Do Not Track

Our Platform does not currently respond to "Do Not Track" browser signals because there is no industry-standard interpretation of this signal for business-to-business platforms. We treat all users consistently regardless of DNT settings.

7. Data Security

We implement appropriate technical, administrative, and physical security measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication including multi-factor authentication options
• Regular security assessments, penetration testing, and vulnerability scanning
• Access controls limiting employee access to personal information on a need-to-know basis
• Incident response procedures for potential data breaches
• Employee training on data protection and security practices
• Secure data centers with physical security controls
• Regular backups and disaster recovery procedures

While we strive to protect your information using commercially reasonable measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Platform at your own risk.

If you believe your account has been compromised, please contact us immediately at legal [at] tpotalk [dot] com.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy and our Terms of Service, unless a longer retention period is required or permitted by law.

• Account Information: Retained while your account is active and for 30 days after account deletion to allow for account recovery, plus any additional period required by law
• Transaction and Payment Records: Retained for 7 years for tax, legal, and compliance purposes
• Communications and Messages: Retained for 3 years for business records and dispute resolution
• Usage Analytics: Retained in identifiable form for 2 years; aggregated or anonymized data may be retained indefinitely
• Legal Hold: Information subject to litigation, investigation, or audit may be retained longer as required

Note on Content License: As described in our Terms of Service, we retain a license to use User Content even after deletion. This means certain content may be retained in backups, archives, AI training data, or distributed copies as permitted under that license.

After the applicable retention period expires, we will securely delete or anonymize your personal information in accordance with our data retention policies.

9. Children's Privacy

Our Platform is designed exclusively for mortgage industry professionals and is not intended for individuals under 18 years of age. We do not knowingly collect, use, or disclose personal information from anyone under 18.

If we learn that we have collected personal information from a person under 18, we will delete that information promptly. If you believe we have collected information from a minor, please contact us immediately at legal [at] tpotalk [dot] com.

10. Geographic Scope

United States Only: TPOTALK is designed exclusively for use by businesses and licensed professionals located in the United States. We do not target, market to, or knowingly accept registrations from individuals located outside the United States.

Our Platform is hosted in the United States, and all data is processed and stored in the United States. By using our Platform, you acknowledge that your information will be processed in the United States in accordance with U.S. law.

If you access the Platform from outside the United States, you do so at your own risk and are responsible for compliance with local laws. We make no representations that the Platform is appropriate or available for use in locations outside the United States.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you of material changes by email or through a prominent notice on our Platform
• Where required by law, obtain your consent to the changes

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must stop using the Platform.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about our data practices, please contact us:

For California residents: You may also designate an authorized agent to make a request on your behalf. To do so, provide written authorization to your agent and have your agent contact us with proof of authorization.

We aim to respond to all privacy inquiries within 30 days. For requests under CCPA/CPRA or other state privacy laws, we will respond within the timeframes required by applicable law.

13. Email Communications

In compliance with the CAN-SPAM Act and similar regulations:

• We will clearly identify ourselves in all commercial emails
• We will provide a clear way to opt out of marketing emails in every promotional message
• We will honor opt-out requests within 10 business days
• We will not use deceptive subject lines or false header information
• Service-related emails (account notifications, security alerts, transaction confirmations, policy updates) are not marketing communications and will be sent regardless of marketing preferences

To unsubscribe from marketing emails, click the "unsubscribe" link at the bottom of any marketing email or update your preferences in your account settings.

14. Dispute Resolution

Any disputes arising from or relating to this Privacy Policy or your privacy rights shall be resolved in accordance with the Dispute Resolution, Arbitration, and Class Action Waiver provisions set forth in our Terms of Service.

This includes the binding arbitration agreement, class action waiver, jury trial waiver, and one-year limitation period on claims.