Privacy Policy

FlexPoint Inc. (“FlexPoint,” “we,” “our,” or “us”) is a licensed mortgage company headquartered in the United States. We originate residential mortgage loans including conventional, FHA, VA, USDA, jumbo, and non-QM products. We have been in business since 1996 and have funded over $5 billion in loans.

NMLS ID: #243082 — Verify at NMLSConsumerAccess.org
Phone: (866) 226-2205
Website: flexpointinc.com

Because FlexPoint is a financial institution regulated under the Gramm-Leach-Bliley Act (GLBA), significant portions of this policy are governed by federal financial privacy law. We also comply with the Fair Credit Reporting Act (FCRA), the Real Estate Settlement Procedures Act (RESPA), the Equal Credit Opportunity Act (ECOA), and applicable state privacy laws including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

We collect information from you in several ways: when you visit our website, when you submit an inquiry or contact form, when you apply for a mortgage loan, and through the mortgage origination and servicing process.

A. Information You Provide Directly

• Identity information: Full name, date of birth, Social Security number (SSN), government-issued ID
• Contact information: Mailing address, email address, phone number
• Financial information: Income, employment history, assets, bank account information, existing debts and liabilities, property information
• Loan application information: Loan purpose, property address, purchase price, down payment source, occupancy intent
• Website inquiries: Name, email, phone, and any information you type into our contact forms

B. Information We Collect Automatically (Website)

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage data: Pages visited, time on page, links clicked, referring URL, search terms used to find our site
• Cookies and tracking technologies: As described in Section 7 of this policy and in our Cookie Policy
• UTM parameters: Marketing campaign source, medium, and campaign name from inbound URLs

C. Information We Receive From Third Parties

• Credit bureaus: Credit reports and scores from Equifax, Experian, and/or TransUnion, obtained with your authorization during the loan application process
• Employment and income verification services: Verification of employment and income through third-party services (e.g., The Work Number / Equifax Workforce Solutions) with your authorization
• Appraisal and title companies: Property value assessments, title reports, and ownership history
• Public records: Property tax records, lien information, court records as relevant to loan underwriting
• Referring partners: Name and contact information from licensed real estate agents, builders, or other referral sources who connect clients to us
• Government databases: OFAC, SAM, and other regulatory databases checked for compliance purposes

Mortgage Origination and Servicing

• Processing, underwriting, and closing your mortgage loan application
• Verifying your identity, income, employment, assets, and creditworthiness
• Ordering appraisals, title searches, flood determinations, and other services required to originate a loan
• Communicating with you about your loan application status, required documentation, and closing
• Complying with federal and state mortgage lending regulations, including RESPA disclosures, TRID (TILA-RESPA Integrated Disclosure), and HUD requirements
• Transferring or selling mortgage loans to investors or the secondary market (Fannie Mae, Freddie Mac, Ginnie Mae, or private investors)

Business Operations and Legal Compliance

• Preventing fraud, money laundering, and other financial crimes
• Maintaining records required by RESPA, HMDA (Home Mortgage Disclosure Act), and other applicable law
• Responding to regulatory examinations, audits, subpoenas, and court orders
• Enforcing our legal rights and protecting the security of our systems
• Internal quality control, training, and performance analysis

Website and Marketing

• Operating, maintaining, and improving flexpointinc.com
• Responding to your inquiries and connecting you with a licensed loan officer
• Sending you information about loan programs, rate updates, or promotions — with your consent where required by law
• Measuring the effectiveness of our marketing campaigns through analytics tools
• Personalizing content and advertising in compliance with applicable law and our Cookie Policy

As a financial institution, FlexPoint Inc. is subject to the privacy provisions of the Gramm-Leach-Bliley Act (GLBA), codified at 15 U.S.C. § 6801–6809, and Regulation P (12 C.F.R. Part 1016). GLBA requires us to provide you with a specific notice about how we handle your “nonpublic personal information” (NPI) — any personal financial information that is not publicly available.

The table below summarizes the key facts required by Regulation P:

This summary does not constitute the full GLBA privacy notice. A complete notice is provided at application and annually as required by Regulation P. California residents see Section 12 (CCPA) for additional rights.

GLBA Opt-Out Right

Under GLBA, you have the right to opt out of certain information sharing. Specifically, you may direct us not to share your nonpublic personal information with our affiliates for their marketing purposes. To exercise this right, contact us at privacy@flexpointinc.com or by phone at (866) 226-2205. Please note that GLBA does not require us to honor opt-out requests for sharing necessary to process your loan, comply with law, or prevent fraud.

We share your personal information only as described in this policy and as permitted or required by law. The following describes the main categories of recipients and the legal basis for sharing.

Sharing Necessary to Process Your Loan

Federal law allows — and in some cases requires — us to share your information with third parties to originate, process, and close your mortgage loan. These parties are contractually obligated to protect your information and may only use it for the purpose we have specified:

• Wholesale lenders and correspondent investors who fund or purchase your loan
• Appraisers, title companies, and settlement agents
• Credit bureaus (for credit pulls and reporting)
• Flood determination and property data services
• Automated underwriting systems (Fannie Mae DU, Freddie Mac LPA)
• Employment and income verification services
• Closing attorneys and notaries
• Mortgage insurance companies (for insured loans)
• Document storage and loan origination technology providers

Sharing Required by Law or Regulation

• Federal regulators (CFPB, HUD, FHFA, and other supervisory agencies)
• State mortgage regulators in states where we are licensed
• Government-sponsored enterprises (Fannie Mae, Freddie Mac, Ginnie Mae) for loan purchase or securitization
• HMDA and CRA reporting to federal regulators
• Courts, law enforcement, and government agencies in response to valid legal process
• OFAC, SAM, and other anti-money-laundering and fraud-prevention databases

Sharing With Your Consent

We may share your information with real estate agents, builders, financial planners, or other parties you have authorized or directed us to contact. You may withdraw consent for non-mandatory sharing at any time by contacting us at privacy@flexpointinc.com.

What We Do Not Share

We do not share your nonpublic personal information with nonaffiliated third parties for their own marketing purposes, sell it to data brokers, or disclose it in ways not described in this policy without your explicit consent — except as required by law.

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., governs how we use consumer credit reports and report information to credit bureaus. Your FCRA rights are important and are summarized here.

Credit Pulls — When We Access Your Credit Report

We access your credit report only with your express written authorization. During a loan application, you will be asked to authorize a “hard” credit inquiry, which may temporarily affect your credit score. We access credit reports from Equifax, Experian, and/or TransUnion through a tri-merged report service.

Rate-shopping inquiries: if you authorize multiple mortgage lenders to pull your credit within a 14–45 day window (depending on the scoring model), credit bureaus treat those as a single inquiry under rate-shopping rules, minimizing the impact on your score.

Credit Reporting — What We Report to Bureaus

If your loan closes, we may report account information (loan amount, payment history, balance, account status) to one or more consumer reporting agencies. This reporting is required or permitted under FCRA and standard industry practice. We report accurate information as required by FCRA § 623.

Adverse Action

If we deny your loan application or take other adverse action based in whole or in part on information in a credit report, we will provide you with an adverse action notice as required by FCRA § 615. That notice will identify the credit reporting agency(ies) used and advise you of your right to obtain a free copy of your report and to dispute inaccurate information.

Your FCRA Rights

• You have the right to know what is in your credit file (one free disclosure per year from each bureau at AnnualCreditReport.com)
• You have the right to dispute inaccurate or incomplete information
• You have the right to opt out of prescreened credit and insurance offers (1-888-567-8688 or OptOutPrescreen.com)
• You have the right to seek damages from violators
• You have the right to place a security freeze or fraud alert on your credit file directly with each bureau

Our website uses cookies and similar tracking technologies including web beacons, pixels, and local storage. These are used to operate the site, understand how visitors use it, and measure the effectiveness of our advertising. We categorize cookies as Essential, Functional, Analytics, and Marketing.

For a complete description of every cookie we use, the third-party services involved, your opt-out options, and your California “Do Not Sell or Share” rights, see our Cookie Policy.

You can manage your cookie preferences at any time using the Cookie Preferences tool or by visiting the Cookie Policy page.

Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. Our website does not currently respond to DNT signals because there is no consistent industry or legal standard for how to interpret them. We will update this policy if that changes.

Email Tracking

Marketing emails we send may contain small tracking pixels that tell us whether an email was opened and whether any links in it were clicked. This helps us understand which communications are relevant to our clients. You may opt out of marketing emails at any time by using the unsubscribe link in any marketing email or by contacting us at privacy@flexpointinc.com.

FlexPoint Inc. maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of your personal and financial information, consistent with the requirements of the GLBA Safeguards Rule (16 C.F.R. Part 314), as amended by the FTC’s 2023 updates.

Our safeguards include:

• Administrative safeguards: Designation of a qualified individual responsible for our information security program; written security policies and procedures; regular employee training on data privacy and security; vendor management and due diligence on third-party service providers
• Technical safeguards: Encryption of nonpublic personal information in transit (TLS/HTTPS) and at rest; multi-factor authentication for systems containing customer data; access controls limiting data access to authorized personnel on a need-to-know basis; firewalls, intrusion detection, and monitoring systems
• Physical safeguards: Secure facilities with access controls; locked storage for physical records; secure disposal of paper and electronic records containing personal information
• Incident response: A written incident response plan; procedures for detecting, containing, and reporting security events; notification procedures consistent with applicable state breach notification laws and FTC requirements

What You Can Do to Protect Yourself

While we maintain strong security practices, you can also take steps to protect your information:

• Never send sensitive financial information (SSN, account numbers) via unencrypted email — use our secure portal or encrypted communication channels
• Verify that any communication purportedly from FlexPoint uses a legitimate @flexpointinc.com email address
• Contact us immediately at (866) 226-2205 if you believe your information has been compromised or if you receive suspicious communications claiming to be from us

We retain your personal and financial information for the periods required or permitted by applicable law and consistent with our legitimate business needs. Retention periods vary by record type:

• Closed mortgage loan records: Minimum 3 years after loan payoff under RESPA; 25 months for ECOA adverse action records; records necessary for regulatory examination retained for the applicable examination cycle
• Declined applications: 25 months from the date of adverse action notice under ECOA/Regulation B
• HMDA data: 3 calendar years from collection under Regulation C
• Credit reports and authorization: Duration of loan origination process plus applicable regulatory retention period
• Website inquiry data: Retained in our CRM system until you request deletion, opt out of all communication, or for 3 years of inactivity, whichever comes first — subject to applicable legal holds
• Marketing and communication preferences: Retained until you unsubscribe or request deletion

When retention periods expire, we destroy records containing personal information through secure methods consistent with NIST SP 800-88 guidelines and our written records disposal policy.

Our website and services are directed to adults applying for residential mortgage loans. We do not knowingly collect personal information from children under the age of 13, and mortgage loan products are not available to minors.

If you believe we have inadvertently collected information from a child under 13, please contact us at privacy@flexpointinc.com and we will promptly delete it.

FlexPoint Inc. is committed to equal and fair treatment of all loan applicants. We comply with the Equal Credit Opportunity Act (ECOA), the Fair Housing Act (FHA), and all other applicable fair lending laws. These laws prohibit discrimination in mortgage lending based on race, color, religion, national origin, sex, marital status, age, familial status, disability, or because you receive income from a public assistance program.

In connection with our advertising and marketing activities, we do not use targeting criteria that exclude or include individuals based on protected class characteristics. Our digital advertising (Google Ads, Meta, LinkedIn) is implemented in compliance with fair lending law and the special ad category restrictions applicable to housing and credit advertisements.

If you believe you have been discriminated against in connection with a mortgage loan application, you may:

• File a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov/complaint or 1-855-411-CFPB (2372)
• File a complaint with the U.S. Department of Housing and Urban Development (HUD) at hud.gov or 1-800-669-9777
• Contact your state mortgage regulator
• Consult a private attorney regarding your legal rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) (Cal. Civ. Code § 1798.100 et seq.), grants you specific rights regarding your personal information. Note: personal information collected, processed, and used for mortgage origination and servicing is subject to a partial CCPA exemption under Cal. Civ. Code § 1798.145(e) for information regulated by GLBA — your primary rights in that context come from GLBA and FCRA. The rights below primarily apply to information collected through our website, marketing activities, and non-loan-related interactions.

Your CCPA / CPRA Rights

Several states beyond California have enacted consumer privacy laws that may provide residents with rights similar to those described in Section 12. To the extent any of the following laws apply to our processing of your personal information, we will respond to requests in accordance with those laws:

• Colorado Privacy Act (CPA) — effective July 1, 2023
• Connecticut Data Privacy Act (CTDPA) — effective July 1, 2023
• Texas Data Privacy and Security Act (TDPSA) — effective July 1, 2024
• Virginia Consumer Data Protection Act (VCDPA) — effective January 1, 2023
• Nevada Privacy of Information Collected on the Internet from Consumers Act
• Other state privacy laws as enacted and applicable

Where these laws provide rights to access, delete, correct, or opt out of certain data processing, you may submit a request using the contact methods in Section 15. We will evaluate each request under applicable law and respond accordingly.

Note: As described above, personal information collected for mortgage origination and servicing is substantially governed by GLBA, which preempts certain state privacy law requirements. We will clearly identify which law governs your specific request when we respond.

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory requirements. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• For existing clients with active loan files or service relationships, provide notice by email or mail as required by GLBA and applicable law
• For website users, post a notice on our homepage or in the banner at the top of this page

Your continued use of our website after any changes take effect constitutes acceptance of the updated policy for website-related data processing. For mortgage loan customers, your rights under GLBA are not diminished by any update — we will provide you with a new GLBA privacy notice if our practices change in a way that requires one.

Previous versions of this Privacy Policy are available upon request by contacting our Privacy Team.

For questions about this Privacy Policy, to exercise your rights, to report a privacy concern, or to request access, correction, or deletion of your personal information, contact us using any of the methods below.

Regulatory Complaint Resources

If you believe your privacy rights have been violated, you may also contact the following regulators:

• Consumer Financial Protection Bureau (CFPB): consumerfinance.gov/complaint · 1-855-411-2372
• Federal Trade Commission (FTC): reportfraud.ftc.gov · 1-877-382-4357
• HUD (Fair Housing): hud.gov · 1-800-669-9777
• State mortgage regulator: Contact us for the specific licensing authority in your state, or search NMLSConsumerAccess.org