Who we are.
MLO Finder (“we,” “our,” “us”) runs a mortgage loan officer directory. Borrowers use it to find a loan officer to talk to. Loan officers use it to keep their public profile accurate. We are not a lender, not a broker, and not a licensing authority.
What we collect.
We only collect information you give us or that your browser sends automatically. Concretely:
- Borrower inquiries. When you contact a loan officer through a profile form, we collect your name, email, phone (if provided), loan goal, timeline, message, and the consent checkbox state.
- Multi-quote requests. When you shortlist several loan officers and request quotes, we collect your email, phone, message, the list of officers you selected, and the consent checkbox state.
- Newsletter signups. When you subscribe to the MLO Finder Rate Brief, we collect your email address and the page you signed up from.
- Technical signals. On every form submission we record the IP address and user-agent string that made the request, plus a timestamp. We use this for anti-spam (honeypot checks and IP-based rate limiting) and for audit.
- Page-view analytics. Aggregated pageview, country, and device telemetry via Vercel Analytics. No cookies, no cross-site tracking.
- Approximate location. Your city, state, and country are inferred from your IP address by our hosting provider (Vercel) when you load a page so we can show local loan officers on the home page. We do not store this — it is read at request time and discarded.
- Advertising cookies. If Google AdSense ads are present on a page you visit, AdSense may set cookies in your browser. See clause 07 for details and opt-out.
How we use it.
- Forwarding inquiries. The whole point of a directory: when you submit a borrower inquiry, we forward it to the specific loan officer(s) you chose. Those officers are independent third parties — see clause 04.
- Sending the Rate Brief. If you subscribed, we send a weekly newsletter. You can unsubscribe from any issue.
- Anti-spam and abuse prevention. Honeypot fields and IP-based rate limiting keep bots and bulk submitters out of officer inboxes.
- Operating the directory. Aggregated analytics tell us which markets and profiles get traffic so we can prioritize coverage and freshness.
We do not sell personal data. We do not rent mailing lists. We do not use your inquiry content to train any third-party AI model.
The loan officer is a third party.
When you submit an inquiry, the named loan officer (and their company) receives your contact info and message directly. Loan officers listed in the directory are not employees, agents, or contractors of MLO Finder. Each one is independently licensed under their own NMLS ID and operates under their own employer's privacy practices. Once your inquiry reaches them, their handling of your information is governed by their policy, not ours.
Beyond loan officer recipients, we share data only with the service providers that run the site:
- Resend — delivers transactional and newsletter email.
- Vercel — hosts the site and runs Vercel Analytics.
- Postgres database provider — stores inquiry and subscriber records.
- Inngest — runs scheduled and background jobs (e.g. follow-up workflows, audit rollups).
- Google AdSense — when ads are shown, may set advertising cookies (clause 07).
How long we keep it.
- Inquiry records: retained up to 36 months from submission, then deleted. Allows loan officers to follow up over a realistic loan-shop window and gives us an audit trail for disputes.
- Newsletter subscribers: kept until you unsubscribe, then deleted within 30 days (short audit window so we honor unsubscribes correctly).
- IP and user-agent logs: rolled off after 90 days.
- Aggregated analytics: retained indefinitely in aggregate form — no individual user profile is built.
California resident rights.
This is the notice at collection required by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). The categories we collect, our purposes, and the third parties we share with are listed in clauses 02–04 above. As a California resident you have the following rights:
- Right to know what personal information we have collected about you.
- Right to delete the personal information we hold about you, subject to the exceptions the law allows.
- Right to correct inaccurate personal information.
- Right to opt out of any “sharing” or “selling” of personal information as those terms are defined under California law. We do not sell personal information for money, and we do not share inquiry contents with anyone except the loan officer recipient you chose and the operational vendors in clause 04.
- Right to non-discrimination for exercising any of the above.
To exercise any of these rights, email support@mlofinder.com with the subject “California Privacy Request.” We will verify your identity through the email address on file before acting.
Tracking, transparently.
The directory itself sets only the cookies needed to keep your session working (for example, remembering items in your compare list). We do not run cross-site advertising trackers ourselves.
Google AdSense
Some pages may display ads served by Google AdSense. AdSense uses cookies to serve ads. On MLO Finder we request non-personalized ads by default, which limits the cookies used to what AdSense needs to frequency-cap and combat fraud.
You can manage or opt out of personalized advertising through Google Ads Settings, or opt out of AdSense participation entirely via the Google Ad Settings opt-out.
EU and UK visitors.
If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (and UK GDPR) gives you rights over your personal data. Our lawful bases for processing are:
- Consent — for newsletter signups and for forwarding an inquiry to a loan officer (you tick the consent box on every form).
- Legitimate interest — for running the directory, fighting spam, and aggregated analytics.
You can request access, correction, deletion, restriction, or portability of your data, and withdraw consent at any time, by emailing support@mlofinder.com. You also have the right to lodge a complaint with your local data protection authority.
Security.
We use encryption in transit (TLS) for every page and form, and encryption at rest at our database provider. Access to production data is limited to operational staff under least-privilege. We do not store payment card data — there are no transactions on MLO Finder.
Children.
The directory is intended for adults shopping for mortgages. We do not knowingly collect information from anyone under 16. If you believe a child has submitted information, email us and we'll delete it.
Updates to this policy.
We update this page when our practices change. The “Last updated” date at the top is authoritative. For material changes that expand how we use existing data, we will notify Rate Brief subscribers by email before the change takes effect.
Contact.
Privacy questions, deletion requests, and DSARs go to support@mlofinder.com. For everything else, use our contact page.