This policy describes how Mortgage Bank of California Inc. dba Mbanc ("Mbanc", "we", "us", or "our") collects, uses, and shares information about you when you use our website at mbanc.com, our application portal at apply.mbanc.ai, our APIs at pipe.mbanc.ai, or otherwise interact with us in connection with mortgage products and services.
1. Information we collect
Information you provide directly
When you submit our application form or contact us, we collect:
- Identity information: first name, last name, email address, phone number, business name (if applicable)
- Geography: state, ZIP code, city
- Loan-inquiry profile: loan purpose (purchase, refinance, cash-out, DSCR, HELOAN), occupancy type, requested loan amount, estimated property value, credit-score range
- Borrower-profile signals: whether you are self-employed, 1099, or own real property
- Trade category (if applicable): the kind of business you operate
- UTM and referral attribution from the URL you arrived through
Information we collect automatically
- Device + connection: IP address, user agent (browser + operating system), session identifier, completion duration on the form (anti-fraud signal)
- Source URL: the page from which you arrived at our application
- Consent metadata: the exact disclosure text shown to you (cryptographically hashed), the timestamp at which you affirmatively agreed, and your IP at that moment — we retain this as a TCPA-defensible record per 47 CFR 64.1200
Information from third parties
- Property records (Estated and similar) — to identify properties associated with you for refinance or DSCR-eligibility analysis
- Phone-line type intelligence (Twilio Lookup) — to determine whether your number is a landline or mobile line, which affects how we may contact you
- Email-deliverability verification (NeverBounce) — to confirm your email is reachable before we send you anything
- Business intelligence (Apollo and similar) — for B2B prospecting on behalf of identifying self-employed business owners who may benefit from our products
2. How we use information
- Loan origination. To evaluate your eligibility for our mortgage programs (Bank Statement, DSCR, 1099, Asset Utilization), match you with a state-licensed Mbanc Loan Officer, and process your application end-to-end.
- Compliance. To enforce state-licensure restrictions, primary-residence loan caps in FL, IL, NJ, and CT, and the Equal Credit Opportunity Act's prohibition on discriminatory lending. To maintain a TCPA-defensible audit trail.
- Communication. To respond to inquiries by email at the address you provided. If you have separately and affirmatively consented, also by SMS or telephone (including via auto-dialing systems and ringless voicemail).
- Fraud prevention and security. To detect and prevent fraudulent applications, identity theft, account takeover attempts, and abusive use of our services.
- Service improvement. Aggregate, anonymized analytics about how our application performs, conversion rates, and which loan programs serve which kinds of borrowers best.
- Legal compliance. Including responses to subpoenas, court orders, and regulatory examinations by state and federal mortgage regulators.
3. How we share information
We do not sell your personal information. We share it only with:
| Recipient | Purpose | Information shared |
|---|---|---|
| Mbanc Loan Officers | Evaluate and process your loan application | All application data, only with the LO licensed in your state |
| GoHighLevel (CRM service provider) | Pipeline management and LO communication tracking | Contact information + application metadata |
| Liora (AI loan-concierge service provider) | Initial pre-qualification conversation | Application data + conversation transcript (retained 90 days) |
| Twilio (telecommunications provider) | SMS verification, line-type lookup, calling infrastructure | Phone number only |
| NeverBounce, Apollo, Estated | Data verification + enrichment | Email, phone, business name as applicable |
| Smartlead.ai (email infrastructure) | Outbound email delivery + reply tracking | Email address + outbound message metadata |
| Service providers under contract | Hosting, security, error monitoring, payment processing | As necessary to deliver each service |
| Regulators and law enforcement | Compliance with valid legal processes | Only what is legally required |
| Successor entities | Mergers, acquisitions, or sale of business assets | Subject to your same privacy protections under the successor |
All service providers are bound by contract to protect your information, use it only for the purpose for which we share it, and delete it when our relationship with them ends.
4. Retention
We retain your information for as long as necessary to deliver the services you requested and to comply with our legal and regulatory obligations:
- Active application data: for the life of the application + 7 years after closing or last activity, per Federal mortgage record-retention requirements
- Consent audit trail (TCPA): 7 years from last contact, per industry standard
- Marketing-only contacts who never apply: 24 months from last engagement, then deleted
- Suppression-list entries (if you opted out): retained indefinitely solely to ensure we do not contact you again
5. Your rights
If you are a California resident (CCPA/CPRA)
You have the right to:
- Know what personal information we have about you
- Know what we have shared and with whom in the last 12 months
- Request deletion of your personal information (subject to lawful exceptions including financial-services record retention)
- Correct inaccurate personal information
- Opt out of any sale or sharing of your personal information (we do not sell it; sharing is only with the service providers above for the purposes described)
- Limit use of "sensitive personal information" — we use it only for the loan origination purpose for which you provided it
- Be free from retaliation for exercising any of these rights
If you reside elsewhere in the United States
State privacy laws including the Virginia CDPA, Colorado CPA, Connecticut CTDPA, and Utah UCPA grant you similar rights. We honor those rights regardless of your state of residence.
To exercise any of these rights
Contact us at privacy@mbanc.com with "Privacy Request" in the subject line. We respond within 45 days. We may need to verify your identity before fulfilling certain requests, and certain information (e.g., regulatory records) may be exempt from deletion under applicable law.
6. Children
Our services are not directed to anyone under 18 years of age and we do not knowingly collect information from minors. If you believe we have inadvertently collected information from a minor, contact us and we will delete it.
7. Security
We use industry-standard encryption in transit (TLS 1.2+) and at rest, and maintain administrative, physical, and technical safeguards designed to protect your information against unauthorized access, alteration, disclosure, or destruction. No system is impenetrable; if we ever experience a breach affecting your information, we will notify you and applicable regulators in accordance with state and federal breach notification laws.
8. Cookies and similar technologies
Our websites use cookies and similar technologies (e.g., local storage) to operate our application form, remember your session, prevent fraud, and measure aggregate site performance. We do not use third-party advertising cookies. You can disable cookies in your browser, but parts of the application form may not function.
9. International users
Mbanc is a U.S.-based mortgage lender. Our services are intended for U.S. residents seeking mortgages on properties located in the 21 states where we hold mortgage-lender licenses. If you access our services from outside the United States, your information will be transferred to and processed in the United States.
10. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page will reflect when changes took effect. For material changes, we will notify you by email if we have your address on file.
11. Contact us
For privacy questions or requests:
Mortgage Bank of California Inc. dba Mbanc
Attn: Privacy Officer
101 Plaza Real South, Suite 203
Boca Raton, FL 33432
privacy@mbanc.com
844-918-1886
NMLS #38232 · Equal Housing Opportunity Lender. Mbanc is licensed to originate mortgages in 21 U.S. states. State-specific advertising disclosures are available upon request and are appended to material we provide to residents of those states.