Privacy Policy

Policy version: 2026-10-11.2 · Last Updated: October 11, 2026 · Effective Date: October 11, 2026

1. Introduction

TPOTALK, LLC ("TPOTALK," "we," "our," or "us") operates an information distribution platform designed exclusively for mortgage industry professionals located in the United States, including loan officers, lenders, vendors, and account executives (the "Platform" or "Services"). This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you use our Platform. By accessing or using our Services, you agree to this Privacy Policy and our Terms of Service.

TPOTALK is designed exclusively for use by businesses and licensed professionals located in the United States. We do not target, market to, or knowingly accept registrations from individuals located outside the United States. We are not a lender, do not offer loans or financing, and do not provide services to consumers seeking personal financing.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

Create an account: name, email address, phone number, company name, job title, and business address.
Provide professional details: NMLS number, state licenses, professional certifications, and other verification information.
Build your profile: professional biography, areas of expertise, profile photo, and business card information.
Make a payment: billing address and payment method details, processed by our third-party payment processor.
Communicate with us: messages, support inquiries, feedback, and suggestions.
Upload or distribute content: program information, documents, images, videos, broadcasts, and other materials.
Set preferences: communication preferences, notification settings, and display preferences.

2.2 Information Collected Automatically

When you use our Platform, we automatically collect usage data and related technical information, which may include device information, IP address, browser type and version, operating system, device type, screen resolution, pages viewed, features used, time spent on the Platform, click patterns, scroll behavior, search queries, access times, referring URLs, exit pages, error logs, API calls, general location derived from IP address, page load times, response times, crashes, errors, cookies, session identifiers, preference cookies, analytics cookies, and authentication tokens.

2.3 Information from Third Parties

We may receive information from third parties, including verification sources, payment processors, analytics providers, other users who may reference or interact with your content, and publicly available business directories and databases.

3. How We Use Information

We use information we collect for platform operations, communications, analytics, safety and security, and our internal business purposes. We may also use information for other purposes disclosed to you at the time of collection or with your consent.

To the extent required by law, our processing is based on applicable legal grounds, which may include performance of a contract, our legitimate interests in operating, improving, and securing the Platform, compliance with legal obligations, and your consent where required.

4. Analytics, Improvement, and AI

We may use automated systems, including machine learning and similar technologies, to operate, maintain, improve, and personalize the Platform. For example, these systems may help us rank and filter feeds, surface relevant content and connections, detect spam and fraud, power search, and improve safety, recommendations, and analytics.

We may also process publicly available content and content distributed on the Platform for purposes such as classification, summarization, tagging, search, recommendations, and general product improvement. Where possible, we use aggregated or de-identified information for these purposes.

We do not sell your content to third parties for their independent model training, and we do not permit unauthorized scraping of the Platform for AI training. Private materials you store but do not distribute are used only to provide storage, search, security, and related Platform features. We may use your content and related information in connection with our own services, subject to applicable law and our user controls, settings, and product design.

5. How We Share Information

5.1 With Other Platform Users

As an information distribution platform, certain information you provide, such as your professional profile, company information, business card, and content you distribute, is shared with other authorized users of the Platform as part of our core service functionality. Your profile information and content may be visible to other registered users as described in Section 17 (Content Activity Visibility (Optional)).

5.2 With Service Providers

We share information with third-party service providers who perform services on our behalf, including cloud hosting and data storage, payment processing, email and communication delivery, analytics and reporting, customer support, caching, content-delivery, and performance services. These providers are contractually obligated to use your information only for the purposes of providing services to us and in accordance with this Privacy Policy.

5.3 For Legal Purposes

We may disclose your information when we believe disclosure is necessary to comply with applicable laws, regulations, or legal processes; respond to lawful requests from government authorities, including law enforcement; protect the rights, property, or safety of TPOTALK, our users, or the public; enforce our Terms of Service and other agreements; detect, prevent, or address fraud, security, or technical issues; or respond to an emergency involving danger of death or serious physical injury.

5.4 Business Transfers

If TPOTALK is involved in a merger, acquisition, reorganization, bankruptcy, dissolution, sale of assets, or other business transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

5.5 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, marketing, or other business purposes, to the extent permissible by law.

5.6 With Your Consent

We may share your information for other purposes with your explicit consent.

6. Your Privacy Rights

6.1 Rights for All Users

All users have the right to access, correct, delete, and obtain a copy of their personal information, opt out of marketing communications, close their account, and request data portability where applicable.

6.2 California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising your privacy rights. We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising.

In the preceding 12 months, we have collected the following categories of personal information: identifiers, professional information, commercial information, internet and network activity, geolocation data, audio/electronic/visual information, and inferences drawn from the above. We have disclosed identifiers, professional information, and commercial information to service providers for hosting, payment processing, email delivery, and analytics.

6.3 Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with privacy laws may have similar rights to access, correct, delete, obtain a copy of their personal data, and opt out of targeted advertising, sale of personal data, and profiling, as applicable under law.

6.4 How to Exercise Your Rights

To exercise your privacy rights, you may submit a request through our contact form or manage settings through your account preferences. We will verify your identity before processing your request and may require additional information to confirm your identity. We will respond within the timeframes required by applicable law, generally 45 days for California residents, with a possible 45-day extension for complex requests.

6.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. To do so, you must provide the agent with written authorization, and the agent must submit proof of authorization when making the request. We may still require you to verify your identity directly.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your use of our Platform. Cookies are small data files stored on your device that help us improve your experience. We use essential cookies, functional cookies, analytics cookies, and performance cookies. You can control cookies through your browser settings, and disabling certain cookies may affect Platform functionality and your user experience.

Where required by law, including for California and Colorado residents, we recognize and honor the Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information and of targeted advertising. Because GPC is browser- and device-specific, you may need to enable it on each browser or device you use. We do not respond to Do Not Track signals.

TPOTALK shows sponsored content, such as banner ads and promoted posts, from lenders and vendors. This advertising is first-party and interest-based, and targeting is performed by TPOTALK using on-Platform information. We do not engage in cross-context behavioral advertising, do not track you across unrelated third-party websites and apps to build advertising profiles, and do not let advertisers take your identifiable data off-Platform. We do not sell your personal information for monetary consideration. Residents of states with applicable privacy laws may opt out of targeted advertising in Settings or by submitting a request, and opting out does not remove ads.

8. Data Security

We implement appropriate technical, administrative, and physical security measures to protect your personal information, including encryption, secure authentication, access controls, incident response procedures, employee training, secure data centers, and regular backups. While we strive to protect your information using commercially reasonable measures, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us (tpotalk.com/contact) immediately.

We maintain an incident-response program to detect and contain security incidents. If we determine that a breach has compromised the security, confidentiality, or integrity of your personal information, we will notify affected users and applicable regulators without undue delay and within the timeframes required by applicable state and federal law. Our notice will describe, to the extent known and permitted, what happened, the categories of information involved, steps we have taken, and steps you can take to protect yourself.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements, and support our operations. When information is no longer needed, we delete it or de-identify it where reasonably possible.

Account and profile information is kept while your account is active and may be retained for a reasonable period after deletion for recovery, backup, and legal compliance. Posts, broadcasts, distributed content, connection data, transaction records, usage data, security logs, and support records may also be retained for as long as necessary for the purposes described above, including in backup systems for a limited period. Content already saved, downloaded, quoted, or re-distributed by other users may continue to exist outside of our control. De-identified or aggregated information may be retained and used to the extent possible for analytics, reporting, and product improvement.

10. Children's Privacy

Our Platform is designed exclusively for mortgage industry professionals and is not intended for individuals under 18 years of age. We do not knowingly collect, use, or disclose personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete that information promptly.

11. Geographic Scope

Our Platform is hosted in the United States, and data may be processed and stored in the United States in accordance with U.S. law. If you access the Platform from outside the United States, you do so at your own risk and are responsible for compliance with local laws.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this policy, notify you of material changes by email or through a prominent notice on our Platform, and where required by law obtain your consent to the changes. Your continued use of the Platform after changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about our data practices, please contact us:

TPOTALK, LLC — Legal & Privacy Department

Contact form: tpotalk.com/contact

For California residents, you may also designate an authorized agent to make a request on your behalf by providing written authorization.

We aim to respond to privacy inquiries within 30 days and will respond to requests under CCPA/CPRA or other state privacy laws within the timeframes required by applicable law.

14. Email Communications

In compliance with the CAN-SPAM Act and similar regulations, we will clearly identify ourselves in commercial emails, provide a clear way to opt out in every promotional message, honor opt-out requests within 10 business days, and not use deceptive subject lines or false header information. Service-related emails, including account notifications, security alerts, transaction confirmations, and policy updates, are not marketing communications and may be sent regardless of marketing preferences. To unsubscribe from marketing emails, click the unsubscribe link in the email or update your preferences in your account settings.

15. Text Messaging (SMS) and Consent

If you provide a mobile number, we may send text messages for service messages such as one-time security or verification codes and critical account or transaction alerts, as well as optional alerts you choose to receive. By providing your mobile number and enabling text notifications, you consent to receive recurring automated texts from TPOTALK at that number, and consent to marketing or optional texts is not a condition of using the Platform or of any purchase.

You may reply STOP to unsubscribe from a category and HELP for help. We honor opt-outs promptly, although security and essential transactional texts may continue if necessary to operate your account. Message and data rates may apply, frequency varies, and carriers are not liable for delayed or undelivered messages. We do not sell or share mobile numbers or text-message consent with third parties for their own marketing.

16. Dispute Resolution

Any disputes arising from or relating to this Privacy Policy or your privacy rights shall be resolved in accordance with the Dispute Resolution, Arbitration, and Class Action Waiver provisions set forth in our Terms of Service, including the binding arbitration agreement, class action waiver, jury trial waiver, and one-year limitation period on claims.

17. Content Activity Visibility (Optional)

TPOTALK lets loan officers choose whether lenders, vendors, and account executives can see when they view, click, or download those companies' posts, documents, or profiles ("Content Activity"). This setting is off by default. While it is off, we share Content Activity with those companies only as aggregated, de-identified statistics (for example, total views by role or region), and we never share groups smaller than five people.

If you turn on "Let lenders and vendors see when I view or download their content" in Settings → Privacy, you consent to us sharing your Digital Business Card — the name, title, company, photo, and contact details you chose to show on it — and the date and type of your Content Activity with the company whose content you engaged with. We never share your account login email, account phone number, or other account information that is not on your Digital Business Card. That company may use your Digital Business Card information to contact you about its products and services.

When you turn this setting on or off, we record your choice together with the date, time, IP address, device or browser, and the version of this policy in effect, and we send a confirmation to your account email. We keep this record as proof of your consent for as long as your account is active, and for up to 7 years afterward or longer if the law requires it.

You can turn this setting off at any time in Settings → Privacy. Turning it off stops future sharing; it does not recall information already shared while the setting was on. Actions you take deliberately, such as saving a company to your lists, connecting, messaging, or requesting information, are shared with that company regardless of this setting, as part of using those features. When you take these deliberate actions, the same rule applies: only your Digital Business Card information is shared.