Privacy Policy

1. Scope and Who We Are

Finanzo, LLC (“Finanzo,” “we,” “our,” or “us”) is a Washington limited liability company located at 5614 176th St E, Ste B103, Puyallup, WA 98375. This Privacy Policy applies to personal information we collect through the Finanzo websites (finanzo.io and its subdomains), the Finanzo mobile apps for iOS and Android, the loan-officer, real-estate-agent, and wholesale-lender portals, our APIs, our e-mails and text messages, and our customer support (together, the “Services”).

It does not apply to the independent practices of the licensed professionals you meet through Finanzo, to the financial institutions whose accounts you link, or to third-party sites we link to. Each has its own privacy notice.

Finanzo is a technology platform. We are not a lender, mortgage broker, real estate brokerage, or consumer reporting agency. Because we help connect consumers with lenders and loan officers, we are a “financial institution” (a “finder”) under the Gramm-Leach-Bliley Act, and Section 5 of this Policy is our GLBA privacy notice.

1.1 Who Uses Finanzo

• Consumers — homebuyers, homeowners, and household members they invite. Consumers are the only audience whose financial-account data we collect.
• Loan officers — NMLS-registered mortgage loan originators and their organizations using our CRM, pricing, communications, and AI copilot.
• Real estate agents — state-licensed agents who receive directional signals about consenting clients, never raw financial data.
• Wholesale lenders — institutions publishing guidelines and pricing; they receive no identified consumer data from us.

Where this Policy says something applies only to one audience, it says so. If you hold more than one role, the most protective practice applies to each piece of data.

2. Information We Collect

The table below lists the categories of personal information we collect, where it comes from, why we use it, and the basis on which we process it. Not every category applies to every user.

2.1 Biometrics

If you enable Face ID, Touch ID, or Android biometric unlock, the biometric is verified by your device's secure hardware. Finanzo never receives or stores fingerprint or facial data; we receive only a yes/no result from the operating system.

2.2 Information From Professionals About You

A loan officer or agent may add you to their CRM as a contact, lead, or client and record information about you (contact details, loan scenario, notes, call outcomes). That professional is responsible for having a lawful basis to do so. You can ask us at info@finanzo.io which professionals hold records about you.

3. How and Why We Use Information

• To provide the Services — show your dashboard, goals, properties, and refinance analysis; run the CRM, pricing, and communication tools for professionals; deliver messages and notifications you request.
• To share at your direction — give a specific loan officer, agent, or household member the data you choose to share (Section 4.1).
• To bill you — process subscriptions through Stripe and collect applicable tax.
• To keep the Services secure — authenticate you, detect fraud and abuse, enforce rate limits, verify professional licenses, and keep audit logs.
• To communicate with you — service and security notices, billing receipts, responses to support requests, and, with your consent, marketing e-mail or SMS you can stop at any time.
• To improve the Services — understand which features are used, measure performance, and fix problems. We use aggregated or de-identified data for this where practical.
• To comply with law — respond to lawful requests, keep records required by tax and financial regulation, and honor legal holds.

We do not sell personal information, use it for cross-context behavioral advertising, use your data to train AI models, or use automated processing to make lending, credit, housing, or eligibility decisions about you.

4. How We Share Information

4.1 With People You Choose

• Loan officers. When you pair with a specific loan officer and choose what to share, that loan officer sees consent-scoped derived signals: account and balance summaries, transaction categories, estimated income, debt-to-income, net worth, goals, and spending patterns. You can also choose, item by item, to let them see your date of birth, the last four digits of your SSN, or your street address for a loan scenario. They never see your Array credit data, your bank credentials, or raw statements. Each grant is per loan officer and per item, time-limited (30 days by default, 90 at most), revocable at any time in Settings → Privacy & Security → Shared with Your Loan Officer, and every view is logged and notified to you.
• Real estate agents. A paired agent sees directional signals only (for example “buying power increased,” saved-search activity, pre-approval yes/no with a price band) plus the contact details you provide. Never balances, transactions, income amounts, SSN, or credit.
• Household members. See only the categories you enable in the shared space.
• Wholesale lenders. Receive aggregated, de-identified analytics. An identified loan scenario reaches a lender only when a loan officer deliberately submits it for pricing, and only the fields the lender's pricing requires.
• Listing shares and reviews. If you share a listing, the recipient sees your name and the listing. If you post a review of a loan officer, your display name and review are public after moderation.

4.2 With Service Providers

We share information with vendors that process it on our behalf under contracts that restrict their use of it to providing services to us. They are listed, with what each receives, in Section 7.

4.3 For Legal Reasons

We may disclose information to comply with law, regulation, subpoena, or court order; to respond to a lawful government request; to enforce our Terms; to protect the rights, property, or safety of Finanzo, our users, or others; or to detect and prevent fraud. Where permitted, we will tell you before disclosing your information in response to legal process.

4.4 Business Transfers

If Finanzo is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4.5 Aggregated and De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you (for example, program-competitiveness statistics shown to lenders). We commit to maintaining it in de-identified form and not attempting to re-identify it.

5. GLBA Privacy Notice

This Section is Finanzo's privacy notice under the Gramm-Leach-Bliley Act and Regulation P (12 C.F.R. Part 1016). It applies to consumers' “nonpublic personal information” (“NPI”).

5.1 Questions?

E-mail info@finanzo.io or write to Finanzo, LLC, 5614 176th St E, Ste B103, Puyallup, WA 98375.

5.2 Who We Are and What We Do

• Who is providing this notice? Finanzo, LLC.
• How does Finanzo protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings, and are described in Section 11.
• How does Finanzo collect my personal information? We collect your personal information, for example, when you open an account, link a financial account through Plaid, enter property or loan details, pair with a professional, or use our calculators. We also collect information from others, such as Plaid and listing data providers.
• Why can't I limit all sharing? Federal law gives you the right to limit only sharing for affiliates' everyday business purposes (information about your creditworthiness), affiliates from using your information to market to you, and sharing for nonaffiliates to market to you. Finanzo does none of these. State laws and individual companies may give you additional rights to limit sharing; see Section 13.

5.3 Definitions

• Affiliates — companies related by common ownership or control. Finanzo has no affiliates.
• Nonaffiliates — companies not related by common ownership or control. Finanzo does not share with nonaffiliates so they can market to you. The loan officers and agents you pair with are nonaffiliates who receive information only at your direction.
• Joint marketing — a formal agreement between nonaffiliated financial companies that together market financial products to you. Finanzo does not jointly market.

5.4 Other Important Information

Loan officers and lenders who receive your NPI at your direction are themselves financial institutions under GLBA and must give you their own privacy notice. California, Vermont, and some other states restrict sharing further; we follow the stricter rule. This notice is provided when you open an account and is available at all times at finanzo.io/privacy-policy; we will re-deliver it if our sharing practices change.

6. Credit Information (Fair Credit Reporting Act)

Finanzo is not a consumer reporting agency, reseller, or furnisher. We do not assemble or evaluate credit information to furnish consumer reports, and we do not report your payment history to anyone.

6.1 Consumer Credit Monitoring (when enabled)

When this feature is enabled for your account, you may enroll in credit monitoring provided by Array US, Inc. Array obtains your score and report from a nationwide consumer reporting agency under your written instructions (FCRA § 604(a)(2)) and displays it to you inside the app. Finanzo stores only your consent record and an opaque Array user identifier. Finanzo never receives, stores, or displays your credit report or score to anyone else, and never provides consumer-report information to loan officers, agents, lenders, or any other professional. Enrollment is a soft inquiry and does not affect your score. You may revoke at any time in the credit section of the app; we then record the revocation and ask Array to delete your profile.

6.2 Credit Reports Ordered by Your Loan Officer (when enabled)

Separately, a loan officer may order a tri-merge credit report for a loan application under their organization's own credit-vendor subscriber agreement, after you sign an authorization that names that company. The loan officer's organization is the end user of that report and is responsible for permissible purpose, adverse-action notices, and risk-based-pricing notices. This integration is not live today; until it is, loan officers order credit outside Finanzo. When it is live, Finanzo will store the report only in sealed form for the ordering organization, and every access will be logged.

6.3 Scores You or a Professional Type In

A credit score you enter yourself, or that a loan officer enters about you, is labelled as self-reported or professional-entered and is never presented as a bureau score. It is stored encrypted and is not a consumer report.

7. Third-Party Services

The following providers process personal information for us. Each is bound by contract to use it only to provide its service. Browser-side details are in the Cookie Policy.

7.1 Google API Services User Data Policy

Finanzo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Gmail data is used only to show a connected professional their own inbox previews inside the CRM, to send messages they compose, and to show their calendar availability. It is not used for advertising, is not sold, is not used to train AI models, and is not read by humans at Finanzo except with the professional's explicit permission for support, for security investigation, or as required by law.

7.2 Plaid

By linking an account you also agree to the Plaid End User Privacy Policy. Plaid may collect additional information from your institution to provide and improve its services as that policy describes. You can see and manage the apps connected to your financial accounts at my.plaid.com.

8. AI Processing

Some features use large language models: a consumer assistant that answers questions about your own data, a professional copilot that reasons over loans, documents, guidelines, and pricing, and automated extraction of text from uploaded guideline documents.

• Where. Inference runs on Microsoft Azure OpenAI Service deployments in the United States. We restrict the provider by policy so that only Azure-hosted endpoints may be used.
• No training. Under Microsoft's Azure OpenAI terms, prompts and outputs are not used to train foundation models and are not shared with OpenAI or other customers.
• Provider abuse monitoring. By default Microsoft may retain redacted prompts and outputs for up to 30 days, in the United States, solely to detect abuse of its service, and authorized Microsoft employees may review content flagged by that system. Microsoft offers approved customers a “modified abuse monitoring” configuration under which no prompts or outputs are stored; as of the Last Updated date you should assume the default 30-day retention applies to Finanzo's deployments. We will update this Section if that status changes.
• Redaction first. Before anything leaves our systems toward the model, we replace Social Security numbers, account and routing numbers, dates of birth, and street numbers with masked values and replace e-mail addresses with per-conversation pseudonyms. The model's output is scanned the same way before it is shown.
• What we keep. Consumer assistant conversations are not stored on our servers; our audit record holds message lengths, categories, and token counts only. Professional copilot conversations are stored with the professional's account, with attachment references rather than contents, so the professional can return to them.
• No automated decisions. AI output is informational. It never issues a loan decision, approval, rate quote, or adverse action, and professionals are contractually barred from using it as the sole basis for a credit decision. Any action the copilot proposes requires a human to confirm.
• You are told it is AI. AI features are labelled in the product. This disclosure, together with those labels, is intended to satisfy state laws that require notice when you interact with generative AI.

9. Cookies and Tracking

finanzo.io uses a small number of first-party cookies to keep you signed in (httpOnly, Secure, SameSite=Strict), to protect forms against cross-site request forgery, and to remember your analytics choice. Optional analytics (Google Tag Manager / Google Analytics) load only after you accept them in the banner and only on deployments where analytics is configured. Stripe, hCaptcha, and Mapbox may set their own cookies on the pages where they load. Every cookie and local-storage key, its purpose, and its lifetime are listed in our Cookie Policy, where you can also change your analytics choice. The mobile apps do not use cookies or advertising identifiers.

10. Data Retention

We keep personal information for as long as needed to provide the Services, meet legal and regulatory obligations (including GLBA and tax record-keeping), resolve disputes, and enforce our agreements. Our scheduled retention periods are:

A legal hold suspends deletion for the records it covers until the hold is lifted. De-identified or aggregated data may be kept indefinitely. Backups are retained for a short period under our cloud provider's schedule and are overwritten in the ordinary course.

10.1 Account Deletion

You can delete your account in the app (Settings → Privacy & Security → Delete My Account) or on the web (Account → Settings → Delete Account), or by e-mailing info@finanzo.io. When you do:

• sign-in is disabled immediately and all pairings and consents are revoked;
• we ask Plaid to remove your connections and, when enabled, ask Array to delete your profile;
• your subscriptions are cancelled at the end of the current period;
• after a 30-day hold (during which you can contact us to reverse the request) your account record is permanently deleted;
• records we must keep (for example, audit logs, tax records, and consent evidence) are retained for the periods above and then deleted.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, consistent with the GLBA Safeguards Rule. They include:

• Encryption in transit — TLS for every connection between your device and our servers, and between our servers and our providers.
• Encryption at rest — all stored data is encrypted by Microsoft Azure. In addition, designated sensitive fields — last four SSN digits, date of birth, street address, annual income, and entered credit scores — and all third-party access tokens (Plaid, Gmail/Microsoft mailbox, lender MCP credentials, credit-vendor logins) receive application-level AES-256-GCM encryption with keys held in Azure Key Vault and never stored in plaintext.
• Authentication — passwords are hashed with Argon2id and checked against known-breached password lists; every account must enroll a second factor (authenticator app, SMS, or backup codes) before protected data can be accessed, and Finanzo staff tools use a separate three-factor sign-in; sign-in on the web is protected by server-verified hCaptcha and rate limiting; sessions use httpOnly, Secure, SameSite=Strict cookies.
• Access controls — role-based and organization-scoped access; consent-gated reads of consumer financial data bound to the specific grant; separate credentials, token audience, and three-factor sign-in for Finanzo staff tools.
• Audit logging — access to sensitive data, consent grants and revocations, credit-report requests, AI provider calls, and administrative actions are written to an append-only audit log.
• Vendor oversight and testing — automated security test suites run on every change; dependencies are monitored for vulnerabilities; providers are selected for SOC 2 or equivalent attestations.

No system is perfectly secure. If we learn of a breach of security affecting your unencrypted personal information, we will notify you and, where required, regulators without unreasonable delay and within the time applicable law requires (for Washington residents, no later than 30 days after discovery under RCW 19.255.010). Report security concerns to info@finanzo.io or see our security.txt.

12. Your Rights and Choices

We offer the following to every user, regardless of where you live. Section 13 describes additional rights under specific state laws.

12.1 How We Handle Requests

You can also make any request by e-mailing info@finanzo.io with the subject “Privacy Request,” or by mail to 5614 176th St E, Ste B103, Puyallup, WA 98375. We will verify your identity (normally by confirming control of the account e-mail and, for sensitive requests, a second factor) before acting. We respond within 45 days and will tell you if we need up to 45 more. If we decline a request we will explain why and how to appeal (Section 13.2). We will not discriminate against you for exercising your rights. You may use an authorized agent; we will require proof of the agent's authority and may still verify your identity directly.

13. State-Specific Disclosures

Most state consumer-privacy laws exempt information covered by GLBA (Section 5), and some exempt GLBA-regulated entities entirely. To the extent a state law applies to information we hold about you that is not covered by GLBA (for example, marketing-site visitor data), the following applies.

13.1 California (CCPA/CPRA)

In the preceding 12 months we collected the categories of personal information listed in Section 2, which correspond to the following CCPA categories: identifiers; personal information under Cal. Civ. Code § 1798.80(e); commercial information; internet or network activity; geolocation (approximate); professional or employment information; inferences; and sensitive personal information (account log-in credentials, Social Security number digits, financial account information, precise geolocation when permitted). We collected them from the sources, and for the purposes, in Section 2, and disclosed them for business purposes to the service providers in Section 7. We did not sell or share (for cross-context behavioral advertising) personal information, including that of consumers under 16, and we have no actual knowledge of doing so. We use sensitive personal information only for the purposes permitted by § 7027(m) of the CCPA regulations, so no “Limit the Use” link is required.

California residents have the right to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and not be discriminated against. Exercise them as described in Section 12. We honor Global Privacy Control as an opt-out of sale/sharing (Section 15). Information covered by GLBA or the California Financial Information Privacy Act is exempt from the CCPA.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their direct-marketing purposes. California residents may nevertheless request a notice of any such disclosures once per year by e-mailing us.

Metrics. We publish annual request-handling statistics on request once we meet the CCPA threshold that requires them.

13.2 Colorado, Connecticut, Virginia, Utah, Texas, and Oregon

Residents of these states may have the right to confirm whether we process their personal data; access it; correct it; delete it; obtain a portable copy; and opt out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data, engage in targeted advertising, or profile in that sense. Where consent is required to process sensitive data, we obtain it. Oregon residents may also request the list of specific third parties to which we have disclosed personal data; it is Section 7.

Appeals. If we decline your request, you may appeal within 45 days by replying to our decision or e-mailing info@finanzo.io with the subject “Privacy Appeal.” We will respond within 45 days (60 in Colorado). If we deny the appeal, you may contact your state Attorney General (Colorado, Connecticut, Virginia, Texas, Oregon) or the Utah Division of Consumer Protection.

13.3 Nevada

We do not sell covered information as defined in NRS 603A.340. Nevada residents may still submit a request to opt out of any future sale by e-mailing us.

13.4 Washington

Finanzo is located in Washington. Washington does not currently have a comprehensive consumer-privacy statute; our practices for Washington residents are those described throughout this Policy. The My Health My Data Act (RCW 19.373) does not apply because we do not collect consumer health data. Under RCW 19.255.010 we will notify affected Washington residents of a breach of the security of their personal information in the most expedient time possible and no more than 30 days after discovery, and will notify the Attorney General when a breach affects 500 or more Washington residents.

13.5 Vermont

We do not share nonpublic personal information about Vermont residents with nonaffiliated third parties except as permitted by law or at your direction, and a loan officer who orders a credit report on a Vermont resident must obtain written consent.

14. Children's Privacy

The Services are for adults. You must be 18 or older to create an account; every registration path requires an explicit confirmation of age and declines the registration by default without it. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). We do not direct any part of the Services to children.

If we learn that we have collected personal information from a person under 18, we will delete it and close the account. Parents and guardians who believe a minor has provided us information may contact info@finanzo.io or write to Finanzo, LLC, 5614 176th St E, Ste B103, Puyallup, WA 98375, with the account e-mail or phone number; we will verify the request, delete the information, and confirm.

15. Do Not Track and Global Privacy Control

On finanzo.io we treat a browser “Do Not Track” (DNT) or “Global Privacy Control” (GPC) signal as a decline of optional analytics cookies: we do not show the cookie banner and we do not load analytics tags while the signal is present, even if you previously accepted. We also honor GPC as a request to opt out of any “sale” or “sharing” of personal information under state privacy laws. Because we do not sell or share personal information, honoring the signal changes nothing else. The signal does not affect essential cookies needed to sign in. We do not track users across third-party websites for advertising.

16. Where Data Is Stored

The Services are offered only in the United States and are hosted on Microsoft Azure in U.S. regions. Our service providers are U.S. companies that may process data in the United States. We do not offer the Services to residents of the European Economic Area, the United Kingdom, or other jurisdictions outside the United States, and we do not intend to collect personal data from them. If you access the Services from outside the United States, you do so at your own initiative, and your information will be transferred to and processed in the United States.

17. Changes to This Policy

We will update this Policy when our practices change. For material changes we will give at least 30 days' notice by e-mail and by an in-product notice, update the Effective Date and version above, and, where the change expands our sharing of GLBA-covered information, re-deliver the notice in Section 5 and give you any opt-out the law requires before the change takes effect. The change log for this document is kept in our public repository documentation.

18. Contact Us

Questions, requests, or complaints about privacy:

We respond to all legitimate inquiries within 30 days.