Privacy Policy

Scope of this policy

This Privacy Policy applies when Bloom Lending, LLC ("Bloom," "we," "us," or "our") controls personal information collected through our websites, online mortgage and inquiry forms, borrower portal, employee CRM, Bloom Lending mobile applications, and related support or communications (together, the "Services"). It also describes how authorized Bloom personnel may enter and use information about borrowers, prospective borrowers, referral partners, and other business contacts in the CRM.

Some mortgage relationships are also covered by separate federal or state financial privacy notices, disclosures, or authorizations. Those documents may describe additional rights or practices and are not replaced by this policy. If another notice applies to a particular transaction and conflicts with this policy, the transaction-specific notice controls for that information.

Information we collect

The information we collect depends on the Service used and the person's relationship with Bloom. It can include the categories below.

Sources of information

We collect information directly from individuals; from authorized employees, loan officers, account administrators, or referral sources; from Microsoft, Apple, and other sign-in providers; from service providers involved in a requested transaction; and, when permitted or authorized, from lenders, investors, employers, financial institutions, consumer reporting agencies, government or public records, and other business partners.

If you provide information about another person, you are responsible for having authority to do so and for directing that person to this policy when appropriate.

Mobile app, authentication, and device permissions

Bloom's mobile CRM is intended for authorized Bloom team members. The borrower portal and other Services may provide separate sign-in choices. Mobile permissions are requested in context and can be changed in device settings.

Microsoft and Apple authentication

Authorized CRM users may sign in through Microsoft Entra ID. Depending on the Service, borrowers may be offered Sign in with Apple. We receive the provider's user identifier and the account details the provider is permitted to return, such as name or email address. Apple may provide a private relay email address. We use these details to authenticate, secure, and associate the user with the correct Bloom account or record.

Device contacts

The app requests Contacts access only after a user starts the import workflow. With permission, the app reads contact fields needed to display the selection screen, such as name, phone number, email, company, job title, and address. The user chooses which records to add to the CRM. Only the selected contacts are transmitted to Bloom; unselected contacts are not uploaded through that workflow. The app does not use contact notes or access the address book in the background for this feature.

Camera and files

The app may request camera access when a user chooses to scan a business card or capture a document. A user may also choose a file or image for upload. Content is transmitted to Bloom only when the user takes an action to submit or attach it. Captured or selected content can contain personal, financial, or other sensitive information, so users should upload only material they are authorized to handle.

Notifications

If a user allows push notifications, the app may register an Expo or Apple Push Notification service token, together with the user and device platform needed to route alerts. Bloom and its delivery providers use that token for operational alerts such as assigned leads, tasks, loan workflow events, document requests, security messages, or other enabled CRM notifications. The token is not used for interest-based advertising. Notification permission and presentation choices can be changed in the app or device settings.

Offline data, secure tokens, and biometrics

To support offline work, the mobile app may store a local copy of authorized CRM records—such as contacts, loans, tasks, activities, and notifications—and synchronize changes with Bloom when a network connection is available. Authentication tokens are stored using device secure-storage features. If biometric unlock is enabled, the device evaluates the fingerprint or face match; Bloom receives only the result of that device check, not the fingerprint or face template. Removing the app or clearing its data removes local app data but does not itself delete records retained in Bloom's systems.

How we use information

We may use personal information to:

• provide, administer, personalize, and support the Services;
• process inquiries, applications, mortgage transactions, documents, and requested communications;
• create and maintain borrower, contact, employee, and CRM records;
• authenticate users, manage permissions, synchronize devices, and protect accounts;
• deliver and measure service, email, SMS, and push notifications consistent with user choices;
• troubleshoot, audit, analyze, and improve the performance and usability of the Services;
• detect, investigate, and prevent fraud, misuse, security incidents, or unlawful activity;
• comply with mortgage, employment, tax, licensing, recordkeeping, legal, and regulatory obligations; and
• establish, exercise, or defend legal claims and protect the rights and safety of Bloom, our users, and others.

We may create aggregated or de-identified information and use it for lawful business purposes. We will maintain it in de-identified form and will not attempt to re-identify it except as allowed by law to test our de-identification methods.

How we disclose information

We disclose personal information only as reasonably needed for the purposes described in this policy, including to the following recipients:

• Authorized users and personnel. Bloom employees, loan officers, processors, administrators, and other authorized users who need the information to perform their work or provide a requested Service.
• Service providers. Vendors that support cloud hosting and security, authentication, mobile app delivery, push notifications, analytics, communications, document processing, electronic signatures, customer support, data storage, and other business operations. These providers may process information only for contracted purposes and subject to appropriate safeguards.
• Mortgage and transaction participants. With authorization or as permitted by law, lenders, investors, settlement and title providers, appraisers, insurers, credit and verification providers, government agencies, and other parties involved in an inquiry, application, or transaction.
• Legal and safety recipients. Courts, regulators, law enforcement, auditors, or other parties when disclosure is required or permitted by law, needed to protect rights or safety, or reasonably necessary to investigate fraud or misuse.
• Business-transfer recipients. Advisers and counterparties evaluating or completing a merger, financing, acquisition, reorganization, bankruptcy, or transfer of some or all of Bloom's business or assets, subject to confidentiality and applicable law.
• At your direction. Other recipients when the individual or an authorized account user asks us to disclose the information or gives consent.

Analytics and advertising partners

Some public website pages may use measurement or advertising technologies from providers such as Google or Meta. Those providers may receive online identifiers and browsing or interaction data through cookies, pixels, or similar tools. Depending on applicable state law, this activity may be considered "sharing" for targeted or cross-context behavioral advertising. We do not use device-contact imports, authentication tokens, Social Security numbers, submitted mortgage documents, or push tokens for targeted advertising.

Email, text messages, calls, and push notifications

Bloom may send transactional or service communications about accounts, inquiries, applications, tasks, documents, security, or other requested services. Where permitted and consistent with consent, we may also send informational or promotional communications.

• Use the unsubscribe link in a marketing email to stop that category of email.
• Reply STOP to opt out of marketing text messages and HELP for help. Message and data rates may apply.
• Use the app or device settings to change push-notification permissions.

Opting out of promotional messages does not stop necessary account, security, legal, or transaction communications. Bloom does not share mobile telephone numbers or text-message opt-in data with third parties or affiliates for their independent marketing or promotional purposes. We may provide that information to communications vendors strictly to deliver Bloom's messages and operate the messaging program.

Cookies, pixels, and analytics

Our websites may use cookies, pixels, local storage, and similar technology to keep sessions working, remember preferences, secure forms, understand traffic, troubleshoot performance, measure campaigns, and improve our Services. Browser and device settings can block or delete many of these technologies, but doing so may affect site features. Where a consent or preference control is presented, use it to record the available choices for that browser or device.

On bloom.mortgage, we may assign an opaque first-party browser identifier and record limited website activity such as the page path, referral source, campaign parameters, form-start or form-submit status, and clicks on Bloom-owned email links. We do not use this identifier for fingerprinting and do not place form-field contents in browsing-event records. Activity is initially pseudonymous and may be associated with a CRM contact when the same browser submits a Bloom form or follows an email link that unambiguously belongs to one CRM contact. First-party visitor-event records are scheduled for deletion after 180 days; mortgage inquiry and CRM records may be retained longer as described below.

The mobile app may use local application storage for settings, authentication status, and offline CRM data. Mobile operating-system controls govern permissions such as Contacts, Camera, biometrics, and Notifications.

How long we retain information

We retain personal information for as long as reasonably necessary to provide the Services and manage the relationship, and afterward as needed to satisfy mortgage, lending, employment, tax, audit, security, dispute-resolution, and other legal or contractual obligations. The retention period varies by the record's type, sensitivity, purpose, and applicable requirements.

When information is no longer required, we take reasonable steps to delete, destroy, de-identify, or restrict it. Information may remain for a limited period in backups, fraud-prevention systems, legal holds, or records that applicable law requires us to keep. Deleting the mobile app or signing out does not delete server-side CRM, borrower, or transaction records.

Security

Bloom uses administrative, technical, and physical safeguards designed to protect personal information. Depending on the system, these measures can include encryption in transit, secure token storage, access controls, least-privilege roles, logging, monitoring, backups, and service-provider oversight.

No internet transmission, device, or storage system can be guaranteed completely secure. Users should protect their devices and credentials, use device-lock features, avoid sharing authentication codes, and report suspected unauthorized access promptly.

Your choices and state privacy rights

Depending on where you live and subject to legal exceptions, you may have the right to request that Bloom:

• confirm whether we process your personal information and provide access to it;
• correct inaccurate personal information;
• delete personal information;
• provide a portable copy of certain information;
• identify categories of information, sources, purposes, and recipients;
• opt you out of covered sale, targeted-advertising sharing, or certain profiling;
• limit certain uses of sensitive personal information; or
• appeal a decision on a privacy request.

To make a request, email admin@BloomLending.com with the subject "Privacy Request," call (480) 535-8796, or write to the address in the Contact Us section. Please describe the request and the Bloom Service or relationship involved. We may need to verify identity and authority before acting. An authorized agent may submit a request when allowed by law, but we may require proof of authorization and direct identity verification.

We will not unlawfully discriminate against someone for exercising a privacy right. Some information may be exempt from a state privacy law because it is governed by federal financial privacy law, maintained as an employment record, needed to complete a requested transaction, or subject to legal recordkeeping. If we deny or limit a request, we will explain the basis when required.

Children's privacy

The Services are not directed to children under 13, and the mobile CRM is restricted to authorized business users. We do not knowingly collect personal information directly from a child under 13 through the Services without legally valid authorization. If you believe a child provided information inappropriately, contact us so we can review and take appropriate action.

Third-party services and links

The Services may link to or integrate with third-party websites, applications, identity providers, app stores, and transaction services. Their privacy practices are governed by their own notices. Review those notices before providing information directly to a third party.

Updates to this policy

We may update this policy to reflect changes in our Services, technology, vendors, or legal requirements. We will post the revised version at this URL and update the date above. If a change is material, we may provide additional notice through the Service, by email, or by another appropriate method.

Contact us

Questions, concerns, or privacy-rights requests can be directed to Bloom Lending, LLC: