Skip to main content

Privacy Policy

Draft — pending legal review. This page is a placeholder that outlines the sections we intend to publish. It is not a binding agreement or an authoritative disclosure. If anything here matters to you, please contact us at ryan@sunrise.loans before relying on it.

1. What This Policy Covers

This policy explains how Sunrise Lending (“we,” “us”) collects, uses, shares, and protects personal information about consumers who use our Platform. It applies to information we collect through the Platform, through email, and through any integrated partner channels.

2. Information We Collect

You provide us:

  • Identity data — name, date of birth, Social Security number, government-issued ID.
  • Contact data — email, phone, mailing address, business address.
  • Financial data — income, assets, debts, bank statements, tax returns, credit authorization.
  • Business data — business structure, years in business, EIN, revenue.
  • Property data — address, estimated value, loan amount.

We collect automatically:

  • Device and usage data — IP address, browser type, pages visited, timestamps. Used for security and service improvement.
  • Cookies — we use strictly-necessary cookies for authentication. See Section 7 for details.

We receive from third parties:

  • Credit bureaus — if you authorize a credit inquiry later in the process, we or our broker partner may receive a credit report about you. We do not currently obtain credit reports through this website.

3. How We Use Your Information

  • Pre-qualify you and match you with lender products.
  • Share your application materials with lenders you authorize.
  • Verify your identity and prevent fraud (including comparing documents to what you self-reported).
  • Comply with legal obligations (AML, OFAC screening, recordkeeping).
  • Communicate with you about your application, our services, and material changes to this policy.

4. How We Share Your Information

We share personal information only as described below. We do not sell your personal information.

  • Lenders. We share application and supporting documents with the specific lenders you authorize via the Platform, so they can underwrite and decide on your loan.
  • Service providers. Hosting (Supabase, Vercel), analytics, email delivery, and security vendors bound by confidentiality and data-handling obligations.
  • Legal. To comply with subpoenas, court orders, or other legal process; to protect our rights; or to prevent fraud.
  • Business transfers. If we are acquired or merge with another entity, your information may be transferred subject to this policy.

5. Your Rights Under Federal Financial Privacy Law (GLBA)

As a financial-services provider, we are subject to the Gramm-Leach-Bliley Act. We maintain physical, electronic, and procedural safeguards to protect your nonpublic personal information. Our disclosure of nonpublic personal information is limited to what is permitted or required by law. You may opt out of certain information-sharing by contacting us at ryan@sunrise.loans.

6. Your Rights Under State Privacy Laws

California (CCPA / CPRA)

If you are a California resident, you have rights to (a) know what personal information we hold about you, (b) request deletion, (c) request correction, and (d) opt out of sale or sharing for targeted advertising (we do neither). To exercise these rights, email ryan@sunrise.loans. We will verify your identity before fulfilling the request.

Other states

Residents of other states with comprehensive privacy laws (VA, CO, CT, UT, TX, OR, and others) have similar rights. Contact us at the same address to exercise them.

7. Cookies

We use strictly-necessary cookies to keep you signed in and to maintain CSRF protections. We do not use advertising or third-party analytics cookies at this time.

8. How We Protect Your Information

Data is encrypted in transit (TLS 1.2+) and encrypted at rest at the database and storage layers using our cloud providers’ server-side encryption defaults. Database access is gated by row-level security policies enforced by Postgres; document storage is gated by per-borrower folder scoping with the same RLS posture. Access to production data is limited to authorized personnel and logged. No system is impenetrable, so we cannot guarantee absolute security; we will notify affected users in accordance with applicable breach-notification laws if a security incident affects their information.

9. Retention

We retain personal information for as long as your account is active and for the period required by federal and state record-keeping laws after that (typically 3–7 years for mortgage-related records). After the retention period, we delete or de-identify the information.

10. Children

The Platform is not directed to children under 18 and we do not knowingly collect information from them.

11. Changes to This Policy

We will revise this policy as our practices or the law change. Material changes will be communicated via email or an in-app notice before taking effect.

12. Contact Us

Questions or requests regarding your information? Email ryan@sunrise.loans or write to [mailing address].