Privacy | Supermortgage

1. Who We Are

Tomorrow OS Inc., a Delaware corporation doing business as Supermortgage, owns and operates the Services. We refer to it as "we," "us," "Supermortgage," and "the Company."

We are a technology company. We are not a mortgage lender. We do not originate, broker, fund, or service mortgage loans, and we do not make credit decisions. The Services help you assemble and submit a mortgage application to a licensed mortgage lender that you select. That lender makes the credit decision and is responsible for its own use of your information under its own privacy policy.

The Services are available only in the United States and only to people 18 and over.

2. Information We Collect

Information you give us. Your name, email address, phone number, and mailing address when you create an account. Your date of birth, Social Security number or individual taxpayer identification number, citizenship or residency status, marital status, and current and prior addresses when you complete an application. Information about your employment, income, assets, debts, and any real estate you own. Information about the property you are buying or refinancing.

Financial account information. When you connect a financial account, our provider Plaid retrieves information from that account on your instruction. Depending on the connection, this may include account ownership details, balances, transaction history, and information about an existing mortgage, including its interest rate, balance, payment, and mortgage insurance status. Section 4 explains this in detail.

Credit information. We obtain a consumer report about you from a consumer reporting agency when you authorize us to do so. This includes your credit history, accounts, balances, payment history, inquiries, addresses associated with you, and credit scores.

Documents you upload. Pay statements, bank statements, tax returns, identification documents, and other records you provide to support your application.

Information we collect automatically. Your IP address, device and browser information, general location derived from your IP address, log data, and information about how you use the Services.

Information from others. Verification results from identity verification providers, property characteristics and valuation estimates from property data providers, and confirmations from service providers involved in your transaction.

Much of what we collect is sensitive, including your Social Security number, your government-issued identification, your financial account information, and your consumer report. We use it only for the purposes described in this policy and never to infer characteristics about you.

Cookies and similar technologies. We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand how they are used. You can control cookies through your browser settings; disabling them may prevent parts of the Services from working. We do not use cookies for advertising and we do not allow third-party advertising trackers on the Services.

Information about other people. If you provide information about another person, such as a co-applicant, a spouse, or someone giving you funds, you are responsible for having their permission to do so. A co-applicant creates their own account and gives their own authorizations; you cannot authorize a credit report or a financial account connection on someone else's behalf.

3. How We Use Information

To create and administer your account and verify your identity.
To prepare and assemble your mortgage application.
To verify the income, assets, employment, and other information you provide.
To transmit your application and supporting information to the licensed mortgage lender you select.
To communicate with you about your account, your application, and the Services.
With your separate consent, to monitor your existing mortgage and notify you when refinancing or another action may benefit you. See Section 5.
To prevent fraud and abuse and to secure the Services.
To comply with law and respond to lawful requests.
To enforce our agreements and protect our rights and the rights of others.

We do not use your financial account information, consumer report information, or the contents of the documents you upload to train, fine-tune, or evaluate artificial intelligence models.

4. Financial Account Data and Your Consent

We use Plaid Inc. to connect to your financial accounts. When you choose to connect an account, you authorize Plaid to retrieve information from that account and provide it to us. Plaid collects your credentials directly and processes them under its own privacy policy; we do not receive or store your online banking credentials.

Before you connect an account, we tell you what will be retrieved and ask for your authorization separately from any other consent in the application. Your authorization covers two things, and you may give one without the other:

Your mortgage application. We retrieve account ownership, balance, and transaction information to verify the assets and income you disclosed, and we transmit that verification to the lender you select. This information supports the lender's underwriting, including submission to Fannie Mae's Desktop Underwriter validation service.

Ongoing monitoring, if you choose it. With your separate authorization, we maintain the connection after your loan closes to track your mortgage interest rate, balance, payment, and mortgage insurance status, and to tell you when refinancing, removing mortgage insurance, or another action may save you money. This authorization is revocable at any time and is renewed periodically. If you revoke it or it expires, we stop retrieving new information.

You may revoke either authorization at any time through your account settings or by emailing privacy@supermortgage.com. Revoking stops future collection. It does not retrieve information already transmitted to a lender.

5. Credit Reports

We obtain your consumer report only after you authorize it, and only for the permissible purpose you authorize. Each applicant authorizes their own consumer report; one applicant cannot authorize a report about another.

We do not make credit decisions and we do not create consumer reports. If a lender declines your application, the lender is responsible for notifying you and for the disclosures that go with that decision.

6. How We Share Information

The lender you select. At your direction, we transmit your application, your supporting documents, and your verification results to the licensed mortgage lender you choose. The lender uses that information under its own privacy policy and its own legal obligations.

Service providers that perform services for us and are contractually restricted to using information only for that purpose, including financial data connectivity, identity verification, consumer reporting agencies, property data, document storage, hosting, communications, and payment processing.

Settlement service providers involved in your transaction, where necessary to complete it, including title, appraisal, and closing providers engaged by you or your lender.

Legal and safety: when required by law, subpoena, or court order; to establish or defend legal claims; to investigate fraud; and to protect the rights, property, or safety of any person.

In a business transfer, if the Company is involved in a merger, acquisition, financing, reorganization, or sale of assets.

We do not sell your personal information, share it for advertising, or disclose it to data brokers. Our service providers may use it only to perform services for us.

7. How Long We Keep Information

We keep personal information only as long as we need it for the purposes described in this policy, and then we dispose of it. Our periods are:

Account and identity information: while your account is open, and for 24 months after you close it.
Application information and the documents you upload: for 25 months after your application is approved, declined, withdrawn, or closed.
Financial account information: for 90 days after your loan closes or your application is closed, and then deleted. If you have authorized ongoing monitoring, we keep the connection and the information needed to operate it until you revoke that authorization or it expires.
Consumer report information: for 25 months after your application is approved, declined, withdrawn, or closed.
Communications with you: for 24 months.
Records we are legally required to keep, or that are subject to a legal hold: for as long as the law or the hold requires, after which the periods above apply.

We dispose of information securely, so that it cannot practicably be read or reconstructed. Deletion extends to backup copies on the schedule those backups follow.

If your application does not proceed, we do not keep your information indefinitely. It is deleted on the schedule above.

8. Your Rights

Much of the information we collect is financial information subject to the Gramm-Leach-Bliley Act. Information collected under that statute is generally exempt from the comprehensive state privacy laws. For information that is not subject to that exemption, and depending on where you live, you may have some or all of the following rights, and where a right is available to you under the law of your state, we honor it.

Know what personal information we have collected about you, where it came from, why, and who we shared it with, and get a copy.
Delete personal information we hold about you.
Correct inaccurate personal information.
Receive your information in a portable, machine-readable format.
Opt out of sale, sharing for advertising, and profiling with legal or similarly significant effects. We do not engage in any of these.
Exercise these rights without being denied service, charged a different price, or given a different level of service.
Appeal a decision on your request, where your state provides for it.

Limits on deletion. Deleting your personal information removes your account and identifying information. It does not remove records we are required to keep, and it does not remove information already transmitted to a lender at your direction, which that lender holds under its own obligations. If you want a lender to delete information, you will need to contact that lender.

Disputing credit information. We do not create consumer reports. If you believe information in your consumer report is inaccurate, dispute it with the consumer reporting agency that produced it. We will tell you which agency that was.

How to make a request. Use the privacy controls in your account settings, email privacy@supermortgage.com, or write to us at the address in Section 11. Before we act on a request we verify that it comes from you, ordinarily by asking you to confirm information already associated with your account or to respond from the email address on file. If we cannot verify a request to a reasonable degree of certainty we will tell you and will not act on it. We may decline requests that are excessive, repetitive, or manifestly unfounded, or where an exception under applicable law applies. We respond within the time your state's law requires, generally 45 days, and may extend where the law permits.

Marketing messages. You can stop marketing emails using the unsubscribe link in any of them, and marketing texts by replying STOP. You will still receive messages about your account, your application, and your transaction, because those are not marketing.

Automated decisions. We do not make decisions about you that produce legal or similarly significant effects. Our monitoring service may tell you that refinancing or another action could benefit you, but it is information, not a decision, and the lender you select makes the credit decision.

9. Security and Your Responsibilities

We maintain a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold. One individual is accountable for it, and we review it at least once a year and whenever our business changes materially.

No method of transmission or storage is completely secure, and we cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed by unauthorized parties.

You are responsible for keeping your account credentials confidential and for activity under your account. Tell us promptly if you believe your account has been compromised.

The Services may link to or work with websites and services we do not operate, including the websites of lenders and financial institutions. Their privacy practices are their own and are not covered by this policy.

10. Children and State Disclosures

The Services are not available to anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it and close the account.

California. This policy serves as our notice at collection and California privacy disclosure for information not exempt under the Gramm-Leach-Bliley Act. The categories of personal information we collect, the sources, the purposes, the third parties to whom we disclose it, and our retention criteria appear in Sections 2, 3, 6, and 7. We have not sold or shared personal information in the preceding twelve months. You may use an authorized agent to make a request; we will ask for proof of authorization and may ask you to confirm it directly. Because we do not disclose personal information for third-party direct marketing, there is nothing to request under the Shine the Light law.

Other states. If you live in a state with a comprehensive privacy law, you have the rights in Section 8 to the extent your state provides them, including the right to appeal. Where required, we honor universal opt-out preference signals such as Global Privacy Control. Nevada residents may direct us not to sell certain personal information; we do not sell personal information.

11. Changes and Contact

We may update this policy. If we make a material change we will notify you through the Services or by email before it takes effect and post the updated date above. Changes apply going forward.

Email privacy@supermortgage.com or write to Tomorrow OS Inc., 2261 Market Street, Suite 86665, San Francisco, CA 94114.

For questions about the security of your information, email security@supermortgage.com.