Privacy Policy

Effective date: January 27, 2026 · Last updated: January 27, 2026

1. Introduction

Harris Capital Mortgage Group, LLC (NMLS# 1918223) (“HCMG,” “we,” “us,” or “our”) operates hcmgloans.com and related internal platforms including our Liftoff operations portal. This Privacy Policy explains how we collect, use, share, and protect your information when you use our website, mortgage services, and internal loan origination tools.

As a licensed mortgage company, we are subject to the Gramm-Leach-Bliley Act (GLBA), Regulation P (12 CFR Part 1016), the Real Estate Settlement Procedures Act (RESPA), the Equal Credit Opportunity Act (ECOA), and applicable state mortgage privacy laws in Alabama, California, Colorado, Florida, Georgia, Maryland, Mississippi, Nevada, Texas, Virginia, and Washington D.C.

2. Information We Collect

We may collect the following categories of information from website visitors, loan applicants, and loan officers:

• Contact information: name, email address, phone number, mailing address
• Mortgage-related inputs: price range, income range, credit range, loan goals, loan purpose, loan amount, purchase price, property address
• Loan transaction data: ARIVE loan numbers, loan type, lock status, earnest money, seller credits, income notes, asset notes, credit notes (collected from licensed loan officers submitting requests through our internal Liftoff system)
• Usage data: pages visited, time on site, referring URL, funnel interactions
• Device and browser information: IP address, browser type, operating system
• Gift fund donor information: name, address, phone, email (when applicable)

3. How We Use Your Information

• Processing mortgage applications and loan origination requests
• Connecting you with licensed Harris Capital Mortgage Group loan officers
• Sending SMS and email communications if you have consented
• Coordinating loan disclosures, registrations, submissions, and lock requests through our internal operations team
• Improving our website and services
• Fraud detection and rate limiting (IP address used to detect abuse)
• Complying with legal obligations (RESPA, ECOA, GLBA, TRID, state mortgage regulations)

4. SMS Communications

We may send you SMS messages if you provided your phone number and consented to receive texts. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for assistance. We do not sell your phone number to third parties. See our SMS Policy for full details.

5. Data Sharing & Service Providers

We do not sell your personal information. We may share your information with the following parties strictly for the purposes listed below:

Harris Capital Mortgage Group Personnel

• Licensed loan officers who will contact you regarding your mortgage inquiry
• Operations and processing staff who handle loan registrations, disclosures, and submissions through our internal Liftoff platform

Technology Service Providers

The following service providers process data on our behalf under confidentiality obligations. Each is bound by their own privacy policy and security certifications as noted:

• Legal authorities when required by applicable law, court order, or regulatory requirement

6. Data Retention

We retain your information only as long as necessary to provide our services and meet legal obligations:

• FHA and VA loan files: 2 years post-closing per HUD Handbook 4000.1 and VA Lender Handbook
• Conventional and other loan files: 7 years post-closing per GLBA and state mortgage regulations
• Marketing and lead inquiry data: Until you opt out or request deletion, or 7 years from last contact, whichever is earlier
• ARIVE lookup results: 120 seconds (automatically deleted after use, these are transient lookups only)
• Session tokens: 7 days, then automatically expired

After the applicable retention period, records are archived and then permanently deleted in accordance with our Written Information Security Program (WISP).

7. Your Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

• Right to know: Request a copy of the personal information we hold about you
• Right to correct: Request correction of inaccurate personal information
• Right to delete: Request deletion of your personal information (subject to legal retention requirements, mortgage records must be retained per GLBA and HUD regulations)
• Right to opt out of sale: We do not sell your personal information

To exercise any of these rights, submit a request at hcmgloans.com/privacy/data-request or email privacy@hcmgloans.com. We will respond within 30 days (45 days for Virginia VCDPA requests). We may ask you to verify your identity before processing your request.

8. Security Safeguards

We maintain physical, electronic, and procedural safeguards to protect your nonpublic personal information (NPI) in compliance with the GLBA Safeguards Rule (16 CFR Part 314). These include:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for all data at rest (managed by Supabase)
• Row-Level Security (RLS) in our database, each user can only access data they are authorized to see
• HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options) to prevent web-layer attacks
• Distributed rate limiting on all authentication and data-submission endpoints
• Session tokens stored as cryptographically random UUIDs in HttpOnly, SameSite=Strict cookies
• Role-based access control, ops staff, lock desk agents, and help desk agents each have scoped access to only the loan queues relevant to their role

9. GLBA Annual Privacy Notice

As a mortgage company and covered financial institution under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6827), we provide this notice of our privacy practices. We do not share your nonpublic personal information with non-affiliated third parties for marketing purposes. We share NPI only as permitted by Regulation P (12 CFR Part 1016): to process transactions you request, to service your account, and as required by law.

You have the right to opt out of certain data sharing. Because we do not share NPI for marketing purposes, there is nothing to opt out of at this time. If our practices change, we will notify you in advance.

10. Cookies and Tracking

We use session cookies for authentication (HttpOnly, not accessible to JavaScript) and analytics cookies from PostHog to understand how visitors use our website. We do not use cross-site tracking cookies. You can disable analytics cookies through your browser settings, this will not affect your ability to use our mortgage services.

11. Children's Privacy

Our website and services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, contact us immediately at privacy@hcmgloans.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes affecting how we use your NPI, we will notify you by email or by posting a prominent notice on our website at least 30 days before the change takes effect.

13. Contact