Privacy Policy
This Privacy Policy describes how Amortize AI collects, uses, and protects your personal information when you use our B2B mortgage technology platform.
1. Introduction & Scope
Amortize Me LLC, doing business as Amortize AI ("we," "our," or "us"), which publishes the app shown as "Amortize" on Google's sign-in and consent screens, is committed to protecting your privacy and handling your data with transparency and care. This Privacy Policy explains how we collect, use, share, and safeguard personal information when you use our mortgage technology platform (the "Service").
Our Service is designed for business-to-business (B2B) use by mortgage professionals, loan officers, and lending institutions. We handle sensitive financial data including Social Security Numbers (SSN), credit scores, loan applications, 1003 forms, and other personally identifiable information (PII) of mortgage borrowers.
This policy applies to all users of our Service, including administrators, loan officers, and any authorized users within your organization.
Google user data at a glance
- What we access: Only if you choose to connect a Google account, Amortize AI accesses (1) the email address of that account, (2) Gmail messages your borrowers and leads send to your Inbox after you connect (for other new Inbox mail, only the sender, to tell which is which), and email you send through the Service, and (3) the free/busy times on your primary Google Calendar, plus the appointments the Service books on it.
- Why: To show your conversations with borrowers and leads in the Service, send email from your own address, book appointments on your calendar, and keep the Service secure. We do not use it for any other purpose.
- What we never do: We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine learning models.
- Amortize AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Section 5 lists every Google permission we request and describes exactly what we access, how we use it, whom we share it with, and how we protect, keep, and delete it.
2. Information We Collect
We collect various types of information to provide and improve our Service:
2.1 Personal Information
Account Information:
- Name, email address, phone number
- Company/organization name and role
- Professional credentials (NMLS ID if applicable)
- Authentication credentials (encrypted passwords)
Borrower Information (entered by you):
- Full names, contact details, Social Security Numbers
- Financial information (income, assets, debts, credit scores)
- Employment and residential history
- Loan application data and 1003 forms
- Property information and transaction details
Connected Account Data (when you choose to connect an account):
- Email messages, account email address, and calendar availability from a Google (Gmail, Google Calendar) or Microsoft (Outlook) account you connect. Section 5 lists exactly what we access from Google and why
- Text messages, call records, voicemails, and call recordings (where you enable recording) for communications you send or receive through the Service
Communications Data:
- Transcripts of voicemails, recorded calls, and calls handled by the AI voice assistant, along with call outcomes and any appointments booked
- Consent and opt-out records for borrowers and leads, including how and when consent was given and any STOP or do-not-contact requests
- Business registration information you provide to enable text messaging (legal business name, EIN or tax ID, business address, website, and a business contact), as described in Section 6
Account Activity and Records:
- Billing records, including subscription details, communication credit purchases, and credit usage. Card details are collected and stored by Stripe, not by us
- API key metadata (name, permissions, creation and last-use dates) and API usage logs
- Records of when a team lead or Amortize AI administrator signs in to your account on your behalf (see Section 7)
- Records of your acceptance of our Terms of Service and this Privacy Policy, including the version accepted, the date and time, and the IP address and browser used
- If you opt in to text messages from us: the mobile number you give us for them, the message types you chose, and a record of each opt-in and opt-out (see Section 10)
2.2 Usage Data
- Browser type and device information (e.g., operating system)
- Activity data (pages visited, features used, session duration)
- Performance and diagnostic data (error logs, response times)
- Authentication and session events
3. How We Use Your Information
We use collected information for the following purposes:
- Service Delivery: Provide, maintain, and improve our mortgage technology platform
- Data Processing: Process loan applications, generate pricing scenarios, and perform calculations
- Communication: Send service updates, notifications, and respond to inquiries, including by text message if you opt in (see Section 10)
- Connected Account Features: Sync, display, and send email, and book calendar appointments, for accounts you connect (see Section 5)
- AI-Assisted Features: Generate reply insights, conversation summaries, translations, and transcriptions that are shown to you within the Service (for Google user data, see Section 5.2)
- Compliance: Meet regulatory requirements (GLBA, FCRA, ECOA, state lending laws)
- Security: Detect, prevent, and address fraud, abuse, and security threats
- Messaging and Calling: Deliver texts and calls you send, register your business for text messaging with carriers, keep consent records, and honor opt-out requests (see Section 6)
- Billing: Process subscription payments and communication credit purchases, and manage accounts
- Legal Obligations: Comply with legal requirements and enforce our terms
4. Data Sharing & Third-Party Services
We share data with third-party service providers who assist in operating our Service. All third parties are contractually obligated to protect your data and use it only for specified purposes.
4.1 Third-Party Service Providers
4.2 Other Disclosures
We may disclose your information in the following circumstances:
- With Your Consent: When you explicitly authorize us to share information
- Business Transfers: In connection with mergers, acquisitions, or asset sales
- Legal Requirements: To comply with laws, regulations, court orders, or government requests
- Protection of Rights: To protect our rights, property, safety, or that of others
- Aggregated Data: We may share anonymized, aggregated data that cannot identify individuals
5. Google User Data & Connected Accounts
You may choose to connect a Google account (Gmail and Google Calendar) to the Service. Connecting is optional, and the rest of the Service works without it. This section describes the data we receive from Google APIs ("Google user data"): what we access, how we use it, whom we share it with, and how we protect, keep, and delete it. We access your Google account only through the permissions you grant on Google's consent screen.
You may also connect a Microsoft account (Outlook email and calendar). We access the equivalent Microsoft data and apply the same practices to it.
5.1 Google Permissions We Request and the Data We Access
The table below lists every Google permission ("scope") the Service requests, what it allows, and the Google user data we actually access.
| Permission (scope) | What Google says it allows | What we access and why |
|---|---|---|
Gmail: readhttps://www.googleapis.com/auth/gmail.readonly | View your email messages and settings | When a message is delivered to your Inbox after you connect, we first read only its sender address, to check whether it is from a borrower or lead in your account. Only those messages are downloaded and stored: the sender, the recipients (To and Cc), the subject, the message body (text and HTML), the preview snippet, message and thread identifiers (Message-ID, In-Reply-To, References), read/unread status, and the date received. For attachments, only the file name, type, and size; we do not download attachment contents. Any other message is skipped after that check: we do not download its subject, body, or attachments, and we keep nothing about it. We also read your Gmail address and a mailbox sync marker (history ID), and ask Gmail to notify us when new Inbox mail arrives. We use this to show your conversations with borrowers and leads in the Service. We do not read mail that was in your mailbox before you connected, your Sent or Drafts folders, other labels, contacts, or settings, and we never change or delete anything in your mailbox. |
Gmail: sendhttps://www.googleapis.com/auth/gmail.send | Send email on your behalf | We send, from your Gmail address, the emails you write in the Service and the emails sent by email campaign steps you configure. We keep a copy of each email sent through the Service (recipients, subject, and body) in your account. |
Email addresshttps://www.googleapis.com/auth/userinfo.email | See your primary Google account email address | Requested when you connect Google Calendar. We read your email address to identify which Google account is connected and show it to you in Settings. (When you connect Gmail, we identify the account through Gmail itself.) |
Calendar: your eventshttps://www.googleapis.com/auth/calendar.events.owned | See, create, change, and delete events on Google calendars you own | We create appointments that you or the AI voice assistant book with a borrower or lead on your primary Google calendar. Each appointment has a title, time, and description we write. The borrower or lead is invited (always for appointments the AI voice assistant books, and when you choose to invite them otherwise), so Google emails them an invitation. When you cancel an appointment in the Service, we delete the calendar event the Service created, and Google emails the invitee a cancellation. We never read, change, or delete any other event, and we store only the identifier of each appointment we create. |
Calendar: availabilityhttps://www.googleapis.com/auth/calendar.freebusy | View your availability in your calendars | The busy and free time ranges on your primary Google calendar, to find open times for appointments. This permission does not show us the titles, descriptions, locations, or attendees of your events, and we do not store your busy times. |
5.2 How We Use Google User Data
We use Google user data only to provide and improve the following features, which you can see and use in the Service:
- Conversation history: Inbox messages from a borrower or lead in your account, and emails you send to them through the Service, are added to that lead's conversation timeline. For other Inbox messages we check only the sender, and we do not download, store, share, or process them
- Sending email: Sending the emails you write and the email campaign steps you configure, from your own address
- AI-assisted features: For emails in a lead's conversation, both received and sent, our AI provider (Anthropic) processes the message text to generate the reply insights (such as intent and sentiment), conversation summaries, follow-up reminders, and lead prioritization shown to you. Campaign reply sentiment uses only the email's subject line. When you translate a text message to a lead, recent emails in that conversation may be included as context. The results are shown to you and stored in your account
- Notifications: Showing you a short preview when a lead emails you
- Scheduling: Checking your availability and booking appointments on your calendar, including when the AI voice assistant books an appointment for you
- Security and support: Protecting the Service against abuse, fixing problems you report, and complying with applicable law
We do not use Google user data for any other purpose.
5.3 Limited Use
Amortize AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide or improve the user-facing features described in Section 5.2
- We do not sell Google user data, and we do not transfer it to third parties such as advertising platforms, data brokers, or information resellers
- We do not use or transfer Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising
- We do not use Google user data to determine credit-worthiness or for lending purposes
- We do not use Google user data, including data obtained through Google Workspace APIs, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. The AI features in Section 5.2 process your data only to produce results for you, and our AI provider does not use it to train its models
- No person at Amortize AI reads your Google user data unless (a) you give us affirmative permission for specific messages (for example, in a support request), (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized for internal operations. These limits also apply when authorized Amortize AI personnel sign in to your account on your behalf (see Section 7.1)
5.4 Sharing of Google User Data
We do not sell Google user data. We share it only as listed below.
| Recipient | What they receive | Why |
|---|---|---|
| Google Cloud Platform (our service provider) | All Google user data we store | Hosting our servers, receiving Gmail new-mail notifications, and encrypted archival storage |
| PlanetScale (our service provider) | Stored messages, account identifiers, and encrypted access tokens | Database hosting |
| Anthropic (our service provider) | Text and subject lines of emails in a lead's conversation. Never other Inbox mail or calendar data | Generating the AI-assisted features in Section 5.2. Anthropic does not use this data to train its models |
| Telnyx (our service provider) | Open appointment times calculated from your free/busy data. Never event details | Letting the AI voice assistant offer appointment times to a lead |
| The borrower or lead you meet with | The invitation for their appointment (title, time, description, and your calendar address), and a cancellation if you cancel it | Google sends them the invitation when an appointment is booked |
| Team leads and administrators of your team or organization | Lead conversations in your account, including synced email | Managing and supporting the team, as described in Section 7.1 |
| Webhooks that you or your organization's administrators configure | The sender, recipients, subject, and text of emails from your borrowers and leads and of emails you send through the Service. An organization-wide webhook receives these for every member of the organization | Delivering data to systems you or your organization choose (see Section 7.2) |
| API keys and AI tools you authorize, including through our MCP server | Emails in your leads' conversations, including full message content | Access you set up (see Section 7.2) |
We may also disclose Google user data when necessary for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets, with notice to you. Our service providers are bound by contracts that allow them to use the data only to provide their services to us.
5.5 Storage, Security, Retention & Deletion
How we protect it:
- Google user data is stored in United States data centers
- It is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256
- Google access and refresh tokens are additionally encrypted at the field level (AES-256-GCM) and are never shown to anyone
- Access to production systems is limited to authorized personnel through role-based access controls
- We accept Gmail new-mail notifications only when they carry a verified Google-signed token
How long we keep it:
- We keep synced and sent messages while your account is active, and afterward only as long as needed to meet the record-keeping obligations described in Section 9
- Message content older than 60 days is moved to encrypted archival storage on Google Cloud Platform
- Copies of webhook deliveries are kept for 30 days, or 90 days if delivery failed
- We do not store your calendar's busy times or the details of your existing events
Disconnecting and deletion:
- You can disconnect Gmail in Settings → Integrations and Google Calendar in Settings → Scheduling at any time. We stop accessing it immediately and delete our stored access tokens for it. Gmail and Google Calendar share one Google authorization, so we ask Google to revoke our access when you disconnect the last of them
- You can remove our access to your Google account at any time at myaccount.google.com/permissions
- Disconnecting does not delete data already stored. To have us delete the Google user data we have stored, including messages, access tokens, and the AI results generated from them, email privacy@amortize.ai, including when you close your account. We will delete it within 30 days, except for records we are legally required to keep, which we will keep only for as long as that requirement applies
6. Communications with Borrowers & Leads
The Service lets you text, call, and email borrowers and leads. For information about those borrowers and leads, we act as a service provider to you: we process it on your behalf and at your direction to provide the Service. If you are a borrower or lead with a question about your information, please contact the loan officer or company that contacted you; we will assist them in responding.
6.1 Text Messaging
- To send text messages, U.S. carriers require your business to be registered. We share the business registration information you provide with Telnyx, The Campaign Registry, and wireless carriers for that purpose
- We keep records of the consent borrowers and leads give to receive messages, including consent collected through opt-in pages and brand websites we host for you
- We honor opt-out requests. When a recipient replies STOP (or a similar keyword), we record the opt-out and stop further messages from the Service to that number
- Mobile phone numbers and text messaging opt-in data and consent are not shared with third parties or affiliates for their marketing or promotional purposes. This excludes the service providers that deliver messages on your behalf
6.2 Calls, Recording & Transcription
- Call recording is off by default. You may turn it on only after confirming that you will tell callers the call is being recorded where the law requires it
- Recordings are stored in encrypted storage on Google Cloud Platform in the United States. Recordings and voicemails may be transcribed (see Section 4.1) so you can read and search them
- Transcripts may be processed by our AI provider to generate the summaries and insights described in Section 3
6.3 AI Voice Assistant
- If you enable the AI voice assistant, it may call or answer calls from your leads on your behalf, identify itself as an AI assistant at the start of the call, answer questions, book appointments on your calendar, and transfer the call to you
- We record whether the AI disclosure was given, along with the call transcript, outcome, and any appointment booked, and show them to you in the lead's history
- AI voice assistant calls are processed by Telnyx and the AI models it hosts, as described in Section 4.1
7. Team Access, Integrations & Mobile App
This section describes other ways information in your account may be accessed or leave the Service.
7.1 Team Leads, Administrators & Support
- If you belong to a team or organization, its team leads and administrators may view reports about your activity and, where permitted, sign in to your account on your behalf to help you or to manage the team
- Authorized Amortize AI personnel may also sign in to your account on your behalf to provide support, investigate a problem, or protect the Service. During these sessions, our personnel view Google user data only as permitted by Section 5.3
- Every such session is shown to the person signed in on your behalf with a clear notice, and its start, end, and the person responsible are logged. These logs are kept even if the account is later deleted
7.2 API Keys, Webhooks & Connected Tools
- You can create API keys to access your account data programmatically, including through our Model Context Protocol (MCP) server, which lets AI assistants and other tools you choose read and act on your data. We store API keys only in hashed form and log their use
- You can also configure webhooks that send lead and message data to URLs you choose, and integrations such as Bonzo CRM that exchange lead data with the Service. Your organization's administrators can configure organization-wide webhooks that receive this data for every member of the organization, including synced email (see Section 5.4)
- Data you send to a third-party tool, AI assistant, webhook, or integration at your direction is handled under that third party's terms and privacy policy, not this one. Revoke a key or remove an integration at any time in Settings to stop further access
7.3 Mobile App
Our mobile app gives you access to the same account and data as the web Service, and this Privacy Policy applies to it. The app stores your sign-in credentials in your device's secure storage. We do not use the app to collect your location, contacts, or advertising identifiers.
8. Data Security
We implement industry-standard security measures to protect your data:
- Encryption at Rest: All data stored in our databases is encrypted at rest using AES-256 encryption.
- Sensitive Credential Protection: Third-party integration credentials (e.g., CRM API keys) are encrypted at the field level. Social Security Numbers submitted for credit report processing are transmitted securely via TLS and are not stored in our systems after processing is complete.
- Transport Layer Security (TLS): All data transmission is encrypted using TLS 1.2 or higher
- Access Controls: Role-based access controls limit data access to authorized personnel only
- Authentication: Multi-factor authentication and strong password requirements
- Regular Audits: Periodic security assessments and vulnerability testing
- Data Isolation: Organization data is logically separated in multi-tenant architecture
- Monitoring: Continuous monitoring for suspicious activity and security threats
- SOC II Readiness: We are actively pursuing SOC II Type II certification to validate our security controls.
While we employ robust security measures, no system is completely secure. We cannot guarantee absolute security of your data during transmission or storage.
9. Data Retention & Deletion
We retain your data for as long as necessary to provide our Service and comply with legal obligations:
- Account Data: Retained while your account is active and for 7 years after closure for compliance purposes
- Borrower Data: Retained as long as required by federal and state regulations (typically 3-7 years)
- Communications: Messages, call records, recordings, voicemails, and transcripts are retained on the same basis as borrower data. Older message content may be moved to encrypted archival storage
- Consent and Opt-Out Records: Records for borrowers and leads, and for text messages we send you, are retained for as long as needed to demonstrate compliance with telemarketing and messaging laws, including after the related lead or account is deleted
- Terms Acceptance and Account Access Logs: Retained for the life of the account and for 7 years after closure
- Usage Logs: Retained for up to 2 years for security monitoring and incident response purposes
- Financial Records: Retained for 7 years to comply with tax and financial regulations
You may request deletion of your data subject to legal and contractual retention requirements. Some data may be retained in anonymized form for service improvement purposes.
10. Text Messages from Amortize
This section covers the text messages Amortize AI sends to you, our customer. It is separate from the messages you send to borrowers and leads through the Service, which Section 6 describes.
- Optional, and chosen separately: In the last step of creating your account, or in Settings → Profile, you can give us a mobile number and choose, one by one, whether to receive marketing messages, account notifications, and customer care messages from us. Nothing is selected for you, and you can use the Service without opting in
- What we collect: The mobile number you give us for these texts, which we keep separately from the phone number on your profile, the message types you chose, and a record of each opt-in and opt-out: the wording you agreed to, the date and time, and the IP address and browser you used. We keep this record as proof of your consent
- How we use it: Only to send you the types of messages you chose and to honor your opt-out requests
- Opting out: Reply STOP to any text from us to stop all of them, or turn individual message types off in Settings → Profile. Reply HELP for help. Message frequency varies, and message and data rates may apply. Opting out of texts does not affect your account or the service emails we send
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as the messaging providers and wireless carriers that deliver our messages, is permitted. All other categories in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Section 16 of our Terms of Service describes the text messaging program in full.
11. Your Rights
As a user of our U.S.-based Service, you have the following rights with respect to your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your data (subject to legal retention requirements)
- Portability: Request your data in a structured, machine-readable format
- Opt-Out: Opt out of marketing communications (service-related communications may continue), including text messages from us: reply STOP to any of them, or change your choices in Settings → Profile
To exercise these rights, contact us at privacy@amortize.ai. We will respond within 30 days of receipt of your request.
12. State-Specific Rights
California Residents (CCPA/CPRA):
California residents have additional rights under the California Consumer Privacy Act:
- Right to know what personal information is collected, used, and shared
- Right to delete personal information (subject to exceptions)
- Right to opt-out of sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising privacy rights
Virginia, Colorado, Connecticut, Utah Residents:
Residents of these states have similar rights under their respective state privacy laws, including rights to access, correct, delete, and obtain a copy of personal information.
To exercise state-specific rights, contact privacy@amortize.ai.
13. Children's Privacy
Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.
14. U.S.-Only Service
Amortize AI operates exclusively within the United States. Our platform serves U.S.-based mortgage professionals, and we store your data in United States data centers. We select service providers (listed in Section 4.1) that process data in the United States wherever they offer that option, and our Service is not available to users located outside the United States.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
We will notify you of material changes by:
- Posting the updated policy on our website with a revised "Last Updated" date
- Sending email notification to your registered email address
- Displaying a prominent notice within our Service, and where the change is material, asking you to review and accept the updated policy before you continue using the Service
Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
16. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: privacy@amortize.ai
Legal Inquiries: legal@amortize.ai
Mailing Address:
Amortize Me LLC, dba Amortize AI
Attn: Privacy Officer
2700 Main Street, Unit 155
Irvine, CA 92614
This document was last updated on October 16, 2026. For questions, contact legal@amortize.ai