Privacy Policy

1. Information We Collect

Information You Provide

When you create an account, fill out a form, or contact us, we may collect:

• Name and email address
• Phone number
• Company name and job title
• Billing and payment information (processed securely by our payment provider)
• Any other information you choose to share with us

Information Collected Automatically

When you use our website or platform, we automatically collect:

• IP address and general location
• Browser type and operating system
• Pages visited, time spent, and referral sources
• Device information

Information We Do Not Collect

Empower LO does not collect, store, or process any of the following:

• Social Security numbers
• Financial account numbers or credit/debit card numbers (payment processing is handled entirely by Stripe)
• Credit reports or credit scores
• Health or medical information

When clients integrate their Loan Origination System (LOS), certain loan-level data (e.g., property address, loan amount, interest rate) may be present in their individual subaccount. See Section 9: GLBA & Financial Data for details on how this data is handled.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our platform and services
• Process transactions and manage your account
• Send you updates, marketing communications, and support messages
• Respond to your requests and provide customer support
• Analyze usage patterns to improve the user experience
• Comply with legal obligations and protect our rights

We do not use customer data for AI model training. Customer data is used solely for delivering the contracted marketing and CRM services.

You can opt out of marketing emails at any time by clicking the unsubscribe link in any email or contacting us directly.

3. Cookies & Tracking

We use cookies and similar tracking technologies to:

• Keep you signed in
• Remember your preferences
• Understand how you use our site
• Measure the effectiveness of our marketing

We may use third-party analytics tools (such as Google Analytics) that place their own cookies. You can manage cookie preferences through your browser settings. Disabling cookies may affect some features of the site.

4. Third-Party Services & Subprocessors

Our platform integrates with and relies on the following third-party services to deliver functionality:

• HighLevel, Inc. (GoHighLevel) — CRM and marketing automation platform. All contact data, communications (SMS, email, voice), workflows, and CRM records are processed and stored within HighLevel's infrastructure. Messaging and email delivery are handled by HighLevel's subprocessors (including Twilio and Mailgun) and governed by HighLevel's Data Processing Agreement.
• Stripe — Payment processing. Stripe handles all billing and payment card data. Empower LO does not store or have access to payment card numbers.
• Google Analytics — Website analytics and traffic measurement.

Each of these services maintains its own privacy policy and security practices. We encourage you to review their policies. Empower LO does not engage additional third-party subprocessors for customer data processing beyond those listed above.

5. Data Sharing

We do not sell your personal information. We may share your information in the following situations:

• Service providers: With the trusted third parties listed in Section 4 who help us operate our business
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets
• With your consent: When you explicitly agree to share your information

6. Data Security

We take reasonable measures to protect your information, including:

• Encryption in transit: All data is transmitted using TLS 1.2 or 1.3 with 2,048-bit keys or better
• Encryption at rest: Platform data is stored using AES-256 encryption
• Access controls: Role-based access control (RBAC) with two-factor authentication (2FA) available for all user accounts
• Secure hosting: Infrastructure hosted on Google Cloud Platform and Amazon Web Services, both of which maintain SOC 2 Type II and ISO 27001 certifications
• Password security: User passwords are hashed using industry best practices and encrypted at rest

Our underlying platform provider, GoHighLevel, maintains SOC 2 Type II compliance and undergoes annual penetration testing. For full details, see the HighLevel Security and Compliance Overview.

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Data Hosting & Location

All customer data is hosted within the United States through GoHighLevel's cloud infrastructure on Google Cloud Platform and Amazon Web Services. No data is stored in physical offices or on-premises servers. Data does not leave the United States.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you close your account, we will delete or anonymize your data within 90 days of account closure, unless we are required to retain it for legal, regulatory, or legitimate business purposes.

Certain logs and metadata may be retained by our platform provider for security and compliance purposes as described in their Data Processing Agreement.

9. GLBA & Financial Data

Empower LO serves mortgage professionals and loan officers. We understand the importance of compliance with the Gramm-Leach-Bliley Act (GLBA) and related financial privacy regulations.

Empower LO is not a financial institution under GLBA, but we serve clients whose businesses are subject to GLBA. We treat our obligations seriously as a service provider that may receive Nonpublic Personal Information (NPI).

Data we collect directly (name, email, phone, company name) through marketing forms and website interactions is not collected in connection with a financial transaction and is not classified as NPI.

LOS integration data: When clients integrate their Loan Origination System with our platform, loan-level data (which may constitute NPI) selected and approved by the client flows into their individual, isolated subaccount. This data is protected by encryption in transit and at rest, role-based access controls, tenant isolation, and is never shared with third parties or used for any purpose beyond delivering CRM services to that client.

Empower LO does not collect, store, or process Social Security numbers, financial account numbers, credit card data, credit reports, or credit scores.

10. AI & Automated Processing

Our platform may use AI-powered tools for communication assistance, workflow automation, and content generation. These tools:

• Do not make autonomous decisions about your account, data access, or service eligibility
• Do not use your data to train AI models
• Are used solely to enhance platform functionality and user experience

You retain full control over all automated workflows and communications configured within your account.

11. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Opt out of marketing communications
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at support@empowerlo.com. We will respond within 30 days.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the sale or sharing of your personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To submit a request, contact us at support@empowerlo.com. We will verify your identity and respond within 45 days as required by law.

13. Breach Notification

In the event of a confirmed data breach that affects your personal information, Empower LO will notify impacted parties within 72 hours of confirmation. We will coordinate with our platform provider and communicate transparently about the nature of the breach, the data involved, and the steps being taken to address it.

14. Data Processing Agreement

Empower LO offers a Data Processing Agreement (DPA) for customers who require one. Our DPA covers data processing scope and purpose, data ownership, breach notification obligations, data deletion procedures, and subprocessor management. To request a copy, contact us at support@empowerlo.com.

15. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will promptly delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or how we handle your data, reach out: