Privacy Policy

RECO Capital ("we", "us") is a private lender that makes and arranges short-term bridge loans secured by real estate. This notice explains what we collect when you use our website, apply for a loan, or have a loan serviced by us, and how we protect it. It is our privacy notice under the Gramm-Leach-Bliley Act (GLBA) and applicable state law.

You give us: name, contact details, date of birth, Social Security number, government ID, income, assets, employment, business ownership, property details, and the documents you upload.

From your consent-based connections: bank account balances, transactions and account-holder details through Plaid; identity-document and selfie verification results through Plaid Identity Verification or Stripe Identity.

From third parties, with your authorization: consumer credit reports, business registration data (Middesk), background screening (Checkr), property valuation and title information.

Automatically: device, browser, IP address and security logs needed to protect your account.

• To evaluate your application, verify identity and ownership, and underwrite and service your loan.
• To prevent fraud, meet anti-money-laundering, OFAC, Know-Your-Customer and other legal obligations.
• To send statements, payment reminders, notices required by law, and respond to you.
• To operate, secure and improve the portal. We do not sell your personal information and we do not use it for third-party advertising.

• Service providers that act for us under contract: Plaid (bank connectivity and identity), Stripe (identity and payments), Middesk (business verification), Checkr (background screening), credit bureaus and their resellers, e-signature, cloud hosting, e-mail delivery and document storage.
• Loan participants — investors or affiliates who fund or purchase an interest in your loan — receive only what they need to administer it.
• Professionals and authorities: title companies, appraisers, attorneys, auditors, regulators, courts, and as otherwise required by law.
• Under GLBA, you cannot opt out of sharing that is needed to process your transaction, service your loan, or comply with law. We do not share for joint marketing.

When you link a bank account, you authorize Plaid to retrieve data from your financial institution and share it with us under the Plaid End User Privacy Policy. We use that data only for the purpose you connected it for — verifying your account, assessing cash flow and assets, and (if you enroll) collecting autopay. You can disconnect at any time from your portal or by contacting us, and we will stop retrieving new data.

We encrypt data in transit (TLS 1.2+) and at rest; sensitive identifiers such as Social Security numbers, dates of birth and addresses are additionally encrypted at the field level. Access is role-based and limited to staff who need it, every access is logged, and we require multi-factor authentication for staff. Our controls are modeled on SOC 2 and the GLBA Safeguards Rule.

Application records are kept for 25 months after a decision (longer where the law requires, e.g. ECOA/Regulation B). Loan files are kept for the life of the loan plus 7 years. Security logs are kept 1 year. Transient items such as sign-in codes and bank-connection tokens are deleted automatically within hours to days. When data is no longer needed it is securely deleted.

• Access, correct, or request deletion of your information where the law allows (we must keep records required for lending compliance).
• Disconnect bank or identity connections at any time.
• Receive a copy of any adverse-action notice and the name of any consumer reporting agency we used.
• Opt out of marketing e-mail with one click. Transactional and legally required notices will still be sent.
• To exercise a right, e-mail privacy@recocapital.com or call (800) 555-7326. We respond within 45 days.

We will post any changes here and update the effective date. Material changes will be e-mailed to active customers. Questions: privacy@recocapital.com · (800) 555-7326.