Privacy Policy (California)
Vellum Mortgage’s Privacy Policy is subject to change. Last updated on: On January 26th, 2026
Vellum Mortgage | NMLS ID#: 1657323
PRIVACY POLICY FOR CALIFORNIA RESIDENTS
This California Privacy Policy describes how Vellum Mortgage, Inc. (“we,” “our,” or “us”), collects, uses, discloses, and retains personal information of California residents, in compliance with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and implementing regulations issued by the California Privacy Protection Agency (the “CCPA Regulations”).
Scope of this Policy
This Policy applies only to California residents’ personal information that is subject to the CCPA/CPRA. Certain personal information we collect and process in connection with providing mortgage loans and related financial services is subject to the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations. Such information is exempt from the CCPA/CPRA. This Policy therefore applies to other personal information we collect, including from job applicants, employees, contractors, vendors, website visitors, and marketing leads.
Categories of Personal Information We Collect:
| Category | Examples | Business or Commercial Purpose | Retention Period | Sold/Shared? |
|---|---|---|---|---|
| Identifiers | Name, alias, postal address, email address, IP address, account name | Customer communications, lead management, accounting servicing | Up to 3 years (marketing); longer if legally required | May be shared with analytics/advertising partners |
| Customer Records Information (per Cal. Civ. Code § 1798.80) | Name, signature, Social Security number (outside GLBA loan use), driver’s license number, financial information | Employment, compliance, fraud prevention | As required by law (typically 7 years) | Not sold / limited shared |
| Protected Classification Characteristics | Age, gender, marital status, veteran status | Employment, compliance with equal opportunity laws | As required by law | Not sold/shared |
| Commercial information | Records of products or services considered or obtained | Marketing, service improvement | Up to 3 years | N/A |
| Biometric information | Fingerprints, voiceprints, facial recognition data | Not collected | N/A | N/A |
| Internet or other network activity | Browsing history, search history, interactions with our website | Analytics, marketing, website optimization | Up to 18 months | May be shared with analytics/advertising partners |
| Geolocation data | Approximate or precise location (if enabled) | Fraud prevention, website tools (branch locator), marketing | Up to 18 months | May be shared |
| Audio Electronic, Visual or Similar information | Voicemail recordings, call recordings | Customer service, compliance | As required by law (typically 5-7 years) | Not sold/shared |
| Professional or Employment-Related Information | Job application data, resumes, HR records | Recruiting, employment management | As required by law (typically 7 years | Not sold/shared |
| Education Information (non-public, FERPA) | Education records such as grades, transcripts | Not collected | N/A | N/A |
| Inferences | Profiles reflecting preferences, characteristics, predispositions | Marketing, service tailoring | Up to 3 years | May be shared |
| Sensitive Personal Information¹ | SSN (outside GLBA), precise geolocation, demographic data, account log-in with password | Employment, fraud prevention, compliance, account security | Varies; retained as required by law | Not sold/ limited shared |
¹ Some sensitive information we collect, such as social security numbers and financial account data used for mortgage services, is regulated under the Gramm-Leach-Bliley Act and not subject to the CCPA/CPRA. Other sensitive data we collect outside of GLBA, such as employee or website information (geolocation or login credentials), is treated as Sensitive Personal Information under the CCPA/CPRA and used only for necessary business purposes.
Your privacy rights
California residents have the following rights under the CCPA/CPRA:
- Right to Know: Request information about the categories and specific pieces of personal information we collect.
- Right to Delete: Request deletion of personal information, subject to exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: Opt out of the sale or sharing of personal information.
- Right to Limit Use of Sensitive Personal Information.
- Right to Non-Discrimination for exercising privacy rights.
To exercise these rights, you may call us at 571-830-2800, email us at hello@vellummortgage.com or submit a request through our website.
Automated Decision Making
If we use automated decision-making technologies, we will provide notice to consumers and offer the ability to opt out where required by law.
We use automated systems such as Desktop Underwriter® and Loan Product Advisor®, which are proprietary underwriting platforms owned and operated by the government-sponsored enterprises (GSEs) Fannie Mae and Freddie Mac. These systems assist in evaluating mortgage applications and credit risk by applying standardized criteria established under federal lending guidelines.
The information processed through these systems is collected, used, and disclosed pursuant to federal financial laws, including the Gramm-Leach-Bliley Act. As such, the personal information used within these automated underwriting processes is exempt from the California Consumer Privacy Act (CCPA/CPRA).
Global Privacy control (GPC)
Our website recognizes and honors Global Privacy Control (GPC) signals as an opt-out preference signal.
Global Privacy control (GPC)
Our website recognizes and honors Global Privacy Control (GPC) signals as an opt-out preference signal.
Children’s Data
We do not knowingly sell or share the personal information of children under the age of 16.
Contact Us
If you have questions about this Privacy Policy or your rights, please contact us at: compliance@vellummortgage.com
