Draft — not yet legally reviewed. This is a structural starting point, not a finished privacy policy. Because SBAConnector collects Social Security numbers and personal financial data, it is a financial institution under the Gramm-Leach-Bliley Act and owes GLBA Privacy Rule and Safeguards Rule duties, plus state breach-notification and privacy obligations. Have counsel complete and approve this before launch, and replace the bracketed items below.

Privacy Policy

Last updated: [DATE] · Effective: [DATE]

1. Who we are

SBAConnector ("we," "us") is operated by [LEGAL ENTITY NAME], a [STATE] [ENTITY TYPE] located at [ADDRESS]. We are a private company. We are not affiliated with, endorsed by, or authorized by the U.S. Small Business Administration, and we are not a lender.

2. Information we collect

When you request an application link, we collect your name, email address, phone number, the loan amount you are seeking, and your stated use of funds.

When you complete an application, we additionally collect:

Identity information — Social Security number, date of birth, home address
Business information — entity name, structure, industry, location, time in business
Financial information — assets, liabilities, income, contingent liabilities, and the contents of your personal financial statement
Your electronic signature and the authorizations you grant
Technical data — IP address, timestamps, and access logs associated with your submission

3. How we use it

To assemble and review your loan application file
To generate SBA Form 413 (Personal Financial Statement) on your behalf
To identify SBA-participating lenders whose criteria your file matches
To refer your file to those lenders, only with your written authorization
To communicate with you about your application status
To meet legal, recordkeeping, and audit obligations

We do not sell your personal information. We do not rent or share it with marketers.

4. Who we share it with

SBA-participating lenders you authorize us to refer you to. We disclose the specific lenders before sharing.
Service providers that operate our infrastructure, under written confidentiality obligations. Currently: [HOSTING PROVIDER] (application hosting), Cloudflare (DNS and content delivery), Resend (transactional email).
Legal recipients where required by law, subpoena, or to protect against fraud.

TODO: GLBA requires a specific initial and annual privacy notice format, including opt-out rights for certain sharing. Confirm whether your sharing model requires an opt-out notice.

5. How we protect it

Your Social Security number, date of birth, address, financial details, and signature are encrypted with AES-256-GCM before being written to storage. The encryption key is held in the application environment, never in the database.
Every decryption of your record by staff writes an append-only audit entry recording who accessed it, what action was taken, and when.
Access to your file is limited to staff with a business need. Full Social Security numbers are masked for all but designated roles.
Traffic is served over TLS with HSTS enforced.
Account access uses one-time email sign-in links rather than stored borrower passwords.

No system is perfectly secure. We cannot guarantee absolute security, and we encourage you to protect access to your email account, since it controls access to yours.

6. How long we keep it

We retain application records for [RETENTION PERIOD] to meet lender, audit, and legal recordkeeping requirements, after which they are deleted or de-identified.

TODO: Set a defensible retention period. SBA and lender recordkeeping expectations may set a floor; state privacy laws may set practical ceilings.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. To exercise these rights, contact us at privacy@sbaconnector.com. We will verify your identity before acting on a request.

TODO: Add state-specific sections if you operate in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Texas, or other states with comprehensive privacy laws. Note that GLBA-regulated data is exempt from some, but not all, of these.

8. Credit inquiries

We do not run a hard credit inquiry to match you with lenders. If we perform a soft inquiry, it does not affect your credit score. A lender may run a hard inquiry later in underwriting, with your separate consent.

9. Children

Our services are for business owners and are not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes

We will post any changes here and update the date above. Material changes affecting how we share your information will be communicated to you directly.

11. Contact

[LEGAL ENTITY NAME]
[ADDRESS]
privacy@sbaconnector.com