This Privacy Policy describes how Metuka, Inc. (“Metuka,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our website at metuka.ai, our web dashboard, and our AI assistant service (together, the “Service”). Metuka is software. We provide an AI assistant, Metuka, to independent mortgage brokers and licensed loan officers (our “Customers”). Metuka performs administrative work under the supervision of licensed humans. Metuka, Inc. is not a lender, mortgage broker, mortgage banker, or loan officer, is not licensed under the SAFE Act, and performs no licensed mortgage activities. Please read this Policy together with our Terms of Service, our SMS and Messaging Terms, our Consent to Electronic Communications, and our Licensing and Disclosures page.
1. Overview and Scope
This Policy applies to personal information we process when you visit our website, request a demo, communicate with us, or use the Service as a Customer, and to personal information about consumers that our Customers submit to or process through the Service. It does not apply to the independent practices of our Customers, who are separate businesses with their own privacy notices and legal obligations.
If you are a borrower, a real estate agent, or another participant in a loan transaction, you are a client of your mortgage professional (the Metuka Customer handling your transaction, your “Mortgage Professional”), not of Metuka. Your Mortgage Professional decides what information is collected about you, why it is collected, and who receives it. Metuka processes that information only on your Mortgage Professional’s behalf and under their instructions. For questions or requests about your loan information, please contact your Mortgage Professional directly. We explain this division of responsibility in Section 2.
2. Our Two Privacy Roles
We handle personal information in two distinct capacities, and your rights and our obligations differ depending on which capacity applies.
a. Metuka as the business (controller)
We act as the business, sometimes called the controller, for personal information about website visitors, prospective customers, and Customer personnel who hold accounts on our dashboard. In this capacity we decide how and why the information is used, and this Policy governs that processing in full, including the privacy rights described in Section 10.
b. Metuka as a service provider (processor)
We act as a service provider, sometimes called a processor, for the loan file data, documents, and communications that Customers submit to or connect with the Service, including personal information about borrowers, co-borrowers, real estate agents, and other transaction participants (“Consumer Data”). Our Customers are financial institutions under the Gramm-Leach-Bliley Act (“GLBA”), and Consumer Data that constitutes nonpublic personal information is governed by GLBA and by our contracts with Customers, as described in Section 7. In this capacity we process Consumer Data solely to provide the Service to the Customer and for the limited purposes GLBA permits, such as legal compliance, fraud prevention, security, and the establishment or defense of legal claims. We do not use Consumer Data for our own marketing or any other independent purpose.
Because we act only on our Customers’ instructions with respect to Consumer Data, we cannot independently grant access, deletion, or correction requests concerning it. If you submit such a request to us, we will refer you to the relevant Mortgage Professional and, where our contract requires, assist them in responding.
3. Information We Collect
The categories of personal information we collect, with examples and the capacity in which we collect them, are summarized below.
| Category | Examples | Capacity |
|---|---|---|
| Identifiers | Name, email address, phone number, mailing address, NMLS identifier, account credentials | Business (Customers, visitors); service provider (consumers) |
| Government identifiers | Social Security numbers and government-issued identification documents contained in loan files | Service provider only |
| Financial information | Income, employment, asset, and liability information; paystubs, W-2s, bank statements, and tax returns; loan terms, status, and underwriting conditions | Service provider only |
| Commercial and account information | Subscription details, billing records, dashboard activity, approval actions, and configuration settings | Business |
| Internet and network activity | IP address, device and browser information, pages viewed, log data, and cookie identifiers | Business |
| Communications content | Email, text, and chat messages sent or received through the Service; delivery metadata; consent and opt-out records | Business (Customer communications); service provider (consumer communications) |
a. Information you provide to us
When you request a demo, create an account, or communicate with us, we collect the information you choose to provide: your name, business contact details, professional license identifiers such as an NMLS ID, billing information, the phone number you enroll for the Service, and the content of your communications with us. Customers may also provide writing samples so that the Service can draft messages in their professional voice.
b. Information collected automatically
When you use the website or dashboard, we automatically collect usage and device data such as IP address, browser type, operating system, pages visited, and the actions you take in the dashboard, including approval decisions, which we record as part of the audit trail. We collect some of this data through cookies, as described in Section 12.
c. Consumer Data received from Customers
In our service provider capacity, we receive Consumer Data from our Customers, from systems the Customer connects to the Service, and from consumers themselves when they reply to messages or upload documents in the course of a transaction the Customer is handling. Consumer Data may include identifiers, contact information, government identifiers, financial and employment information, loan documents, message content and delivery metadata, and records of messaging consent and opt-outs.
4. How We Use Information
In our capacity as a business, we use personal information to:
- Provide, operate, maintain, and secure the Service, including authenticating users, administering accounts, and processing payments;
- Operate the compliance controls built into the Service, including automated pre-send compliance checks on outbound messages, consent and opt-out management, quiet hours enforcement (no texts before 8 a.m. or after 9 p.m. in the recipient’s local time), and audit logging;
- Communicate with Customers and prospects about the Service, including support, service announcements, and, with any required consent, marketing of our own products;
- Improve the Service, including analytics and developing new features, using only aggregated or de-identified information for those purposes and always subject to the model training commitment in Section 5; where debugging or support requires access to Consumer Data, that access occurs solely in our service provider capacity under the relevant Customer contract;
- Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service; and
- Comply with legal obligations and enforce or defend legal claims.
In our capacity as a service provider, we use Consumer Data solely to provide the Service to the relevant Customer under our contract with that Customer: reading and verifying loan documents, tracking underwriting conditions, drafting and delivering communications the Customer directs, answering questions in chat, maintaining consent and audit records, and related support and security functions. We do not use Consumer Data for our own marketing, and we do not sell it.
5. Artificial Intelligence and Model Training
The Service uses artificial intelligence to read documents, draft communications, and answer questions. Metuka is openly disclosed as an AI assistant and never pretends to be a human. Messages the Service drafts in a Customer’s professional voice are prepared for, and sent on behalf of, that licensed professional, who supervises those messages and remains responsible for them; when Metuka communicates in its own persona, it is identified as an AI assistant. Licensed acts, including pricing or locking rates, approving or denying an applicant, and issuing legal disclosures, are performed only by a licensed human professional; the Service is designed to stop and wait for that human at each of those moments.
We do not train or fine-tune foundation models, and we do not use consumers’ nonpublic personal information to train AI models. Documents and messages processed by the Service are used to perform the requested work for the Customer, not to build or improve underlying AI models.
6. How We Disclose Information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising. We have not done either in the preceding twelve months. We disclose personal information only as described below, and we require service providers that receive personal information to be bound by contracts limiting their use of it to providing services to us.
- Service providers. Vendors that perform services on our behalf, such as payment processing, analytics, customer support, and communications delivery, under contracts that limit their use of personal information to providing those services to us.
- Cloud infrastructure providers. We host the Service on enterprise cloud infrastructure that provides computing, storage, database, document processing, and AI model hosting services. Loan documents and data are processed within this environment under the security controls described in Section 8.
- Communications infrastructure providers and carriers. Email and text messages (which may be delivered over SMS, RCS, or iMessage) are transmitted through third-party communications infrastructure providers and telecommunications carriers. These providers process message content, phone numbers, and delivery metadata as needed to deliver messages, and may retain them transiently for that purpose. Messages sent over certain channels also transit the infrastructure of device and messaging platform providers. Our SMS and Messaging Terms describe our messaging program, including consent, STOP and HELP keywords, and quiet hours.
- Parties to the transaction, at the Customer’s direction. Acting as a service provider, we transmit loan information to the recipients our Customer designates, such as borrowers, real estate agents, and wholesale lenders, in the course of processing a loan file.
- Professional advisors. Lawyers, accountants, auditors, and insurers, under duties of confidentiality, where reasonably necessary.
- Legal and safety. Courts, regulators, law enforcement, and other parties where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, safety, or property of Metuka, our Customers, consumers, or the public. Where our contracts and the law allow, we will notify the affected Customer before disclosing Consumer Data in response to legal process.
- Corporate transactions. A counterparty and its advisors in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations and to this Policy or a successor policy that is at least as protective with respect to previously collected information.
7. The Gramm-Leach-Bliley Act
Our Customers are financial institutions under GLBA, and the consumer loan data we process for them is nonpublic personal information protected by GLBA and its implementing rules. Metuka receives that information as a nonaffiliated third party performing services on the financial institution’s behalf under the service provider exception of GLBA. Consistent with that role:
- We use and disclose nonpublic personal information only to provide the services described in our contract with the Customer, to the extent permitted by GLBA, and not for any independent purpose;
- We do not sell it, use it for marketing, or disclose it except as the Customer directs, as GLBA permits, or as the law requires; and
- We maintain the administrative, technical, and physical safeguards described in Section 8.
This Policy is not a GLBA privacy notice. Your Mortgage Professional is responsible for delivering their own GLBA privacy notice to you, which describes their information practices and any opt-out rights you may have with respect to them.
8. Security
We maintain a security program designed to protect personal information against unauthorized access, use, alteration, and destruction. Our safeguards include:
- Encryption of personal information in transit and at rest;
- Field-level encryption for the most sensitive data elements, including Social Security numbers and financial account numbers;
- Access controls that limit access to personal information to personnel and systems that need it to perform their functions;
- Engineering practices designed to keep personal information out of application logs; and
- Hosting on enterprise cloud infrastructure.
No security program can eliminate all risk, and no method of transmission or storage is completely secure, so we cannot promise that personal information will never be accessed or disclosed without authorization. If we become aware of a security incident affecting personal information we process, we will investigate, take steps to contain and remediate it, and notify affected Customers without undue delay so they can meet their own notification obligations. We will notify individuals and regulators directly where we have an independent legal obligation to do so.
9. Data Retention
In our business capacity, we retain personal information for as long as needed for the purposes described in this Policy: generally, for the duration of the relevant account or relationship, plus any additional period needed to comply with legal, tax, accounting, or audit obligations, resolve disputes, enforce agreements, and maintain security records. When information is no longer needed, we delete it or de-identify it. Where we rely on de-identified information, we maintain and use it only in de-identified form and do not attempt to re-identify it, except as permitted by law to test our de-identification processes.
In our service provider capacity, we retain Consumer Data as our contract with the Customer provides and as the Customer instructs. Mortgage records, including communications with borrowers, are subject to regulatory retention requirements that apply to our Customers, and the Service maintains message archives, consent and opt-out records, and audit trails to help Customers satisfy those requirements. Upon termination of a Customer relationship, we return or delete Consumer Data as the contract provides, except where the law requires retention or where retention is reasonably needed for legal compliance, dispute resolution, backup integrity, or security, in which case this Policy and the safeguards described in Section 8 continue to apply to the retained information.
10. Your Privacy Rights
A number of U.S. states have comprehensive privacy laws that grant residents rights over personal information. Whether or not a particular law applies to Metuka at a given time, we extend the following rights to all individuals whose personal information we hold in our capacity as a business:
- Right to know and access. You may request confirmation of whether we process your personal information and a copy of the categories and specific pieces of it, including the categories of sources, purposes, and recipients.
- Right to correct. You may request that we correct inaccurate personal information.
- Right to delete. You may request that we delete personal information, subject to exceptions permitted by law (for example, records we must keep for legal compliance or security).
- Right to portability. You may request a copy of personal information you provided to us in a portable and readily usable format.
- Right to opt out of sale, sharing, and targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising, so there is nothing to opt out of. If that ever changes, we will update this Policy and provide the required opt-out mechanisms first.
- Right to non-discrimination. We will not deny you service, charge you a different price, or provide a different level of quality because you exercised a privacy right.
The only sensitive personal information we collect in our business capacity is account log-in credentials, which we use solely to provide and secure the Service, purposes for which applicable law does not require a right to limit. We do not use or disclose sensitive personal information to infer characteristics about any person. We also do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects: licensed humans and wholesale lenders make all credit decisions, as described in Section 5.
a. How to exercise your rights
You may exercise these rights by emailing privacy@metuka.ai or, if you are a Customer, through the account dashboard. We will acknowledge your request within 10 business days and respond within 45 days, which we may extend once by an additional 45 days with notice to you where reasonably necessary, or within any shorter period applicable law requires. We do not charge a fee to process a rights request unless the law permits one for requests that are excessive or manifestly unfounded.
b. Verification and authorized agents
Before acting on a request, we will verify your identity by matching the information you provide against information we already hold, or, for account holders, by requiring you to submit the request from your authenticated account. You may use an authorized agent to submit a request on your behalf; we will require proof of the agent’s written authorization and may still verify your identity directly.
c. Appeals
If we decline to act on your request, we will explain why and how to appeal. You may appeal by replying to our decision or by emailing privacy@metuka.aiwith “Appeal” in the subject line. We will decide appeals within 45 days, or within any shorter period applicable law requires. If your appeal is denied, you may contact your state attorney general.
d. Loan data is generally exempt from state privacy laws under GLBA
State privacy laws generally exempt nonpublic personal information collected and processed under GLBA. Consumer Data that we process as a service provider to your Mortgage Professional falls within that exemption and within our processor role, so the rights above do not apply to it through Metuka. Please direct requests about your loan information to your Mortgage Professional, who is responsible for responding under the laws that apply to them. Where our contract requires, we will assist the Mortgage Professional in honoring your request.
11. Global Privacy Control
Because we do not sell personal information or share it for cross-context behavioral advertising, a Global Privacy Control (GPC) browser signal requires no action from us today: there is no sale or sharing to opt out of. If our practices ever change, we will honor GPC signals as valid opt-out requests before making any such change, so browsers sending a GPC signal will be opted out automatically.
12. Cookies and Analytics
We use two categories of cookies and similar technologies:
- Essential cookies, which are required to operate the Service: signing you in, keeping your session secure, remembering your preferences, and protecting against fraud. Blocking these may prevent parts of the Service from working.
- Analytics cookies, which help us understand how the website and dashboard are used in aggregate so we can improve them. Our analytics are designed not to collect loan file data or other sensitive personal information, and our analytics providers are service providers bound by the contractual restrictions described in Section 6.
We do not use advertising or social media tracking cookies. You can control cookies through your browser settings, including blocking or deleting them; most browsers also let you clear cookies when you close them.
13. Children
The Service is a business tool for licensed professionals and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18 in our business capacity. If you believe someone under 18 has provided personal information to us, contact privacy@metuka.ai and, after verifying the report, we will delete the information we hold in our business capacity, subject to legal retention requirements. Information about a minor contained in a loan file (for example, a dependent listed on a tax return) should be raised with the responsible Mortgage Professional.
14. United States Only
The Service is offered only in the United States and is designed for U.S. residential mortgage workflows. Personal information we process is stored in the United States. Message delivery by third-party carriers and messaging platforms may transit infrastructure in other jurisdictions. If you access the website from outside the United States, you do so on your own initiative, and your information will be transferred to and processed in the United States, where privacy laws may differ from those of your jurisdiction.
15. Changes to this Policy
We may update this Policy from time to time. When we do, we will post the updated Policy at this page and revise the effective date above. If a change materially reduces your rights or materially changes how we handle personal information we have already collected, we will provide advance notice to Customers by email or through the dashboard before the change takes effect, and we will obtain any consent applicable law requires before applying the change to previously collected information. Your continued use of the Service after the effective date of an updated Policy means the updated Policy applies.
16. Contact Us
Questions, concerns, and rights requests about privacy should go to privacy@metuka.ai. Legal notices should go to legal@metuka.ai, and product support requests to support@metuka.ai. Customers may also submit rights requests through the account dashboard. If you have a disability and need this Policy in an alternative format, contact privacy@metuka.ai and we will provide it.
Related documents: Terms of Service, SMS and Messaging Terms, Consent to Electronic Communications, and Licensing and Disclosures. Licensed mortgage services are provided by licensed professionals; see NMLS Consumer Access. Equal Housing Opportunity.