Privacy Policy — Business Loans for America

1. Who we are

Business Loans for America is operated by Ellipsis Capital LLC (“Ellipsis Capital LLC”, “we”, “us”). We are a financing marketplace and brokerage. We are not a lender. We do not make credit decisions and we do not originate financing.

2. Information we collect

Information you give us

Business details — legal and trading name, industry, state, time in business, monthly and annual revenue, and amount requested; how quickly you need the funds and what they are for; and, later in the application, how the business is organized (for example, LLC or corporation), the state it is registered in, the month and year it started, its legal address and its EIN.
Financial background — whether you have recent business bank statements, whether the business has open loans or advances and how many, your credit score range as you describe it, and whether you have ever defaulted on a business loan.
Military service — on applications made through a page we no longer use, whether you served in the military and, if so, the branch.
Contact details — first and last name, email address and mobile telephone number.
Identity and ownership details — asked after your phone number is verified, if your application meets our minimum criteria: your date of birth, Social Security number, home address, whether you own your home and, if you do, roughly how much equity you have in it, your share of the business and whether you are authorized to sign for it.
Documents — your business bank statements, which you upload or, where offered, we retrieve from your bank through Plaid (see below). After you sign, you may also choose to upload photos of the front and back of your driver’s license, a voided check (which shows your bank account and routing numbers) and your IRS EIN letter.
Your signature — when you sign your application: the full name you type, the signature you draw, the date and time, the IP address and browser you signed from, the versions of the consents you agreed to, and a fixed copy of the application as you signed it. We use these to produce your signed application and to show that you signed it.
Anything else you send us — including documents you provide to support an application.

Incomplete applications

We save your answers as you go, not only when you submit. Once you have typed your first name and a valid email address on the contact step, we keep what you have entered, even if you do not finish. We add your mobile number once you ask us to text you a code. We do not send incomplete applications to funding partners today. We may offer them to funding partners in the future, so they can contact you about financing.

Repeat applications

If you apply again within our duplicate window (currently 30 days), we do not create a new application. We keep a record of the repeat attempt, with your name, email address, phone number and business name, alongside your first application.

Information collected automatically

Device and connection data — IP address, browser type, device type and operating system.
Referral data — the website or service that referred you and the search or query string you arrived with, including advertising details such as the campaign, ad set and ad that brought you and Meta’s click identifier. We record this to understand which channels bring us applicants. Some funding partners receive these details with your application.
Session activity — pages viewed and interactions, including session recordings and heatmaps captured by Microsoft Clarity, and which screens of the application you reach. We link these to your application with a random session number.
Consent records — from the moment our application page opens, ActiveProspect’s TrustedForm service records your visit, whether or not you finish: the text and disclosures shown to you, what you type and select on the form, including each key you press, and your agreement to be contacted. When the form is submitted, ActiveProspect keeps that record for five years as proof of that consent; it keeps other recordings for a shorter time, as its TrustedForm Privacy Notice explains. We keep a link to the record. On our current application page, some later answers are kept out of that recording: your date of birth, home address, Social Security number, EIN, the business’s legal details and legal address, your ownership share and the name you type to sign. The business’s legal name still appears in the authorization text it records. On the page we used before October 7, 2026, the home address and EIN you typed were recorded.
Advertising identifiers — cookies and click identifiers set by Meta (Facebook) advertising tools, used to measure and target our advertising. For applications that meet our criteria for reporting, our server also sends Meta your email address, phone number, first and last name, state and country, and a coded reference number for your application, in hashed form (coded so Meta can match them to its users without receiving them as plain text), along with your IP address, browser details, Meta’s cookie and click identifiers and the address of the page you applied on.

Information we verify

We verify your mobile telephone number by sending a one-time code via SMS through Twilio. Your number and the verification result are processed for that purpose. See our SMS Terms.

Information from your bank, through Plaid

We may offer you the choice to connect your bank account instead of uploading statements. It is optional, and you can still upload them. Connecting uses Plaid Inc. You pick your bank and sign in inside Plaid’s window. Your bank sign-in details go to Plaid and your bank; we never receive them. We give Plaid your mobile number, so Plaid can recognize you if you have used Plaid before, and a reference number for your application. Plaid then gives us the statements your bank issued for the checking or savings account you choose (if your choice does not reach us, the bank’s first checking account, or else its first savings account), for about the last three months, along with the bank’s name, the account’s name and the last few digits of its number. Once your statements are retrieved, we end the connection, so we keep no continuing access to your account. We do not sell information we receive through Plaid, and statements retrieved through Plaid are not sent to funding partners. Plaid handles your information under the Plaid End User Privacy Policy.

Address suggestions

When you type a street address, we may suggest matching addresses using Google’s address service. Our server sends Google what you type, and if you pick a suggestion, we fill in the address Google returns. Google’s handling of what it receives is described in the Google Privacy Policy.

3. How we use information

To match your application to funding partners and to send it to them.
To decide automatically whether your application meets our minimum criteria (see below).
To let funding partners verify your identity and review your application. That is why we ask for your date of birth, Social Security number and documents.
To prepare your application for your signature and keep a record that you signed it.
To rank applications for our own review, using a score worked out from your answers. We do not send the score to funding partners.
To alert our team to new applications and to problems with them.
To verify that a real person controls the telephone number provided.
To document your consent to be contacted about your application.
To communicate with you about your application.
To detect, prevent and investigate fraud, abuse and duplicate submissions.
To measure and improve the website and our advertising.
To comply with legal obligations and enforce our terms.

How we decide whether to send your application

As soon as you verify your phone number, our system checks your answers automatically, with no person involved. It looks at the business’s monthly revenue, the amount requested, how long the business has operated, whether it is in the United States and whether you have defaulted on a business loan. If your answers do not meet our minimum criteria, your application is not sent to funding partners automatically. We can also limit, for each funding partner, the kinds of applications it is offered, for example by state, industry, revenue or credit score range, and our system offers each application to partners in turn, following those limits. This check is not a credit decision. Only lenders decide whether to offer you financing. If your application was not sent to funding partners and you think we misread your answers, email us at support@businessloansforamerica.com and a person will review them.

4. Who we share information with

This is the disclosure that matters most, so it is stated plainly. When you verify your phone number and your application meets our minimum criteria, we send it automatically to one or more lenders, funders and the funding brokers who work with them (together, our “funding partners”). Funding partners pay us for the applications they receive, and the same application may go to more than one of them. Those partners are independent businesses. Once they receive your information they handle it under their own privacy policies, which we do not control. They may contact you directly, and a funding broker may pass your application to the lenders it works with.

What funding partners receive

When you verify your phone number: your name, email address, mobile number and business name, and your answers about the business and its finances, such as revenue, amount requested, industry, state, time in business, whether you have bank statements, open loans and credit score range. It may also include whether your application met our criteria, and details of the ad or link that brought you to us.
A link to your application file. The link has no password and does not expire: anyone who has it can open your file, download your documents and see your full Social Security number. We send it with your application, in our emails to funding partners (including anyone a partner asks us to copy), in spreadsheets we share with some partners, and inside your signed application, where each document is listed with its own link. Our team receives it in internal alerts and in our own records. So anyone a partner passes the link or your signed application to, including the lenders a broker works with, can open your file. If you opt out of the sale of your information or ask us to delete it, we switch the link off so it no longer opens your file. Copies a partner has already downloaded stay with that partner.
What the file shows. It is read live, so it shows each detail as soon as you add it, including before you sign: your date of birth, home address, homeownership and home equity, EIN, the business’s legal details and address, your share of the business and authority to sign, what the funds are for, and your bank statements. Documents you add after signing, such as your driver’s license and a voided check, appear there too. It shows your full Social Security number behind a button. Once you sign, it lets anyone with the link download your signed application, which includes your full Social Security number, your answer about past loan defaults and the IP address and device you signed from.
By email, when you submit your bank statements: your date of birth, home address, EIN and business details, with your Social Security number shown only as its last four digits, and the link.

Credit reports. We do not obtain credit reports about you. When you sign your application, you authorize the companies that receive it to get credit reports on you and your business and to check your information with banks, credit bureaus and other sources.

Sent by hand. We may also choose a funding partner by hand and send it your application, for example to send it to an additional partner, or to send an application that did not meet our automatic criteria.

Applications that do not meet our criteria

If your answers do not meet our minimum criteria, we do not send your application to funding partners automatically, and we do not report it to Meta as a lead. We keep it, as Section 6 describes. We may show you a link to another financing company’s website. The link carries our referral code but none of your information. If you apply there, that company’s privacy policy applies.

Other recipients

We also share information with:

Service providers who operate the service on our behalf, including Vercel (hosting, and storage for the documents you upload), Neon (database), Inngest (background processing, such as sending your application to funding partners), Twilio (SMS verification), Resend (email to funding partners), Google (spreadsheets in which some partners receive applications, and address suggestions as you type an address), Slack (internal alerts to our team about applications) and ActiveProspect’s TrustedForm (consent records).
Plaid, if you connect your bank. Plaid handles your information under its own End User Privacy Policy (see Section 2).
Advertising and analytics partners: Meta, to measure and target our advertising, and Microsoft, through Clarity, which records how you use our pages and which Microsoft also uses for its own purposes, including advertising (see Section 5).
Professional advisers, acquirers and authorities where required by law, in connection with a corporate transaction, or to protect our rights.

We share personal information with funding partners as described above, and we use cookies and advertising identifiers as described in Section 5. Under California and several other state privacy laws, these activities may constitute a “sale” or “sharing” of personal information. California residents may exercise the right to opt out — see “Your California Privacy Rights” below.

5. Cookies and tracking

We use cookies and similar technologies for essential site function, analytics, and measuring and targeting our advertising. Most browsers let you refuse or delete cookies; doing so may affect how parts of the site work.

On the application page, these tools load when the page opens:

Meta pixel — sets Meta’s advertising cookies and tells Meta when the page is viewed and when an application counts as a lead, and may report buttons you click. Meta and other companies may use cookies, web beacons and similar technologies to collect information from our site and elsewhere on the internet, and use it to measure our ads and to target ads, including showing our ads to people likely to apply. You can opt out of interest-based advertising at optout.aboutads.info and in your Facebook ad preferences. The pixel does not load if your browser sends a Global Privacy Control signal (Section 8).
Microsoft Clarity — records how you use the pages, such as clicks, scrolling and the screens you see, as session recordings and heatmaps. Microsoft receives this information as an independent company and also uses it for its own purposes, including Microsoft Advertising. See the Microsoft Privacy Statement. Clarity does not load if your browser sends a Global Privacy Control signal (Section 8).
TrustedForm — records your visit to the application page, from the moment it opens, as proof of your consent to be contacted (Section 2). See ActiveProspect’s TrustedForm Privacy Notice.

We do not respond to browser Do Not Track signals; we handle Global Privacy Control as Section 8 explains. Meta and Microsoft may collect information about your activity on our pages and on other websites over time.

6. Retention

We retain application records for up to thirty-six (36) months from your last interaction with us, then delete or de-identify them, except where longer retention is required for legal, tax or dispute-resolution obligations.

Application records include your answers, incomplete applications, records of repeat applications, the bank statements and other documents you upload or we retrieve, your signed application, and our records of which funding partners received your application. Where we must keep a record that an application was delivered, for our billing, we de-identify it.

Records documenting your consent to be contacted are kept for up to five (5) years, as evidence of that consent.

Consent records include your agreement to be contacted, your consent to sign electronically and the link to your TrustedForm record.
A bank connection through Plaid is kept only until your statements are retrieved. We then end the connection and delete the access key.
Records of which screens of the application a visit reached are kept for up to 36 months.
Database backups expire within 30 days. System logs expire under our hosting provider’s short retention.
Copies in our own tools. Alerts to our team in Slack, and spreadsheet copies of applications in our Google account, are kept until we remove them. We remove them when you ask us to delete your information, and in our regular retention review.
Copies held by others. Funding partners keep the copies they receive under their own policies. Meta, Microsoft and ActiveProspect keep what their tools collect under their own terms; ActiveProspect keeps submitted TrustedForm records for five years.

7. Security

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit and, through our hosting and database providers, encryption at rest. We encrypt your Social Security number again under its own key, and do the same for any bank-connection key from Plaid. Documents are kept in storage that is not public; they can be opened through our administrative portal or through your application’s link, as Section 4 explains. Our administrative portal requires a password and a one-time code. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal information, to opt out of certain sharing or targeted advertising, and to be free from discrimination for exercising those rights. Residents of California, Colorado, Connecticut, Utah, Virginia and other states with comprehensive privacy laws have specific rights.

To make a request, contact us at support@businessloansforamerica.com. Before acting on a request to know, correct or delete your information, we verify your identity by matching at least two details you give us, such as your email address and phone number, with those on your application. For a copy of specific information, such as your documents or signed application, we match at least three details and ask you to sign a statement, under penalty of perjury, that you are the applicant. For your security, we do not send your Social Security number, driver’s license number or bank account numbers in response to a request; we tell you that we hold them. We do not ask you to verify your identity to opt out.

An authorized agent can make a request for you by emailing support@businessloansforamerica.com with your signed written permission, or a power of attorney under California Probate Code §§ 4121–4130. For a request to know, correct or delete, we may also ask you to verify your identity with us directly or to confirm that you gave the agent permission. For an opt-out, your signed permission is enough.

If we decline a request, you can appeal by replying to our decision with “Appeal” in the subject line. We will answer within 45 days.

Deletion. When we delete your application, we delete its answers, documents and signature drawing with it, and switch off the link to your file. We keep the record of your consent to be contacted and to sign electronically, and a record of your request, for as long as Section 6 says, as the law allows. If we have sent your application to funding partners, we keep only what we need to record that delivery, and we tell those partners about your request. They hold their copies under their own privacy policies. If we keep anything else, we will tell you what and why.

Your California Privacy Rights

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, California residents have specific rights and we make the following additional disclosures.

Notice at collection

Categories of personal information we collect and disclose. In the last 12 months we have collected the following categories of personal information. For each, we list what it includes, why we collect it, who receives it, whether that may be a sale or sharing, and how long we keep it. It comes from you; from your browser and device, including through the Meta, Microsoft Clarity and TrustedForm tools on our pages; from the ad or link that brought you; from Google, when you pick a suggested address; and, if you connect your bank, from your bank through Plaid. “Service providers” are those named in Section 4.

Identifiers — name, home and business addresses, email address, mobile telephone number, IP address, Social Security number, driver’s license number (on a photo you upload), and online identifiers such as cookie, click and session identifiers. Why: to process and verify your application, send it to funding partners so they can identify and contact you, prevent fraud and duplicate applications, document your consent, and measure and target our advertising. Who receives it: funding partners, which may be a sale; Meta, which may be sharing (your email address, phone number, name, state and country and a coded reference number, all hashed, with your IP address and Meta’s cookie and click identifiers); Microsoft through Clarity, which may be sharing (online identifiers); and service providers. Kept: up to 36 months, or up to 5 years as part of a consent record.
Personal information described in Cal. Civ. Code § 1798.80(e) — your name, signature, Social Security number, address, telephone number, driver’s license and the details shown on it, bank account and routing numbers (on a voided check or statements), and other financial information, such as bank statements, credit score range, open loans, loan default history and home equity. Why: to decide whether your application meets our criteria, send it to funding partners so they can verify your identity and review it, and prepare your signed application. Who receives it: funding partners, which may be a sale (statements retrieved through Plaid are not sent to them); and service providers. Kept: up to 36 months. The answers you give before verifying your phone are also part of your TrustedForm consent record, which ActiveProspect keeps for up to 5 years.
Characteristics of protected classifications under California or federal law — your age, from your date of birth, and, on applications made through a page we no longer use, veteran status and branch of service. Why: so funding partners can verify your identity and confirm you are 18 or over; veteran status was asked on a page for veterans. Who receives it: funding partners, which may be a sale; and service providers. Kept: up to 36 months.
Commercial information — business name, industry, state, time in business, revenue, amount requested, what the funds are for and how quickly you need them, the business’s legal details and EIN, and whether you own your home and your home equity. Why: to decide whether your application meets our criteria, match it to and send it to funding partners, and prepare your signed application. Who receives it: funding partners, which may be a sale; and service providers. Kept: up to 36 months. The answers you give before verifying your phone are also part of your TrustedForm consent record, which ActiveProspect keeps for up to 5 years.
Professional or employment-related information — that you own or run the business, your share of it and whether you are authorized to sign for it. Why: so funding partners know who is applying and who can sign for the business. Who receives it: funding partners, which may be a sale; and service providers. Kept: up to 36 months.
Internet or other electronic network activity — pages viewed, interactions, the screens of the application you reach, session recordings, consent records, cookies and click identifiers, the ad or link that brought you, and the browser and device you signed from. Why: to run and improve the site, document your consent, prevent fraud, and measure and target our advertising. Who receives it: Meta, which may be sharing (cookie and click identifiers, browser details, the page address and what the pixel reports); Microsoft through Clarity, which may be sharing (pages viewed, interactions and session recordings); funding partners, which may be a sale (the browser, device and IP address you signed from, in your signed application, and sometimes the ad or link that brought you); ActiveProspect (TrustedForm) and other service providers. Kept: up to 36 months, or up to 5 years as part of a consent record.
Audio, electronic, visual or similar information — the signature you draw, and photos of your driver’s license and of any check or letter you upload. Why: to sign your application and to let funding partners verify your identity and bank account. Who receives it: funding partners, which may be a sale; and service providers. Kept: up to 36 months.
Inferences — whether your application meets our minimum criteria, and an internal score of how strong it looks. Why: to decide whether to send your application, and for our own review. Who receives it: whether your application met our criteria may be included in what funding partners receive, which may be a sale. We do not send the score to anyone. Kept: the result is kept with your application for up to 36 months; the score is worked out each time we view an application and is not stored.

Sensitive personal information. We collect your Social Security number and, if you upload a photo of your driver’s license, your driver’s license number. These are sensitive personal information under California law. We disclose them to the funding partners who receive your application, so they can verify your identity and review it; as described above, this may be a sale. We do not use them to infer characteristics about you. We do not receive the sign-in details for your bank account. You may ask us to limit our use and disclosure of your sensitive personal information by emailing support@businessloansforamerica.com.

Sale or sharing of personal information. Passing your application to funding partners, and our use of advertising cookies and identifiers, including through Meta and Microsoft Clarity, may constitute a “sale” or “sharing” of personal information under California law. You have the right to opt out. To opt out, use the form on our Do Not Sell or Share My Personal Information page, linked at the bottom of every page including the application, or email us at support@businessloansforamerica.com. We do not ask you to verify your identity to opt out. Tell us the name, email address and phone number you used, so we can find your record. Your opt-out takes effect within 15 business days. From then on we do not send your application to funding partners or report it to Meta, and we switch off the link to your file. We tell the funding partners and Meta about your request if they received your information after you asked. Copies partners already hold stay with them under their own policies. If you apply again after opting out, we ask whether you want your application sent to funding partners before we send it.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale and sharing for that browser and, once you give us your name, email address or phone number, for you: we record the opt-out against your application, so it also applies if you come back on another device. The Meta pixel and Microsoft Clarity do not load, we do not report your application to Meta, and the page shows that your signal was honored. Sending your application to funding partners is the service you ask for when you apply, so if you apply from that browser we ask whether you want us to send your application to funding partners, with equally easy Yes and No answers, before we send it. To send GPC, turn it on in a browser or extension that supports it (see globalprivacycontrol.org).

Your rights. You have the right to know the categories of personal information we have collected about you, where it came from, why we collect, sell or share it, the categories of third parties we disclose it to, and the specific pieces we hold; to request deletion, subject to exceptions the law allows, or correction; to receive a copy of your information in a portable form, apart from the numbers we withhold for your security; to limit the use of sensitive personal information; to opt out of its sale or sharing; and to be free from retaliation for exercising these rights. To exercise any of these rights, contact us at support@businessloansforamerica.com. We confirm requests within 10 business days and answer within 45 days; we may extend that once by 45 days and will tell you why. We verify requests to know, delete or correct as described above, and you may use an authorized agent where the law allows.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

9. Children

The service is for business owners and is not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes

We may update this policy. The date at the top of this page shows when it last changed, and material changes will be signposted on the site.

We keep each earlier version of this policy. Your signed application refers to the version in effect on the day you signed. Email us at support@businessloansforamerica.com for a copy of an earlier version.

11. Contact

Ellipsis Capital LLC — 971 US Highway 202N, Suite N, Branchburg, NJ 08876. Email: support@businessloansforamerica.com. Telephone: (732) 609-7182.