Individuals covered by this notice
SB Loan Group, LLC — referred to throughout this page as "SB Loan," "we," or "us" — collects information in the ways described below. This Privacy Policy covers data gathered through sbloan.net, any forms you complete, our email and SMS programs, and all pages or applications that link to this document. It governs every U.S. visitor to the site, along with anyone who submits details in order to be matched with a lender. SB Loan does not knowingly serve EU or UK residents, and they are not the intended audience of our services.
Privacy disclosure the GLBA mandates
The federal Gramm-Leach-Bliley Act (GLBA), together with its implementing rule known as Regulation P, governs how certain information you share with SB Loan must be handled. Because our role is connecting borrowers with financial institutions, these standards apply to your "nonpublic personal information" (NPI):
- What we collect. We receive details from your application form, information passed back to us by lenders you are matched with, and — when you authorize it — data from consumer-reporting agencies for credit-check purposes.
- Why we need it. The collection lets us identify state-licensed lenders able to offer credit suited to your circumstances.
- How we keep it safe. We rely on administrative, technical, and physical safeguards, which are outlined in the Security section.
- Your rights around affiliate sharing. Currently, SB Loan has no affiliates who market non-lending products to you. Should that change, you would receive advance notice and a GLBA-compliant opt-out opportunity before any affiliate sharing could begin.
Categories of information we gather
Information we gather falls into three distinct categories.
- Data you provide directly
- This includes your name, address, date of birth, employment and income details, contact information, and bank account information needed for funding. We also collect your Social Security Number when a lender requires it to assess eligibility, along with your military status — the latter is used solely for compliance checks under the Military Lending Act.
- Data from lenders and verification services
- Once you connect with a lender, we may receive back their approval or denial decision, the loan terms they offered, results of fraud screening, identity-verification outcomes, and confirmation of whether you qualify as a covered borrower under the Military Lending Act.
- Data collected automatically
- When you browse the site, we record device and browser identifiers, your IP address, which pages you view, the referrer URL, and an approximate location limited to city or state level. We do not capture precise geolocation coordinates.
Purposes for which your data is used
- Identify lenders licensed in your state who are eligible to serve you
- Conduct checks for identity verification, fraud prevention, and Military Lending Act covered-borrower status
- Respond to your inquiries and deliver customer support
- Deliver transactional email or SMS messages connected to your application, provided you have given the consents that law requires
- Fulfill legal obligations and address requests from regulators or law-enforcement agencies
- Enhance the website experience and, in aggregate form, spot potential security issues
Third parties who may receive data
Our practice is to share information only in limited circumstances, and solely with the following types of recipients:
- State-licensed lenders within our network that you select for matching
- Service providers whose work supports site operations — this covers hosting, fraud detection, identity verification, analytics, and email or SMS delivery. Each operates under contract with confidentiality obligations and restrictions on how data may be used
- Regulators and law enforcement when we receive lawful process or need to satisfy compliance requirements
- Successors in interest should a business transfer occur, with this Privacy Policy continuing to apply
Bar against selling or sharing across sectors
Should we ever depart from this position, we will: (a) revise this page; (b) email account-holders 30 days before the change; and (c) apply the change prospectively — meaning data you previously submitted would not be moved out of vertical.
CCPA/CPRA rights for California residents
Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents possess the following rights:
- Right to know the personal information we collected, used, disclosed, or shared during the prior 12 months
- Right to delete personal information we hold (with exceptions under GLBA and other applicable laws)
- Right to correct personal information that is inaccurate
- Right to opt out of "sale" or "sharing" of personal information (we do neither — see the prior section)
- Right to limit how we use and disclose sensitive personal information
- Right to non-discrimination for exercising any of these choices
To submit a request: email [email protected], or use the Do Not Sell or Share My Personal Information link. We confirm your identity before acting and aim to respond within 45 days.
Wider state privacy legislation effective 2026
As of 2026, a number of states have enacted comprehensive consumer-privacy laws granting residents rights such as access, correction, deletion, portability, and opt-out from targeted advertising and the "sale" of personal data. SB Loan does not engage in targeted advertising as those statutes define it, nor do we sell personal data. The states covered and their principal statutes are listed here:
- California — CCPA / CPRA (the section above details the full set of California rights)
- Colorado — Colorado Privacy Act (CPA)
- Connecticut — Connecticut Data Privacy Act (CTDPA)
- Delaware — Delaware Personal Data Privacy Act (DPDPA)
- Florida — Florida Digital Bill of Rights (FDBR)
- Indiana — Indiana Consumer Data Protection Act (INCDPA)
- Iowa — Iowa Consumer Data Protection Act (ICDPA)
- Maryland — Maryland Online Data Privacy Act (MODPA)
- Minnesota — Minnesota Consumer Data Privacy Act (MCDPA)
- Montana — Montana Consumer Data Privacy Act (MCDPA)
- Nebraska — Nebraska Data Privacy Act (NDPA)
- New Hampshire — New Hampshire Privacy Act (NHPA)
- New Jersey — New Jersey Data Privacy Act (NJDPA)
- Oregon — Oregon Consumer Privacy Act (OCPA)
- Rhode Island — Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
- Tennessee — Tennessee Information Protection Act (TIPA)
- Texas — Texas Data Privacy and Security Act (TDPSA)
- Utah — Utah Consumer Privacy Act (UCPA)
- Virginia — Virginia Consumer Data Protection Act (VCDPA)
If you reside in one of these states, you may exercise the rights available to you by following the process described next.
Send your state-law privacy request to [email protected] with the subject line formatted as "Privacy request — [your state]." We reply within the timeframe that statute demands — typically 45 days. Should we deny your request, you may appeal by replying with "Appeal" in the subject; a different person from the one who made the original determination will review it.
Honoring Global Privacy Control signals
SB Loan recognizes the Global Privacy Control (GPC) browser signal. Where your browser sends GPC, we honor it as a legitimate opt-out of "sale" or "sharing" of personal information for visitors located in California, Colorado, Connecticut, and any other state where GPC carries legal weight — even though selling and sharing are not our default practices. No separate opt-out request is necessary when GPC is active on your browser.
Duration of record preservation
- Lead and application data
- Retained for as long as needed to provide service and for the period required by GLBA, state lending and lead-generation laws, and our own books-and-records obligations — typically 7 years from the last interaction.
- Customer service correspondence
- 3 years from the last interaction.
- Marketing and analytics data
- De-identified or aggregated where possible; raw identifiers retained no longer than 24 months unless tied to an active application.
- Security and fraud logs
- Up to 5 years, in encrypted form, for incident-response and compliance purposes.
Tracking technologies and cookie usage
Cookies and comparable technologies on the site serve three functions: strictly necessary operations (login sessions, fraud prevention), functional features (remembering preferences and form state), and analytics (understanding aggregated traffic patterns). We do not deploy third-party advertising trackers. On your first visit, a cookie banner appears where required by law; after that, you may adjust your choices through the Cookie preferences link.
Safeguards protecting your information
Our protection measures include administrative, technical, and physical safeguards that meet industry standards. Specifically, we use TLS for data in transit, AES-256 encryption at rest for sensitive fields, network segmentation, need-to-know employee access controls, periodic penetration testing, and an internal incident-response framework designed around FTC Safeguards Rule expectations. No security system is completely invulnerable. Should a security incident affect your information, we will notify you as required by applicable law.
Safeguards for underage individuals
SB Loan is designed for adults in the U.S. who are age 18 or older. It is not aimed at children under 13, and we do not knowingly gather information from them. If you suspect a child has submitted information to us, please reach out to [email protected] so we can delete it without delay.
Revisions to this privacy statement
From time to time we may revise this policy. When changes are material, we will display an updated "Last updated" date and, for revisions that significantly expand how we use your data, we will provide direct advance notice — by email to account-holders, 30 days prior — before the new terms take effect.
Heightened protections for delicate personal data
Several state laws, including California's, single out certain personal information as "sensitive." For visitors to SB Loan, the sensitive categories we may process include: your Social Security Number (when a lender needs it for application processing), your government-issued ID number (for identity verification), your detailed financial-account information (to enable funding), and your military status (to comply with the Military Lending Act). We use sensitive personal information strictly for the purposes you supplied it for — not for cross-context behavioral advertising, and not for profiling that produces legal or similarly consequential effects on you. We also do not derive sensitive characteristics from how you behave on the site.
Where state law permits you to "limit" use and disclosure of sensitive personal information, you may do so by emailing [email protected] with the subject line "Limit sensitive PI." Be aware that limiting certain fields — your Social Security Number, for instance — could stop us from matching you with lenders whose underwriting requires those details.
Treatment of financial and credit particulars
When a lender in our network requests a consumer report on you for underwriting, that action falls under the federal Fair Credit Reporting Act (FCRA) and the lender's own privacy notice. SB Loan itself does not pull traditional credit reports during matching; certain lenders may instead conduct a soft inquiry, which does not impact your credit score. Under the FCRA, the lender — not SB Loan — is the "user" of any consumer report, and the lender must furnish you with the FCRA notices triggered by any adverse action.
Information we receive from consumer-reporting agencies, such as identity verification results, receives the same protective treatment as other sensitive information. We keep it only as long as necessary to support your application and to satisfy our books-and-records obligations.
Use of SMS and electronic mail
By supplying your phone number and consenting to SMS messages from SB Loan, you authorize us to send transactional communications and lender-match alerts in line with the TCPA and the specific scope of consent you provided. Standard message and data rates may apply. You can withdraw consent anytime by replying STOP to any SMS, clicking the unsubscribe link in any email, or writing to [email protected]. Agreeing to marketing messages is not required in order to receive a lender match.
We apply opt-outs consistently across channels: choosing to opt out of SMS covers the same phone number across our entire marketing program. We neither sell your phone number to outside parties nor permit our SMS delivery partners to use it for anything beyond sending messages on our behalf.
Reaching our Privacy Officer
For questions about privacy, contact our designated privacy representative — who serves as our Data Protection Officer for U.S. consumer-privacy matters — at [email protected]. You may also reach us by postal mail at: SB Loan Group, LLC, Attn: Privacy, [address placeholder]. California residents may use a verified authorized agent to make requests on their behalf; the agent must present proof of authorization, and we will still verify your identity before processing any substantive request. We do not impose a fee for your first two verifiable privacy requests within any 12-month period. If we must deny a request — for example, because the GLBA, FCRA, or another federal statute mandates retention — we will explain the reason in writing and inform you of your right to appeal.