MyLola
Privacy

What we collect, how we use it, and who else sees it.

Short version: we collect what we need to run the product, we share it with the cloud + AI providers we depend on, and we never sell or train models on your data.

1. Who we are

MyLola is a customer relationship management product for mortgage loan officers, operated by Mortgage Dude Holdings, LLC, a Texas limited liability company. References to "MyLola," "we," "our," or "us" mean Mortgage Dude Holdings, LLC.

2. What we collect

The data MyLola collects falls into three buckets:

From you, the user (the loan officer):

  • Name, email address, profile photo (from your Google account at sign-in).
  • NMLS number, license states, company affiliation (provided by you in Settings).
  • Configuration: workflow preferences, pipeline stages, email templates, notification settings.

From the systems you connect:

  • Gmail: messages relevant to households we identify (full headers, body, attachments).
  • Google Calendar: events on your primary calendar (for scheduling features).
  • Google Drive: files you select to attach to a household.
  • Arive (your LOS): loan records, borrower contact info, loan-level business contacts, stage history.

Automatically, as you use the product:

  • Activity logs (which records you opened, when you sent which email, which workflow ran).
  • Basic device + browser info for security and debugging.
  • Error reports if the product crashes or a sync fails.

We do not collect data from sources you haven't connected. We do not buy contact data from third parties.

3. How we use it

We use your data to:

  • Run the product features you turned on (Gmail auto-attach, Arive sync, Lola drafts, mail merge, scheduled send, workflows).
  • Authenticate you and your team members and gate access to your records.
  • Debug crashes and fix bugs (logs are retained 30 days then auto-deleted).
  • Send transactional emails about your account (security alerts, billing, scheduled maintenance).
  • Improve the product. Aggregate, de-identified usage statistics may inform what we build next. Individual borrower data is never used to inform product decisions.

We do not:

  • Sell your data, ever.
  • Train AI models on your data. The only AI calls we make are real-time drafts via Anthropic's commercial API, which contractually prohibits training on submitted data.
  • Run advertising. There are no ad pixels, no Facebook Pixel, no Google Analytics retargeting tags on the authenticated product.

4. Who we share it with

We share data only with these processors, only as needed to run the product:

  • Google Cloud / Firebase (United States). Hosts our database, file storage, authentication, and serverless functions. Google does not access your data except as instructed by us.
  • Anthropic (United States). Receives email content + relevant household context only at the moment you click "Draft with Lola" or run a workflow that drafts a message. Anthropic's commercial API does not retain prompt or response data beyond a short operational window, and contractually does not train on it.
  • Google Workspace APIs (Gmail, Calendar, Drive). We call these on your behalf to read or write the data you authorized.
  • Stripe (United States) for billing. Stripe receives the billing email + payment instrument data you provide on checkout. We do not store card numbers.
  • Arive (United States) for loan data sync. We exchange data with Arive over their API using credentials you provided.

We share data with law enforcement only when legally compelled (subpoena, court order) and will notify you unless the order prohibits notification.

We do not share data with any other third parties without your explicit consent.

5. How long we keep it

  • While your account is active: data is retained as long as it's in use.
  • After you cancel: data is retained for 90 days (so you can re-activate without losing your book), then permanently deleted.
  • On request: you can request immediate deletion at any time. We complete deletion within 30 days.
  • Backups: encrypted backups are retained for 30 days and then cycled out.
  • Crash + error logs: 30 days, auto-deleted.
  • Activity logs: 24 months, used for audit and security.

6. Your rights

You can, at any time:

  • Access your data: export it as JSON or CSV from Settings.
  • Correct your data: edit it in the product or email us.
  • Delete your data: cancel your account, or email us to request deletion.
  • Disconnect a connected service (Google, Arive) from Settings. Disconnecting stops new data ingestion and revokes the token.
  • Opt out of marketing emails. Transactional emails about your account are not opt-out-able for as long as you have an active account.

California, Virginia, Colorado, Connecticut, and Utah residents have additional rights under their state privacy laws. To exercise those rights, email privacy@mylola.ai.

7. International users

MyLola is hosted in the United States and is intended for use by mortgage professionals licensed in the United States. If you access the product from outside the U.S., your data will be transferred to and processed in the U.S.

8. Children

MyLola is a B2B product for licensed mortgage professionals. It is not designed for or directed to anyone under 18, and we do not knowingly collect data from anyone under 18.

9. Changes to this policy

If we make material changes to this policy, we will notify active users by email at least 30 days before the changes take effect. The "last updated" date below tracks the most recent revision.

10. Contact

Privacy questions, deletion requests, security concerns: privacy@mylola.ai.

Mortgage Dude Holdings, LLC
Austin, Texas, United States

Last updated: May 13, 2026