PRIVACY POLICY

1. Information We Collect

We collect personal information from you directly, automatically through your use of our digital properties, and from authorized third parties. The categories of information we may collect include the following.

A.Personal Identifiers

• Full legal name, email address, phone number, and mailing address.
• Social Security number and date of birth.
• Government-issued identification numbers and copies of identification documents.

B. Financial Information

• Employment and income information including pay stubs, tax returns, W-2s, 1099s, and profit and loss statements.
• Bank account details, asset statements, bank statements, and investment account information.
• Credit history and credit scores obtained through consumer reporting agencies.
• Property information, appraisal data, and existing mortgage details.

C. Online and Tracking Information

• IP address, browser type, device identifiers, and operating system.
• Cookies, pixels, and similar tracking technologies (see Section 13).
• Website usage data, page interactions, form submissions, and session analytics.

D. Voice, Call, and AI Interaction Data

Where permitted by law and disclosed to you, we collect the following categories of information when you communicate with us by phone, SMS, or any AI-assisted channel:

• Audio recordings of inbound and outbound telephone calls.
• Transcripts of calls generated by automated speech-to-text systems.
• AI-generated summaries, sentiment scores, keyword tags, and conversation analytics derived from call audio and transcripts.
• Voice characteristics processed by AI for quality assurance, employee coaching, and compliance review.
• The content of SMS and text messages exchanged with us, including messages sent or received by automated systems on our behalf.
• Interactions with AI-powered chat experiences, virtual assistants, and automated outbound dialing system.

E. Other Information

• Any additional information you voluntarily provide to us through forms, surveys, applications, or communications.
• Information provided by third parties authorized by you, such as your accountant, real estate agent, or referring partner.

2. How We Use Your Information

We use your personal information for the following purposes:

• Processing loan applications and providing related financial services.
• Verifying your identity and determining eligibility for financial products.
• Responding to inquiries and providing customer support.
• Complying with legal, regulatory, recordkeeping, and contractual obligations applicable to mortgage brokers and lenders.
• Improving our services, training our staff, evaluating call quality, and refining our website functionality and user experience.
• Communicating with you via email, phone, SMS, and other channels, including communications that may be drafted, sent, or initiated by automated or AI systems on our behalf, subject to your consent.
• Detecting, preventing, and investigating fraud and unauthorized activity.
• Marketing, retargeting, and audience development, subject to your opt-out rights.

3. Use of Artificial Intelligence and Automated Systems

We use artificial intelligence (AI) and other automated systems to operate our business more efficiently and to serve you more effectively. We believe transparency about these tools is essential, and we describe their use here in plain language.

A. What Our AI Systems Do

• Record, transcribe, summarize, and analyze inbound and outbound calls for quality, coaching, and compliance purposes.
• Draft, send, and reply to SMS and text messages, including messages sent on behalf of your assigned loan officer.
• Place outbound voice calls to schedule appointments, follow up on inquiries, and provide updates on your application.
• Prioritize and route incoming leads and inquiries to the appropriate team member.
• Surface relevant borrower information to our employees during a call or interaction.
• Provide AI-assisted chat experiences on our websites.

B. What Our AI Systems Do Not Do

Final lending decisions, including approval, denial, pricing, and underwriting determinations, are made by licensed mortgage professionals. AI tools assist our employees but do not independently approve or deny a loan application or set final loan terms. Where AI is used to assist with any decision that has a material effect on you, a qualified human employee reviews the outcome before it is communicated to you.

C. AI Identification

When you interact with an AI voice agent or AI-driven SMS system operated by or on behalf of Truss Financial, that system will identify itself as automated at the start of the interaction, or in response to your direct question, consistent with applicable state and federal disclosure laws.

D. Right to Human Interaction

You may request to speak with a live employee at any time during an interaction with one of our AI systems. We will route you to a human as promptly as reasonably practicable.

E. Right to Human Review of Automated Decisions

Where an automated process is used to make or materially influence a decision concerning you, you have the right to request human review of that decision, to be informed of the key factors that influenced it, and to provide additional information for reconsideration. See Section 10 for details on how to exercise these rights, including the additional rights provided to California residents.

4. Call Recording and Monitoring

Truss Financial records and monitors inbound and outbound telephone calls for quality assurance, employee training, dispute resolution, fraud prevention, and regulatory compliance. This includes recording, transcription, and analysis by AI systems.

A. Notice and Consent

You will be notified at the beginning of a call that the call may be recorded and analyzed, including by automated and AI systems. By continuing the call after receiving that notice, you consent to the recording, transcription, storage, and AI-assisted analysis of the call. This consent applies in all jurisdictions in which we operate, including those that require all-party consent to record telephone communications (such as California, Florida, Pennsylvania, Washington, Connecticut, Maryland, and Illinois).

B. Right to Opt Out of Recording

If you do not wish your call to be recorded, you may inform the agent at any time and request a non- recorded channel for that conversation. We will accommodate such requests where operationally and legally feasible. Certain interactions that are required to be recorded for regulatory or evidentiary purposes may not be available on a non-recorded basis.

C. Retention of Recordings and Transcripts

Call recordings, transcripts, and AI-generated analytics are retained in accordance with our general data retention practices described in Section 11. For mortgage-related interactions, recordings and transcripts are generally retained for at least three to five years following the closing or denial of the related loan, consistent with federal and state mortgage recordkeeping requirements.

5. SMS, Text Message, and AI-Initiated Communications

By providing your mobile telephone number to Truss Financial through any form, application, verbal authorization, or other channel, you provide prior express written consent to receive telephone calls and text messages from us, including calls and messages placed using an automatic telephone dialing system, prerecorded voice, artificial voice generated by AI, or automated text messaging system. This consent is not a condition of receiving any mortgage product or service.

A. Types of Messages You May Receive

• Loan application updates and status notifications.
• Document requests and verification reminders.
• Appointment scheduling and confirmations.
• Rate and market updates relevant to your inquiry.
• Marketing and promotional content related to our products and services, where you have not opted out.

B. AI-Generated Messages

Some text messages and voice calls you receive from Truss Financial may be drafted, sent, or placed by automated or AI systems operating on our behalf. Your replies to those messages may be read, interpreted, and routed by AI systems before being escalated to a human team member.

C. Opt-Out and Help

• You may opt out of SMS communications at any time by replying STOP to any text message you receive from us.
• You may obtain assistance by replying HELP to any text message, or by contacting us using the information in Section 15.
• Opting out of marketing messages will not affect transactional or service-related communications necessary to process or service your application.

D. Carrier Charges and Frequency

Message and data rates may apply depending on your wireless plan. Message frequency varies based on the stage of your loan process and the nature of your interactions with us. SMS consent and the contents of messages between you and Truss Financial are not shared with third parties or affiliates for marketing purposes.

6. Information Sharing and Disclosure

We do not sell or rent your personal information to third parties.

We share your personal information only as necessary to provide our services, operate our business, and comply with applicable law. The categories of recipients include:

• Wholesale lenders, investors, title companies, escrow companies, appraisal management companies, settlement agents, and other parties involved in the origination, underwriting, and closing of your loan.
• Loan origination system (LOS) providers, customer relationship management (CRM) platforms, document management systems, and other technology providers used to manage your application.
• Cloud hosting, infrastructure, IT support, cybersecurity, and data analytics service providers.
• AI and conversational intelligence providers, including call recording and transcription platforms, AI dialer and SMS platforms, conversation analytics tools, and AI chat providers, in each case operating under written confidentiality and data processing terms.
• Consumer reporting agencies, identity verification services, and fraud prevention services.
• Government, regulatory, and law enforcement agencies, as required by law, subpoena, court order, or regulatory request.
• Professional advisors including attorneys, accountants, auditors, and insurers.
• Successors in interest in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets.
• Affiliated business partners, subject to your GLBA opt-out rights (see Section 7).

All third parties that process personal information on our behalf are required by contract to maintain the confidentiality of your information, use it only for the purposes for which it was disclosed, and implement appropriate safeguards consistent with the GLBA Safeguards Rule.

7. GLBA Privacy Notice: Reasons We Can Share Your Personal Information

Federal law gives consumers the right to limit some, but not all, sharing of personal financial information. The table below summarizes how and why Truss Financial may share your information.

8. Cookies, Tracking Technologies, and Do Not Track

Our websites use cookies and similar tracking technologies to improve site functionality, analyze usage patterns, and support marketing efforts. The categories of cookies and tracking technologies we use include:

• Essential cookies required for website operation, authentication, and security.
• Analytics cookies used to understand site performance and visitor behavior, such as Google Analytics.
• Advertising and retargeting pixels used to deliver targeted advertising on third-party platforms, such as the Meta Pixel, Google Ads remarketing tags, and similar tools.
• CRM and personalization tracking, such as the HubSpot tracking code, used to recognize returning visitors and personalize their experience.

You can manage cookie preferences through your browser settings or through the cookie consent banner on our website. Some browsers offer a Do Not Track (DNT) signal. Because there is currently no uniform industry standard for responding to DNT signals, we do not respond to them at this time. We will update this policy if a generally accepted standard is established.

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your personal information consistent with the GLBA Safeguards Rule and applicable state law. These safeguards include:

• Encryption of data in transit using HTTPS and TLS, and encryption of sensitive data at rest.
• Access controls, multi-factor authentication, and role-based permissions.
• Employee training on information security, privacy, and the responsible use of AI tools, supported by written confidentiality agreements.
• Periodic security assessments, vulnerability scans, penetration testing, and system patching.
• Vendor risk management, including written contracts that require service providers to maintain appropriate safeguards.
• Incident response procedures designed to detect, contain, and remediate security events, and to notify affected individuals as required by law.

10. Your Rights and Choices

A. All Consumers

• Request access to or correction of your personal information held by Truss Financial.
• Opt out of marketing communications by email, SMS, or phone using the methods described in Section 5 or by contacting us.
• Opt out of affiliate information sharing for marketing purposes under the GLBA.
• Request human review of any decision that was made or materially influenced by an automated or AI system.
• Revoke your consent to receive automated calls and text messages at any time, without affecting our ability to communicate with you through non-automated means or to process your loan application through other channels.

B. California Residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, subject to certain exceptions:

• Right to Know: request the categories and specific pieces of personal information we have collected, used, disclosed, and sold or shared about you.
• Right to Delete: request deletion of personal information we have collected from you, subject to legal retention obligations applicable to mortgage records.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: although we do not sell personal information for monetary consideration, certain advertising and analytics activities may constitute sharing under the CPRA. You may opt out of such sharing.
• Right to Limit Use of Sensitive Personal Information: limit the use and disclosure of your sensitive personal information to those purposes permitted by law.
• Right to Pre-Use Notice and Opt-Out of Automated Decision-Making Technology (ADMT): receive notice before automated decision-making technology is used in connection with significant decisions affecting you, and to opt out of certain uses of ADMT as permitted under CPRA regulations.
• Right to Access Information About Automated Decision-Making: request meaningful information about the logic, intended use, and outcomes of automated decision-making used in connection with you.
• Right to Non-Discrimination: we will not deny goods or services, charge different prices, or provide a different level of quality because you exercised any of these rights.

We will respond to verified consumer requests within 45 days of receipt, as required by law, with one additional 45-day extension permitted where reasonably necessary. To submit a request, contact us using the information in Section 15. We will verify your identity before responding to any request that involves disclosure or deletion of personal information.

C. Do Not Sell or Share My Personal Information

Truss Financial does not sell personal information for monetary consideration as defined under the CCPA/CPRA. To opt out of any sharing of personal information for cross-context behavioral advertising purposes, please contact us using the information in Section 15 or adjust your cookie preferences using the consent tools available on our website.

11. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to satisfy legal, regulatory, accounting, recordkeeping, and reporting obligations applicable to mortgage brokers and lenders. For mortgage transactions, we generally retain loan-related records for a minimum of three to five years following the closing or denial of a loan, consistent with the Truth in Lending Act (TILA), the Real Estate Settlement Procedures Act (RESPA), the Equal Credit Opportunity Act (ECOA), the Home Mortgage Disclosure Act (HMDA), and applicable state law. Call recordings, transcripts, and AI-generated analytics are retained on the same schedule. When personal information is no longer needed, we securely dispose of or de-identify it.

12. Children's Privacy

Our services are directed to adults and are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have inadvertently collected such information, we will promptly delete it. If you believe a minor has provided personal information to us, please contact us using the information in Section 15.

13. Other State Privacy Rights

Residents of other states with comprehensive privacy laws (including but not limited to Colorado, Connecticut, Utah, Virginia, Oregon, Texas, and Florida) may have rights to access, correct, delete, and port their personal information, as well as to opt out of targeted advertising, the sale of personal information, and certain profiling activities. To exercise these rights, contact us using the information in Section 15. We will verify your identity and respond within the period required by your state of residence.

14. Information from Outside the United States

Our services are intended for residents of the United States. If you access our services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country of residence.

15. Contact Information

For questions about this Privacy Policy, to exercise any of your rights described above, or to report a privacy concern, please contact us using one of the following methods:

• Truss Financial Group, LLC
• Attention: Privacy Office
• 999 Corporate Drive, Suite 180, Ladera Ranch, CA 92694
• Email: hello@trussfinancialgroup.com
• Phone: 888.878.7715

16. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our use of technology, or applicable law. When we make material changes, we will post the revised policy on our website with an updated effective date and, where required by law, provide additional notice. Your continued use of our services after the revised policy is posted constitutes your acceptance of the changes. We encourage you to review this policy periodically.