Conditionly Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how Marketing Supply Co, LLC, doing business as Conditionly ("Conditionly," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit https://www.conditionly.io, use our web application at https://app.conditionly.io, connect to our MCP server at https://mcp.conditionly.io/mcp, or otherwise interact with us (together, the "Services").

If you have questions, email us at support@conditionly.io.

Quick summary

• We collect account, billing, and usage information from the mortgage professionals who use Conditionly, plus information about website visitors.
• Our customers put borrower information into Conditionly. For that information, we work on behalf of the customer (the mortgage company or loan officer). The customer decides how it is used. See Section 2.
• We use PostHog for product analytics, including session recordings in our website and app, Bubble to run our app, and Stripe for payments.
• We do not sell personal information. We use (or may use) Google advertising cookies on our marketing website, which some state laws treat as "sharing" for advertising; you can opt out (see Sections 5 and 11). We never use borrower information for advertising or marketing.
• You may have rights to access, correct, or delete your information, depending on where you live. Email support@conditionly.io.

1. Who this policy covers

This policy applies to:

• Customers and users: mortgage loan officers, processors, team members, and other people who sign up for or use Conditionly (including during a free trial);
• Website visitors: people who visit our marketing website or blog; and
• Other contacts: people who email us, request support, or otherwise communicate with us.

It also explains, in Section 2, how we handle information about borrowers that our customers put into the Services.

2. Borrower information: we act on behalf of our customers

Conditionly is a tool used by mortgage professionals. Our customers (for example, a mortgage lender, broker, branch, or loan officer) enter information about their borrowers and loan files into Conditionly so they can track loan conditions and send condition-request emails. We call this "Customer Data."

What borrower information may be in Customer Data. Depending on how a customer uses the Services, this can include a borrower's name, email address, phone number, loan number, loan type and stage, property and settlement or closing dates, the conditions requested and their status, notes, email history and delivery status, and income figures entered into the income calculator (such as salary, hourly, overtime, bonus, or self-employment income). Condition-request emails are designed to send borrowers to the customer's own secure portal, and the Services are not designed to receive or store borrower documents.

Our role. For Customer Data, we act as a service provider (also called a "processor") to our customer. That means:

• We process borrower information only on the customer's behalf and according to the customer's instructions, to provide, secure, support, and maintain the Services.
• We do not sell borrower information, use it for our own marketing, or use it to contact borrowers for our own purposes.
• We send condition-request and reminder emails to borrowers only when the customer (or an AI tool the customer has connected and approved) tells us to.
• The customer is responsible for its own privacy practices toward borrowers, including providing any notices and obtaining any consents required under the Gramm-Leach-Bliley Act (GLBA), state privacy laws, and other laws that apply to the customer.

If you are a borrower. If you received a condition-request email or believe your information is in Conditionly, the mortgage company or loan officer you are working with controls that information. Please contact them directly with questions or requests about your information. If you contact us, we will refer your request to the relevant customer or help them respond, as the law requires. Your lender's own privacy notice describes how it handles your information.

The rest of this policy describes information we handle for our own purposes (as a "business" or "controller").

3. Information we collect

Information you give us

• Account information: your name, email address, phone number, company name, role, and login credentials when you sign up or are invited to a team.
• Team information: names and email addresses of team members you invite, and the page-level access you give them.
• Branding and settings: information you add to customize your account and emails, such as your name, title, company, logo, contact details, signature, and email templates.
• Billing information: your billing name and address, and payment details. Payment card data is collected and stored by our payment processor, Stripe, not by us. We receive limited information from Stripe, such as the card type, last four digits, expiration date, and billing status. Stripe's privacy policy is at https://stripe.com/privacy.
• Communications: information you send when you contact support, respond to surveys, or otherwise communicate with us.

Information collected automatically

• Device and log data: IP address, browser and device type, operating system, language settings, referring URLs, pages viewed, and the dates and times of your visits.
• Usage and analytics data: how you use the website and app, such as features used, clicks, and navigation, collected through PostHog (see Section 5).
• Session recordings: PostHog session recordings capture how you interact with pages (for example, mouse movements, clicks, scrolling, and what appears on screen) on our website and inside the Conditionly app. Because recordings run in the app, they may capture on-screen interactions and information displayed or entered in the app, including Customer Data such as borrower information. We use session recordings only to provide support, find and fix bugs, and improve the product, and we do not use them for advertising.
• Email delivery data: information about whether condition-request emails were delivered, which we show to customers. Emails we send, including condition-request emails, may include standard delivery and engagement tracking (for example, whether an email was delivered, opened, or a link was clicked).

Information from AI tools you connect (MCP)

If you connect an AI tool (such as Claude, ChatGPT, Cursor, or Claude Code) to Conditionly through our MCP server, we receive and keep information needed to run that connection, such as OAuth authorization records and tokens, the AI client's name or identifier, the scopes you approved (mcp:read and mcp:write), and records of the requests and actions taken through the connection.

Information from other sources

• Related products: if you connect Conditionly with RateUpdate (https://www.rateupdate.io), we may receive information from it as needed to make the integration work.
• Advertising partners: if you click one of our ads (for example, a Google ad), we may receive information about that click and whether you later took an action on our website, such as starting a trial.
• Google APIs: if we use information received from Google APIs, our use will follow the Google API Services User Data Policy, including its Limited Use requirements.

We do not knowingly collect sensitive personal information about our users, such as Social Security numbers, for our own purposes.

4. How we use information

We use the information we collect to:

• Provide the Services: create and manage accounts, run the app and MCP server, send condition-request emails at your direction, and provide support;
• Process payments: manage free trials, subscriptions, billing, and renewals;
• Communicate with you: send service, security, billing, and account messages, and respond to questions;
• Send marketing: send product news and offers about Conditionly and our related products by email or text message, and advertise Conditionly online (for example, through Google Ads) and measure how well those ads work. You can opt out at any time;
• Improve the Services: understand how the Services are used, fix bugs, and develop new features (using analytics and session recordings);
• Keep the Services secure: detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms; and
• Comply with law: meet legal, tax, accounting, and regulatory obligations, and enforce our agreements.

We may also use information for other purposes with your consent.

We do not use borrower information in Customer Data for marketing, and we do not use Customer Data to train artificial intelligence models.

5. Cookies, analytics, and session recordings

We and our service providers use cookies, local storage, and similar technologies to keep you signed in, remember preferences, keep the Services secure, and understand usage.

PostHog. We use PostHog for product analytics and session recordings on our website and app. PostHog data is sent through our own domain (t.conditionly.io) and processed by PostHog, which hosts data in the United States. PostHog may set cookies or use local storage to recognize returning browsers. PostHog's privacy policy is at https://posthog.com/privacy.

Other technologies on our website. Our website is hosted on Webflow and loads fonts from Google Fonts, and our product demo video is hosted by Loom. These providers may receive your IP address and device information when you load the relevant pages.

Advertising. We use, or may use, Google Ads and related Google advertising and conversion-tracking cookies or tags on our marketing website. These help us show Conditionly ads to people who may be interested, including people who previously visited our website, and measure whether ads lead to actions such as starting a trial. Google may collect information such as your IP address, device identifiers, and pages visited, and may combine it with other information it has. Google's privacy policy is at https://policies.google.com/privacy. Advertising cookies are used only on our marketing website. We never use borrower information or other Customer Data for advertising.

Your choices. Most browsers let you block or delete cookies; blocking them may cause parts of the Services, such as staying signed in, to stop working. You can opt out of personalized Google ads at https://adssettings.google.com (Google Ads Settings), and learn about other industry opt-outs at https://optout.aboutads.info. You can also opt out of advertising "sharing" by emailing us (see Section 11).

6. How we share information

We do not sell personal information. We share it only as described here:

• Service providers (subprocessors) who help us run the Services and act on our instructions, including:

• AI tools you connect. When you connect an AI tool through our MCP server, we send it the information it requests within the access you approved, which can include Customer Data. That AI tool and its provider (for example, Anthropic, OpenAI, or Anysphere/Cursor) are not our service providers. Their handling of the data is governed by their own terms and privacy policies, and you are responsible for the tools you connect.
• Recipients you direct. When you send a condition-request email, we deliver it to the borrower you choose.
• Your team and organization. Information in an account is visible to that account's owner and team members according to the page access they have been given.
• Related products you connect, such as RateUpdate, when you choose to connect them.
• Affiliates. Companies under common control with Marketing Supply Co, LLC, who must follow this policy.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, information may be transferred to the buyer or successor, subject to this policy.
• Legal and safety. When we believe in good faith that disclosure is required by law, subpoena, or court order, or is needed to protect the rights, property, or safety of Conditionly, our customers, borrowers, or others.
• With your consent or at your direction.

Text messages. We send text messages to Conditionly customers and users (not to borrowers for our own purposes). If you opt in to text messages from us, we will not share your mobile number or text-messaging opt-in data or consent with third parties or affiliates for their marketing or promotional purposes. We may share it with service providers that help us deliver messages and support. Reply STOP to opt out or HELP for help. Message and data rates may apply.

7. How long we keep information

We keep account information and Customer Data (including borrower information) for as long as the account exists and, after an account is cancelled or closed, until the customer asks us to delete it. This means we may keep this information indefinitely unless a deletion request is made. We may also keep information longer where required or permitted by law (for example, for tax, accounting, or legal reasons).

Deletion and export requests. Customers can delete borrower records in the app at any time, and can ask us to delete or export their account information and Customer Data by emailing support@conditionly.io. After we act on a deletion request, information may remain in backups for a limited time; while it does, we store it securely and keep it from further use until it is deleted. We may keep limited records as needed to comply with law, prevent fraud, resolve disputes, and enforce our agreements.

8. How we protect information

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including access controls such as team page-level permissions, and OAuth 2.1 with PKCE for MCP connections so that AI tools receive access tokens rather than your password. Sending condition-request emails and deleting clients through the MCP server require an explicit confirmation step.

No method of transmission or storage is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your login credentials safe, managing your team's access, and only connecting AI tools you trust. If we learn of a security incident affecting your personal information or Customer Data, we will notify affected customers as required by law and our agreements.

9. Your choices

• Account information: you can review and update your account information in your account settings.
• Marketing emails: click "unsubscribe" in any marketing email or contact us. We will still send service and account messages.
• Text messages: reply STOP to opt out or HELP for help. Message and data rates may apply.
• Advertising: opt out of personalized Google ads at https://adssettings.google.com, block cookies in your browser, or email support@conditionly.io with "Do Not Share" in the subject line.
• AI connections: you can disconnect an AI tool at any time by removing the Conditionly connector in that tool.
• Closing your account: you can cancel your subscription in the app. Cancelling does not delete your data; to have your account and Customer Data deleted (or to get a copy first), email support@conditionly.io. We may keep some information as needed to prevent fraud, resolve disputes, enforce our Terms, and comply with law.

10. Your privacy rights

Depending on where you live, you may have some or all of these rights about personal information we hold about you as a business or controller:

• Access / know: confirm whether we process your personal information and get access to it and details about how we use it;
• Correction: correct inaccurate information;
• Deletion: delete your personal information;
• Portability: get a copy of your information in a portable format;
• Opt out: opt out of the sale of personal information, sharing for targeted advertising, or certain profiling (we do not sell personal information; see Section 11 to opt out of advertising "sharing");
• Withdraw consent: where we rely on your consent; and
• Non-discrimination: not be treated differently for exercising your rights.

Residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, may have these rights. Some laws apply only to businesses that meet certain thresholds, and some rights do not apply to information collected in a business-to-business context or to information covered by GLBA.

How to make a request. Email support@conditionly.io with "Privacy Request" in the subject line. We will need to verify your identity, usually by matching information you give us with information we already have, and we will use the information you provide only for verification. You may use an authorized agent; we may require proof that the agent is authorized and may ask you to verify your identity directly. We will respond within the time required by law.

Appeals. If we decline your request, you may appeal by emailing support@conditionly.io with "Privacy Appeal" in the subject line. We will tell you in writing what we did and why. If your appeal is denied, you may contact your state attorney general.

Borrower requests about Customer Data should go to the mortgage company or loan officer you are working with (see Section 2).

11. Additional information for California residents

This section supplements this policy for California residents under the California Consumer Privacy Act, as amended (CCPA).

Categories we collect (in the past 12 months), with the sources and purposes described in Sections 3 and 4:

We disclose these categories to the service providers listed in Section 6 for business purposes. We do not sell personal information for money. However, our marketing website uses (or may use) Google advertising cookies, which may count as "sharing" identifiers and internet activity with Google for cross-context behavioral advertising under the CCPA. To opt out of sharing, email support@conditionly.io with "Do Not Share" in the subject line, use Google Ads Settings at https://adssettings.google.com, or block cookies in your browser. Borrower information and other Customer Data are never sold or shared for advertising. We do not knowingly sell or share personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it under the CCPA. We do not offer financial incentives for personal information.

When we process borrower information on behalf of our customers, we do so as the customer's service provider, and borrower requests should go to the customer.

Shine the Light. California residents may request, once a year and free of charge, information about personal information we disclosed to third parties for their direct marketing purposes in the previous calendar year. We do not disclose personal information to third parties for their direct marketing purposes.

12. Children's privacy

The Services are for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe a child under 18 has given us personal information, contact support@conditionly.io and we will delete it.

13. International users

The Services are operated in the United States and intended for users in the United States. If you use the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

14. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, if we make material changes, notify you by email or through the Services before the changes take effect.

15. Contact us

Marketing Supply Co, LLC (dba Conditionly) Email: support@conditionly.io Mail: 320 E 600 S, St. George, UT 84790, United States