Privacy Policy

1. Introduction, Scope & Platform Classification

Welcome to Three Sticks Lending (accessible via https://threestickslending.net/). This Privacy Policy governs the manner in which Three Sticks Lending ("we," "us," or "our") collects, maintains, uses, safeguards, and discloses consumer personal information obtained through our website, mobile interfaces, payment calculation modules, and online consumer intake forms.

Important Platform Notice: Three Sticks Lending is an independent educational and consumer referral platform. We are not a direct lender, depository financial institution, bank, loan broker, or credit repair organization. We do not underwrite credit applications, originate loans, make credit decisions, or issue funds directly. Our service connects eligible prospective borrowers with independent, qualified third-party lenders within our referral network.

By accessing our website, using our interactive loan estimation tools, or submitting an online inquiry, you consent to the data collection and processing practices described throughout this Privacy Policy. If you do not agree with any terms within this policy, please discontinue use of the platform immediately.

2. Categories of Personal Information We Collect

In the preceding 12 months, we have collected (or may collect) the following categories of personal information from consumers depending upon the level of interaction:

• Identifiers & Contact Details: Full name, verified email address, telephone number, residential street address, city, state of residence, and postal ZIP code.
• Financial & Employment Inquiry Data: Requested loan principal amount ($200 to $5,000), intended loan purpose (e.g., auto repair, medical, home improvement, debt consolidation), employment status (full-time, part-time, self-employed, benefit recipient), approximate recurring gross monthly income, and self-reported credit score tier.
• Device & Internet Activity Data: Internet Protocol (IP) address, operating system, web browser type and version, language preferences, device hardware identifiers, internet service provider (ISP), referring and exit page URLs, date and time stamps, and on-site clickstream behavior.
• Inference & Preference Data: Information derived from your interactions with our payment amortization calculator, such as selected term lengths (6 to 60 months) and simulated APR ranges.

3. How We Collect Information

We obtain consumer personal data through three principal channels:

1. Direct Consumer Input: Information you voluntarily enter when completing our online loan inquiry forms, subscribing to consumer guides, requesting customer support through our Contact Us page, or adjusting calculation parameters.
2. Automated System Logging: As you navigate through our website, our web servers and performance monitoring systems automatically record technical telemetry, network connection parameters, and page load diagnostics.
3. Lending Partner Communications: When you connect with a participating lender, we may receive confirmation regarding whether an inquiry resulted in a matched offer, for referral attribution and regulatory reporting purposes.

4. Purposes for Processing Personal Data

We collect and process consumer personal information for specific, lawful operational purposes, including:

• Lender Referral Matching: Connecting prospective applicants with independent lenders licensed in their jurisdiction that offer installment loans matching requested loan amounts ($200 to $5,000).
• Illustrative Financial Calculations: Generating customized monthly payment estimations, total finance charge breakdowns, and amortization projections based on representative APRs (5.99% to 35.99%).
• Customer Communication: Responding to consumer inquiries, delivering disclosures, providing requested guides, and delivering technical assistance.
• Platform Integrity & Security: Detecting fraudulent inquiries, mitigating bot abuse, preventing security incidents, and safeguarding our infrastructure.
• Regulatory & Legal Compliance: Complying with federal consumer financial protection rules, state licensing disclosures, subpoena demands, and auditing standards.

5. Gramm-Leach-Bliley Act (GLBA) Financial Privacy Notice

To the extent that personal information collected in connection with consumer loan inquiries qualifies as Nonpublic Personal Information (NPI) under the federal Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. § 6801 et seq.) and Consumer Financial Protection Bureau (CFPB) Regulation P:

• Administrative Safeguards: Access to consumer inquiry records is restricted to authorized personnel who require access to fulfill operational or compliance responsibilities.
• Technical Safeguards: All digital communications containing NPI are transmitted via strong cryptographic protocols (TLS 1.3), with data at rest protected by hardened database environments.
• Sharing Limitations: We share NPI only as permitted by law, specifically to process consumer-initiated loan requests, prevent fraud, or satisfy regulatory oversight. We do not disclose NPI to nonaffiliated third parties for independent marketing purposes without providing applicable opt-out mechanisms.

6. Sharing & Disclosure with Third-Party Lenders

When you submit a loan inquiry through our service, you explicitly authorize Three Sticks Lending to transmit your contact details, financial criteria, and requested loan parameters to independent participating lenders and loan referral service providers within our network.

Independent Third-Party Policies: Once your information is received by a third-party lending provider, that entity's handling, retention, credit bureau reporting, and servicing of your information are governed exclusively by their own privacy policies and terms of service. We urge you to review the specific privacy disclosure of any provider prior to executing a loan agreement.

Zero Data Selling Guarantee: Three Sticks Lending does not sell consumer personal information, email addresses, or phone numbers to unrelated commercial telemarketers, lead lists, or data brokers.

7. Cookies & Automated Tracking Technologies

We utilize first-party cookies, local web storage, and session identifiers to facilitate smooth platform operation. These technologies fulfill essential functions:

• Essential Operation: Ensuring form data persists across multi-step inputs and enabling basic navigation security.
• Preference Retention: Remembering user interface settings, such as calculator preset choices and accessibility preferences.
• Security & Abuse Prevention: Verifying genuine human interaction and preventing automated credential-stuffing or spam submission.

You may configure your internet browser to refuse cookies or alert you when cookies are placed on your device. However, disabling essential cookies may impact certain interactive features such as the payment amortization calculator.

8. Data Security & Encryption Standards

Protecting consumer data is fundamental to our service. We implement industry-accepted administrative, technical, and physical safeguards:

• In-Transit Cryptography: All communications between your web browser and our servers are encrypted via modern 256-bit TLS (Transport Layer Security) encryption.
• Network Firewalls & Intrusion Prevention: Continuous automated monitoring and firewall filtering against distributed denial of service (DDoS) and vulnerability exploits.
• Access Restrictions: Personnel access is strictly managed according to the principle of least privilege, requiring multi-factor authentication.

While we follow rigorous security standards, no electronic data transmission or digital storage system can be guaranteed to be 100% impenetrable. We encourage consumers to take precautions when accessing financial portals on public or unencrypted Wi-Fi networks.

9. State-Specific Consumer Privacy Rights

Residents of several U.S. states enjoy statutory privacy rights under comprehensive state data privacy laws. These statutes include the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and the Texas Data Privacy and Security Act (TDPSA).

Depending upon your state of residence, your statutory rights may include:

• Right to Know & Access: You may request disclosure of the specific pieces and categories of personal information we have collected about you, the categories of sources, and the business purposes for collecting it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to statutory exceptions (such as compliance with legal retention requirements or fraud defense).
• Right to Correct: You have the right to request correction of inaccurate personal data maintained about you.
• Right to Opt Out of Sale or Targeted Advertising: We do not sell personal data for monetary consideration or engage in cross-context behavioral advertising. You maintain the right to verify or reaffirm this preference.
• Right to Non-Discrimination: We will not deny you services, charge you different rates, or provide a lower quality of experience for exercising your lawful privacy rights.
• California "Shine the Light" Law (Civil Code § 1798.83): California residents may request a list of third parties to whom we disclosed personal information during the preceding year for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes without your prior affirmative consent.

10. How to Submit a Verifiable Consumer Request

To exercise any of the state privacy rights outlined above, you or an authorized agent acting on your behalf may submit a verifiable consumer request through either of the following mechanisms:

• Online Portal: Submit an inquiry via our secure Contact Us page, selecting "Privacy Request" in the subject category.
• Direct Written Email: Send an email to [email protected] with the subject line "Privacy Rights Request".

Verification Process: To protect consumer security and confidentiality, we must verify your identity before processing any substantive request. We will match information provided in your request against data already maintained in our systems. We respond to verifiable consumer requests within forty-five (45) days of receipt, or notify you in writing if an extension (up to an additional 45 days) is required by law.

11. Data Retention & Disposal Guidelines

We retain personal data only for as long as reasonably necessary to fulfill the specific purposes described in this policy, including:

• Facilitating initial referral transmission and customer follow-up.
• Satisfying statutory legal, auditing, and tax compliance records.
• Resolving consumer inquiries, complaints, or ongoing dispute defense.
• Maintaining fraud prevention logs and security auditing history.

When personal data is no longer necessary to satisfy these obligations, it is securely deleted, permanently overwritten, or aggregated into irreversible, non-identifying statistical records.

12. Children's Online Privacy Protection (COPPA)

Our website, products, and informational services are strictly intended for legal adults who are at least eighteen (18) years of age (or nineteen [19] years of age in Alabama and Nebraska). We do not knowingly solicit, collect, or maintain personal information from individuals under the age of 18 in accordance with the Children's Online Privacy Protection Act (COPPA).

If we discover that an individual under the age of 18 has submitted personal information through our platform, we will take immediate steps to delete that data from our records. If you are a parent or guardian who believes your child has provided us with personal information, please notify us immediately at [email protected].

13. Do Not Track (DNT) & Global Privacy Control (GPC)

Some web browsers offer a "Do Not Track" (DNT) signal setting. Because universal technical standards for interpreting DNT have not been finalized, our website does not currently modify its general data collection behavior in response to standard DNT browser headers.

However, we recognize and honor recognized automated universal opt-out preference signals, such as the Global Privacy Control (GPC), as required under applicable state laws, ensuring your preferences regarding data sharing are appropriately respected.

14. Policy Modifications & Designated Privacy Contact

We reserve the right to amend, update, or modify this Privacy Policy at our discretion to reflect changes in our operational procedures, technological advancements, or applicable statutory frameworks. Whenever material adjustments are made, the revised policy will be posted on this page with an updated "Last Updated & Effective Date" notice at the top. We encourage consumers to review this page periodically.

For any questions, concerns, or formal privacy inquiries regarding this Privacy Policy, our data practices, or to request access to this policy in an alternative accessible format, please contact our Privacy Team: