Privacy Policy
Dispensation Investment Group (“DIG”) collects and processes personal data to operate the platform, originate financing, and meet our obligations under federal and Texas law. This policy explains what we collect, why, and your rights.
The short version. We collect what we need to identify you, underwrite financing, and process payments. We never sell or rent your data to advertisers. We retain financial records for 7 years (federal requirement) and you can request a copy or deletion any time.
1.What we collect
We collect six categories of personal data, each tied to a specific point in your DIG journey:
Identity — Name, date of birth, SSN/ITIN, ID document. Collected at application.
Contact — Email, phone, mailing address. Collected at account creation.
Financial — Income, bank statements, tax returns, credit report. Collected during underwriting.
Payment — Bank account or card on file (tokenized via Stripe). Collected at signing.
Device — IP address, browser, OS, basic analytics. Collected on every visit.
Communications — Messages with your agent, support tickets. Collected throughout the relationship.
2.How we use it
Provide the service. Match you with properties, originate financing, accept payments.
Verify identity & underwrite. Soft and hard credit pulls (with your consent), KYC checks, fraud screening.
Comply with the law. AML/BSA reporting, GLBA safeguards, IRS Form 1098 mortgage interest reporting.
Improve the platform. Aggregated, anonymized analytics — never tied to identity.
3.When we share data
We share data only with the parties needed to deliver the service:
Title companies for title verification and policy issuance.
Stripe for payment tokenization and processing.
Experian / Equifax for soft and hard credit pulls.
Plaid for income and bank-statement verification (with your explicit consent).
Regulators when compelled by lawful subpoena or required by 31 CFR 1010 (BSA).
We do not sell, rent, or share your data with third-party advertisers, data brokers, or marketing platforms.
4.How long we keep it
Financial & loan records — 7 years after loan satisfaction (IRS / Texas record-retention).
Account data — until you delete the account, plus 90 days for backup purging.
Marketing data — until you opt out, then 30 days for unsubscribe processing.
5.How we protect it
We follow GLBA Safeguards Rule controls, including:
End-to-end TLS 1.3 in transit; AES-256 at rest.
SOC 2 Type II–audited cloud hosting (AWS US-East).
Required two-factor authentication on accounts with payment authority.
Quarterly access review; annual third-party penetration testing.
Incident-response plan with 72-hour breach-notification protocol.
6.Your rights
Under Texas Data Privacy and Security Act (effective July 2024) and GLBA, you may:
Access a copy of your personal data on file.
Correct inaccurate data.
Delete data we are not required by law to keep.
Port your data to another provider in machine-readable form.
Opt out of marketing communications at any time.
Submit requests to privacy@dinvestgroup.com. We respond within 45 days (Texas DPSA requirement).
7.Cookies & tracking
We use functional cookies (session, CSRF) by default, and analytics cookies only after you accept our cookie banner. We do not use third-party advertising cookies. We honor Global Privacy Control (GPC) signals.
8.Children
DIG is not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe a minor has used DIG, contact us and we will delete the account.
9.Contact & complaints
Privacy questions: privacy@dinvestgroup.com. Complaints can also be filed with the Texas Attorney General (Consumer Protection Division) or the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov.