Your Data Security

Supaloan Privacy Policy

Last updated: May 2026

This Privacy Policy explains how Credit Boxed Inc. collects, uses, shares, stores, and protects information when you visit or use Supaloan.com, any related website, landing page, form, feature, or loan connection service operated by or on behalf of Credit Boxed Inc. We refer to these websites and services together as the “Service.” Credit Boxed Inc. operates a loan connection and consumer financial marketing service. We may collect information from you and share it with participating third-party lenders, loan marketplaces, lead buyers, financial service providers, verification providers, marketing partners, service providers, and other companies that may review, process, respond to, or help facilitate your request. We refer to these companies as “Participating Providers.”By using the Service, submitting information, or continuing through a loan request journey, you acknowledge that you have read this Privacy Policy and understand how your information may be collected, used, and shared.

1. Who We Are

The Service is operated by:

Credit Boxed Inc.

14501 Grove Resort Avenue, Unit 3236

Winter Garden, Florida 34787

Email: hello@supaloan.com

Credit Boxed Inc. is not a lender, creditor, loan originator, loan servicer, or credit decision-maker. Any loan, credit product, financial product, or related service is provided by the applicable third-party lender or provider.

2. Information We Collect

We may collect information directly from you, automatically from your device or browser, from affiliates or traffic sources that refer you to us, from vendors and verification providers, and from Participating Providers. The information we collect may include the following categories.

2.1 Contact and identifying information

This may include:

  • first and last name;
  • email address;
  • telephone number;
  • mobile number;
  • home address;
  • mailing address;
  • date of birth;
  • Social Security number or partial Social Security number;
  • driver’s license number, state identification number, or other identification information;
  • military status or affiliation, where relevant to the request; and
  • other information you provide to identify yourself or submit a request.

2.2 Loan request and financial information

This may include:

  • requested loan amount;
  • loan purpose;
  • income amount;
  • income source;
  • pay frequency;
  • employment status;
  • employer name;
  • job title;
  • time with employer;
  • work phone number;
  • housing status;
  • time at residence;
  • rent or mortgage payment;
  • bank name;
  • bank account type;
  • routing number;
  • bank account number;
  • time with bank;
  • credit score range or credit-related information you provide;
  • bankruptcy information or other financial status information; and
  • other application, eligibility, or financial information you choose to provide.

2.3 Device, internet, and usage information

This may include:

  • IP address;
  • device type;
  • browser type and version;
  • operating system;
  • pages viewed;
  • buttons or links clicked;
  • date and time of visits;
  • time spent on the Service;
  • referring URL;
  • source URL;
  • redirect URL;
  • affiliate, source, sub-source, campaign, and ad identifiers;
  • cookies, pixels, tags, tracking links, and similar identifiers;
  • approximate location derived from IP address; and
  • other information about how you interact with the Service.

2.4 Consent, disclosure, and transaction records

This may include:

  • consent language shown to you;
  • page version or form version;
  • E-Consent records;
  • TCPA or marketing consent records;
  • FCRA or credit-review authorization records;
  • timestamps;
  • source and landing page information;
  • submission records;
  • routing records;
  • Participating Provider records;
  • suppression or opt-out records;
  • complaint records; and
  • audit, compliance, and recordkeeping information.

2.5 Verification, fraud, and compliance information

We may use vendors or Participating Providers to verify information, reduce fraud, detect duplicate requests, confirm identity, validate contact details, check bank account details, validate income or employment information, or support compliance. Depending on the process, this may include information received from identity verification providers, fraud prevention providers, bank verification providers, income or employment verification providers, consumer reporting agencies, specialty data providers, or Participating Providers.

3. How We Collect Information

We may collect information:

  • when you enter it into a form or submit a request;
  • when you communicate with us;
  • when you click links, visit pages, or interact with the Service;
  • through cookies, pixels, tracking links, server logs, analytics tools, and similar technologies;
  • from affiliates, publishers, advertising sources, or other traffic sources that refer you to us;
  • from service providers that support our operations;
  • from verification, fraud prevention, analytics, and compliance providers;
  • from Participating Providers that receive, review, or respond to your request; and
  • from public, commercial, or lawful third-party sources where permitted.

4. How We Use Information

We may use information for the following purposes:

  • operating the Service;
  • receiving, processing, and routing your loan request;
  • transmitting your request to Participating Providers;
  • helping connect you with lenders, loan marketplaces, lead buyers, financial service providers, or related providers;
  • verifying your identity;
  • validating the information you provide;
  • detecting and preventing fraud, misuse, duplicate requests, or unauthorized activity;
  • supporting credit review, eligibility review, prequalification, underwriting, or offer generation by Participating Providers;
  • preserving records of consent, disclosures, page versions, and submissions;
  • communicating with you about your request;
  • enabling Participating Providers to contact you where permitted and consented to;
  • providing customer support;
  • responding to consumer inquiries, complaints, disputes, legal requests, or regulatory inquiries;
  • managing opt-out, unsubscribe, and suppression requests;
  • measuring traffic, marketing performance, source quality, and attribution;
  • improving the Service, user experience, and fraud controls;
  • auditing, reporting, monitoring, and compliance testing;
  • enforcing our Terms and other agreements;
  • protecting our rights, users, systems, data, Participating Providers, and business;and
  • complying with applicable law, regulation, legal process, contractual obligations, and internal policies.

5. How We Share Information

We may share information as described below.

5.1 Participating Providers

We may share information with Participating Providers, including third-party lenders, loan marketplaces, lead buyers, financial service providers, verification providers, marketing partners, and other companies that may review, process, respond to, purchase, or help facilitate your request.

Participating Providers may use your information to:

  • review your request;
  • verify your identity;
  • validate the information you provide;
  • determine whether they may offer or facilitate a product or service;
  • provide quotes, prequalification results, offers, or other information;
  • make lending, underwriting, fraud prevention, or eligibility decisions;
  • contact you about your request or related products and services where permitted;
  • comply with legal, regulatory, underwriting, audit, or compliance obligations; and
  • maintain their own records in accordance with their own privacy policies and legal obligations. 

Participating Providers are independent third parties. Their use of your information is subject to their own privacy policies, terms, disclosures, and legal obligations.

5.2 Service providers and vendors

We may share information with vendors and service providers that support our business, including hosting providers, cloud providers, analytics providers, CRM systems, lead management platforms, fraud prevention vendors, identity verification vendors, communication providers, email service providers, SMS service providers, compliance vendors, security providers, professional advisers, and other operational vendors.

5.3 Affiliates, publishers, and marketing partners

We may share information with affiliates, publishers, advertising sources, and marketing partners for attribution, campaign performance, fraud prevention, traffic quality review, compliance, suppression, and other operational purposes. Where permitted by law and consistent with the consents and disclosures presented to you, we or our partners may use information to present or facilitate offers for loan-related or other financial products and services.

5.4 Legal, regulatory, security, and business purposes

We may share information:

  • to comply with law, regulation, subpoena, court order, legal process, regulatory inquiry, or law enforcement request;
  • to respond to complaints, disputes, investigations, audits, or due diligence requests;
  • to protect the rights, property, safety, systems, data, users, Participating Providers, or business of Credit Boxed Inc. or others;
  • to detect, prevent, or address fraud, security, technical, or operational issues;
  • to enforce our Terms, policies, agreements, or rights;
  • with professional advisers, auditors, insurers, legal counsel, and compliance advisers;
  • in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, change of control, or similar transaction; and
  • for any other purpose disclosed to you or permitted by law.

6. Credit Reports, Consumer Reports, and Verification Providers

Where you submit a loan request, Participating Providers may obtain or use information from consumer reporting agencies, credit bureaus, specialty consumer reporting agencies, identity verification providers, fraud prevention providers, bank verification providers, income or employment verification providers, or other lawful data sources. These providers may include Experian, TransUnion, Equifax, Clarity Services, Array, FactorTrust, DataX, MicroBilt, or other recognized consumer reporting agencies, specialty reporting agencies, credit bureaus, verification providers, or data sources. Credit Boxed Inc. does not itself make final lending decisions, underwrite loans, approve or deny credit, fund loans, or set loan terms. Any lender or provider that obtains or usesconsumer report information is responsible for its own permissible purpose and compliance with the Fair Credit Reporting Act and other applicable law.

7. Communications, Calls, Texts, and Email

Where you provide contact information and any required consent, Credit Boxed Inc. and Participating Providers may contact you using the phone number, mobile number, email address, mailing address, or other contact details you provide.

Communications may relate to:

  • your loan request;
  • incomplete submissions;
  • requests for additional information;
  • product or service opportunities;
  • lender or provider offers;
  • fraud prevention or verification;
  • customer support;
  • legal, compliance, or transactional notices;
  • marketing communications where permitted; and
  • other matters described in the Terms, E-Consent, or other disclosures presented to you. 

Credit Boxed Inc. does not currently operate outbound telemarketing call campaigns or SMS marketing campaigns in its own name. Where Credit Boxed Inc. collects phone or text consent, it is intended to support contact by Participating Providers unless another use is clearly disclosed.

You may opt out of marketing emails by using the unsubscribe link or instructions in the email. You may opt out of text messages by replying STOP where that option is provided. If a Participating Provider contacts you, you may need to opt out directly with that Participating Provider.

8. Cookies, Analytics, and Tracking Technologies

We may use cookies, pixels, tags, server logs, tracking links, analytics tools, and similar technologies to operate the Service, remember information, support form completion, measure traffic, identify sources, improve user experience, detect fraud, support advertising, and measure campaign performance.

These technologies may collect device, browser, interaction, source, ad, and usage information. Some cookies are necessary for the Service to function. Others help us understand performance, attribution, marketing effectiveness, or fraud signals.

You may be able to manage cookies through your browser settings. Blocking cookies may affect the availability or functionality of parts of the Service.9. Do Not Track and Opt-Out Preference Signals

Some browsers or devices may offer “Do Not Track” or similar settings. Because there is not currently a uniform industry standard for responding to Do Not Track signals, the Service may not respond to all such signals.

Where required by applicable law, including California privacy law where applicable, we will process recognized opt-out preference signals such as Global Privacy Control as an opt-out of sale or sharing for the browser or device through which the signal is sent.

10. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, destruction, misuse, or loss.

These safeguards may include access controls, encryption in transit, secure hosting, logging, monitoring, vendor controls, fraud prevention tools, and other measures appropriate to the nature of the information and our business. 

No website, system, network, storage method, or electronic transmission is completely secure. We cannot guarantee absolute security. You should use caution when submitting information online and should protect your own devices, accounts, and communications.

11. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to operate the Service, route and evidence requests, maintain consent and disclosure records, detect fraud, comply with law, respond to complaints, support audits, satisfy contractual obligations, resolve disputes, enforce agreements, and maintain business records.

Retention periods may vary depending on the type of information, the purpose for which it is used, legal obligations, contractual requirements, regulatory expectations, complaint or litigation risk, fraud prevention needs, and operational requirements. When information is no longer reasonably needed, we will delete, de-identify, aggregate, or otherwise dispose of it in accordance with our recordkeeping and security practices, unless retention is required or permitted by law.

12. Your Choices

Depending on where you live and the laws that apply, you may have choices or rights relating to your personal information. These may include the ability to:

  • request access to certain personal information;
  • request correction of inaccurate personal information;
  • request deletion of certain personal information;
  • opt out of certain sales or sharing of personal information;
  • limit certain uses or disclosures of sensitive personal information;
  • opt out of certain marketing communications;
  • withdraw certain consents for future communications; and
  • appeal certain privacy decisions where applicable. 

To make a request, contact us at hello@supaloan.com or use any privacy request or opt-out form made available on the Service.

We may need to verify your identity before responding to certain requests. We may deny or limit requests where permitted by law, including where information must be retained for legal, fraud prevention, security, compliance, dispute resolution, audit, contractual, or transaction-related purposes. If your request relates to a Participating Provider, you may need to contact that Participating Provider directly.

13. Sale, Sharing, and Targeted Advertising

Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly. Depending on the law that applies and how the Service is operated, sharing information with Participating Providers, advertisers, analytics providers, marketing partners, or tracking technology providers may be considered a sale, sharing, or targeted advertising. Where required by applicable law, you may opt out of the sale or sharing of personal information or targeted advertising by using the opt-out methods made available on the Service or by contacting hello@supaloan.com.

We do not knowingly sell or share personal information of individuals under 18 years old.

14. Sensitive Personal Information

We may collect information that some laws classify as sensitive personal information, such as Social Security number, driver’s license or identification number, financial account information, income information, precise data submitted through a financial request, and certain account or verification information.

We use sensitive personal information for purposes such as processing your request, routing your request to Participating Providers, identity verification, fraud prevention, compliance, security, recordkeeping, and other purposes permitted by law. Where applicable law gives you the right to limit certain uses of sensitive personal information, you may submit a request by contacting hello@supaloan.com. Some uses of sensitive personal information may be necessary to provide the Service, process your request, prevent fraud, comply with law, or maintain security and may not be subject to limitation.

15. California Privacy Notice 

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to Credit Boxed Inc. Some personal information may also be subject to exemptions, including exemptions for information governed by the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or other laws.

15.1 Categories of personal information collected

Category

Examples

Identifiers

Name, address, email, phone number, IP address, device identifiers, Social Security number, driver’s license number

Personal information under California customer records law

Contact details, financial information, bank information, identification information

Protected classification characteristics

Age, date of birth, military status where provided or relevant

Commercial information

Loan request details, products or services requested, lead submission history

Internet or electronic network activity

Pages viewed, links clicked, browser information, usage data, source URL, redirect URL, cookies

Geolocation data

Approximate location derived from IP address or device/browser information

Professional or employment information

Employer, job title, work phone, employment status, income source, time with employer

Inferences

Eligibility signals, fraud indicators, source quality information, routing information, inferred interests based on request or site activity

Sensitive personal information

Social Security number, driver’s license number, financial account information, income information, authentication or verification data where collected

15.2 Sources of personal information

We may collect personal information from you;

  • your device or browser;
  • affiliates, publishers, advertising sources, or referring sites;
  • service providers and vendors;
  • verification and fraud prevention providers;
  • Participating Providers;
  • analytics and tracking technology providers; and
  • public, commercial, or lawful third-party sources.

15.3 Business or commercial purposes

We may collect, use, disclose, sell, or share personal information for the business and commercial purposes described in Sections 4 and 5 of this Privacy Policy, including processing requests, routing leads, fraud prevention, identity verification, compliance, analytics, advertising, marketing, attribution, service improvement, recordkeeping, and legal purposes.

15.4 Categories of third parties to whom information may be disclosed

We may disclose personal information to:

  • Participating Providers;
  • lenders;
  • loan marketplaces;
  • lead buyers;
  • financial service providers;
  • verification providers;
  • fraud prevention providers;
  • marketing partners;
  • affiliates and publishers;
  • advertising and analytics providers;
  • cloud, hosting, CRM, lead management, and technology vendors;
  • email, SMS, and communications vendors;
  • professional advisers;
  • regulators, law enforcement, courts, and other parties where legally required or permitted; and
  • parties involved in a business transfer or corporate transaction.

15.5 Sale or sharing of personal information

Depending on how applicable law defines “sale” or “sharing,” we may sell or share identifiers, internet or electronic network activity information, commercial information, and related lead request information when we transmit requests to Participating Providers, work with marketing partners, or use certain advertising or analytics technologies. Where required, you may opt out of sale or sharing by using the opt-out method on the Service or by contacting hello@supaloan.com.

15.6 California rightsSubject to legal limits and verification, California residents may have the right to:

  • know what personal information we collect, use, disclose, sell, or share;
  • access personal information;
  • request deletion of personal information;
  • request correction of inaccurate personal information;
  • opt out of the sale or sharing of personal information;
  • limit the use or disclosure of sensitive personal information where applicable;
  • not be discriminated against for exercising privacy rights; and
  • use an authorized agent to submit certain requests. 

To exercise these rights, contact hello@supaloan.com or use the applicable request form made available on the Service. We may need to verify your identity and may request information reasonably necessary to process the request. If you use an authorized agent, we may require proof of authorization and may also require you to verify your identity directly with us.

16. Other State Privacy Rights

Residents of certain other U.S. states may have privacy rights under applicable state privacy laws. Depending on the law that applies and subject to available exemptions, these rights may include access, deletion, correction, opt-out of targeted advertising, opt-out of sale, opt-out of certain profiling, data portability, and appeal rights. To submit a request, contact hello@supaloan.com. We will process requests as required by applicable law. Some information may be exempt from state privacy laws, including information governed by the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or other federal or state laws.

17. Children’s Privacy

The Service is intended for adults. We do not knowingly collect personal information from children under 13. The Service is not intended for individuals under 18, and we do not knowingly sell or share personal information of individuals under 18. If you believe a child has provided information to us, please contact hello@supaloan.com.

18. Third-Party Websites

The Service may link or redirect you to third-party websites, forms, services, or offers. This Privacy Policy does not apply to websites or services operated by third parties. You should review the privacy policy and terms of any third-party website, lender, marketplace, provider, or service before submitting information or accepting any offer. Credit Boxed Inc. is not responsible for the privacy, security, content, disclosures, or practices of third parties.

19. Financial Privacy and Legal Exemptions

Because the Service relates to consumer financial products and services, certain information may be subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or other federal or state financial privacy laws. Where those laws apply, some state privacy rights may not apply to that information or may apply differently.

We will use and share financial information, nonpublic personal information, consumer report information, and related records as permitted by applicable law, consumer disclosures, consents, and our operating model.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. Unless otherwise stated, changes are effective when posted. Your continued use of the Service after an updated Privacy Policy is posted means you acknowledge the updated Privacy Policy.

21. Contact Us

For privacy questions, requests, or complaints, contact:

Credit Boxed Inc.

14501 Grove Resort Avenue, Unit 3236

Winter Garden, Florida 34787

Email: hello@supaloan.com

If your request concerns information held by a Participating Provider, you may need to contact that Participating Provider directly.