Last updated October 18, 2026
Milestone Updates ("Milestone Updates," "we," "us") is software that mortgage loan officers use to send their clients short, personalized video updates as a loan moves forward. This policy explains what information we handle, why we handle it, who we share it with, and the choices you have.
This policy applies to milestoneupdates.com, the video pages at myloanupdate.com, and the related service. It covers three groups of people:
This policy does not describe how your lender, loan officer, real estate agent or title company handles your information. Their own privacy notices do. We are not responsible for their practices.
When we process loan information about borrowers, agents and other contacts, we do so on behalf of the loan officer and their company. They decide which loans and contacts are included and they control that information. In privacy-law terms, they are the "business" or "controller," and we are their "service provider" or "processor." We use that information only to provide the service to them, as our agreement with them and the law allow.
Financial privacy (GLBA). Loan information is "nonpublic personal information" under the federal Gramm-Leach-Bliley Act. Your lender's or loan officer's company's privacy notice explains how they share it. We receive it as their service provider. We use and disclose it only to perform services for them, and we do not reuse it for our own purposes.
For our own business records, such as loan officer accounts and website inquiries, we decide how information is used, and this policy describes those practices directly.
We receive this from the loan officer's loan origination system, not from you directly:
We do not ask for and do not use Social Security numbers, credit reports, income, bank account numbers or similar financial details to create updates.
Each update has its own private link. When someone opens it, we record events for that link: that the page was viewed, the video was played or finished, and whether the call or email button was tapped. We record these events for the link, not for a tracked person across the web. The loan officer can see this activity so they know the update was received.
Like any website, our hosting provider receives your IP address, browser type and the pages requested in order to deliver pages and protect them from abuse. We keep a short security log of failed attempts to reach administrative pages, which includes the IP address.
What we don't do. We do not sell personal information. We do not use loan or recipient information for advertising, profiling, or marketing our own products to recipients. We do not use it to decide anyone's creditworthiness or eligibility for a loan. We do not use it to train artificial intelligence models.
Updates are sent from the loan officer's own mailbox using Microsoft's sign-in and Microsoft Graph. We request only these permissions: sign you in (openid, profile), read your basic profile (User.Read), stay connected (offline_access), and send mail as you (Mail.Send).
Google accounts (if offered in the future). If we add Gmail or other Google account connections, Milestone Updates' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We would request only the permissions needed to send updates. We would not use Google user data for advertising, sell it, or use it to develop, improve or train generalized AI or machine-learning models. People would not read it except with your permission, for security, or to comply with law.
Emails we send. Update emails contain a link to the video page. They do not contain tracking pixels. We learn that an update was seen only when someone opens its link.
Each video's narration is created with text-to-speech technology. The voice is computer-generated. To create it, we send the narration script to our voice provider. The script is what you hear in the video. It may include names of the people on the loan, the property's street address and the loan's milestone. We do not send email addresses, phone numbers or other loan details to voice providers. We do not collect or analyze recipients' voices.
We use voice providers under terms that limit their use of our content to providing their service to us, and we use available settings so our content is not used to train their models.
Do Not Track and Global Privacy Control. We do not track visitors across other websites, and we do not allow third parties to do so through our pages. We do not sell or share personal information for advertising. We treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing for that browser.
We share personal information only as described here.
| Provider | What it does | Information involved |
|---|---|---|
| Cloudflare | Hosting, video pages, storage, security and admin sign-in | All service data; IP addresses; admin email addresses |
| Microsoft | Loan officer sign-in and sending email from their mailbox | Loan officer account; email content and recipients |
| ElevenLabs | Text-to-speech narration | Narration script (names, street address and milestone) |
| Google Fonts | Typefaces on our pages | Visitor IP address and browser type |
The loan officer's loan origination system is the loan officer's own system. It is a source of data, not a provider we share data with. We may change providers over time. We will update this list and give customers advance notice of new providers that will handle loan information.
| Information | How long |
|---|---|
| Video pages, narration audio and the loan details inside them | Expire and are deleted 180 days after creation |
| Delivery and activity logs (who an update went to, when, and viewing events) | About 13 months |
| Records that prevent duplicate sends and track a loan's last update | About 13 months |
| Mailbox connection (encrypted token) | Until the loan officer disconnects or revokes access |
| Security logs of failed admin access, including IP address | Up to 90 days |
| Opt-out list | As long as needed to keep honoring the request |
| Loan officer account and profile | While the account is active, and a reasonable period afterward |
We may keep information longer if the law requires it, or to resolve a dispute or security issue. Deleted information may remain in our providers' systems for a short time before it is permanently removed.
We use reasonable administrative, technical and physical safeguards suited to a small service. These include:
No system is perfectly secure, and we cannot guarantee the security of information. If we learn of a security incident affecting personal information, we will notify the affected loan officer and their company without undue delay, help them meet their obligations, and notify others as the law requires.
Depending on where you live, state law may give you rights over your personal information. These may include the right to know what we collect, to get a copy, to correct it, to delete it, and to opt out of its sale, sharing for targeted advertising, or certain profiling. States with these laws include California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.
We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects. We have not done so in the past 12 months.
Loan information and exemptions. Many state privacy laws do not apply to information covered by the Gramm-Leach-Bliley Act, or to certain financial institutions. When we hold information as a service provider, the loan officer's company is generally responsible for answering rights requests, and we help them. Even where a law does not apply, you may contact us and we will work with the loan officer on your request.
This notice describes the personal information we collected in the past 12 months, and our purposes. The sources are the loan officer and their company (including their loan origination system), the people who use our website and video pages, and Microsoft (for connected loan officers). We use each category only for the purposes in section 4. We disclose each category only to the recipients in section 8, for business purposes. We keep each category as described in section 9.
| Category | Examples | Disclosed to |
|---|---|---|
| Identifiers | Name, email address, phone, IP address | Loan officer and their company; people on the loan; service providers |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, address, phone, loan status | Loan officer and their company; people on the loan; service providers |
| Commercial information | Loan milestone status and key dates | Loan officer and their company; people on the loan; service providers |
| Internet or other electronic activity | Video page views, plays and button taps; security logs | Loan officer and their company; tools they connect; service providers |
| Audio or visual information | Loan officer headshot and logo; computer-generated narration | People on the loan; service providers |
| Professional information | Loan officer and agent name, company, NMLS number | People on the loan; service providers |
| Sensitive personal information | Loan officer's mailbox access tokens (account credentials) | Microsoft and our hosting provider, only to operate the connection |
We do not collect precise geolocation, biometric information, Social Security numbers or other government ID numbers, financial account numbers, or inferences about you. We use sensitive personal information only to provide the service, as California law permits, so the right to limit its use does not apply. We do not knowingly sell or share the personal information of anyone under 16.
We do not sell covered information as defined in Nevada law (NRS 603A). Nevada residents may still send an opt-out request to support@milestoneupdates.com, and we will honor it.
The service is for adults involved in a home loan. It is not directed to children. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.
The service is offered only in the United States and is intended for U.S. residents. Our providers operate global networks, so information may be processed or cached outside the United States. If you use the service from outside the United States, you understand that your information will be handled under U.S. law and the practices in this policy.
Updates may link to other websites, such as a loan officer's or lender's site. We are not responsible for their content or privacy practices.
We may update this policy as the service changes or the law changes. We will post the new version here and change the date at the top. If we make a material change, we will tell loan officers in advance by email or in the service. We will not use information in a materially different way from what this policy described when it was collected without giving notice and, where the law requires, getting consent.
Questions or requests about privacy: support@milestoneupdates.com. Milestone Updates is based in Las Vegas, Nevada.