Privacy Policy

Effective October 16, 2026. Last updated October 24, 2026.

1. Introduction and Scope

MercFinancial is a commercial funding brokerage with its operations at 24 Greenway Plaza, Suite 1800L, Houston, Texas 77046 ("MercFinancial," "we," "our" or "us"). We arrange business-purpose financing for companies and their owners through a network of wholesale lenders and financial institutions. We are not a lender, and we do not make credit decisions.

This Privacy Policy (the "Policy") explains how we collect, use, disclose, retain and protect information when you:

• visit Merc.Financial or any page, form or tool we operate on it (the "Site");
• speak with Stephanie, our AI lending assistant, on the Site, by text message or by telephone;
• request a pre-approval, submit an application, upload documents or otherwise ask us to arrange financing (the "Services");
• take part in the Syndication Partner Program, including the Partner Portal; or
• call, text, email, write to or meet with us.

Because our Services are offered to businesses, most of the information we hold concerns a business and the people who own, guarantee or represent it. This Policy covers all of it, whether the law treats it as "personal information," "personal data," "nonpublic personal information" or business information. Where a specific law gives you rights, Section 15 explains them. If you do not agree with this Policy, please do not use the Site or the Services.

2. Definitions

Personal information

Information that identifies, relates to, describes or could reasonably be linked to an identifiable individual or household. It does not include information that has been de-identified or aggregated so that it can no longer be linked to a person, or information that is lawfully available from government records.

Business information

Information about a company, partnership, trust or other entity, such as its name, EIN, financial statements, bank activity, ownership and obligations.

Nonpublic personal information (NPI)

Personally identifiable financial information we obtain in connection with arranging a financial product or service, as that term is defined in the Gramm-Leach-Bliley Act.

Sensitive information

Government identifiers (Social Security number, driver's licence or passport number), precise financial account credentials, and any other category a law designates as sensitive.

Lender

A bank, credit union, finance company, fund, investor or other capital provider in our network to which we may present your request.

Service provider

A company that processes information on our behalf and under our instructions, such as our cloud hosting, communications or e-signature vendors.

Divisions

The other trade names of the same legal entity that operates MercFinancial: MercResolution (commercial debt resolution), MercConsulting (business consulting) and MercPrivacy (privacy services), all under the Mercury Holdings brand.

3. Information We Collect

The categories below describe what we collect, with examples and where it comes from. Not every category applies to every person: a visitor who reads a Knowledge Center article gives us far less than a borrower who completes an application.

3.1 Information you give us

You give us information when you ask a question on the Site, talk with Stephanie, complete a contact form or pre-approval, apply for financing, upload documents, sign an agreement, join the Syndication Partner Program, or write, call or text us. You decide what to share, but a lender cannot evaluate a request without the financial and ownership details its program requires, so declining to provide them may mean we cannot place your financing.

3.2 Information we collect automatically

When you use the Site, our systems record technical and usage data described in the table above. We use a first-party analytics script, served from our own domain, that sends nothing until you accept analytics in the cookie notice. Our bot-protection and content-delivery provider (Cloudflare) inspects traffic to the Site to block abuse and may set the cookies described in Section 10.

3.3 Information from other sources

We receive information from:

• Lenders and funding partners, who tell us the status and outcome of a request, the terms they offer and, in some cases, their underwriting findings;
• Consumer reporting agencies and commercial credit bureaus, when you authorize a credit report (Section 7);
• Business-data and verification providers, which supply or confirm entity details, addresses, telephone numbers and public records, and licensed business lead lists we may obtain to introduce our Services to businesses that may qualify for them (Section 11.5 tells you how to stop those introductions);
• Referral partners, such as accountants, brokers, attorneys and marketing partners that refer a business to us with its knowledge;
• Public records, including secretary-of-state filings, county property and lien records, UCC filings and court dockets; and
• Our Divisions, when you are already a client of one of them and ask that your information be used for financing.

4. How We Use Information

We use the information we hold for the following purposes:

We may also use de-identified or aggregated information for any purpose. We will not attempt to re-identify it.

4.1 Automated decision-making

We use software to route requests, flag likely spam and suggest which lender programs fit a request. No decision to approve or decline financing is made by MercFinancial, automatically or otherwise. Credit decisions are made by the lender you choose to apply to, under its own underwriting standards and its own legal obligations, including any adverse-action notice it must give you.

5. How We Share Information

We share information only as described here. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

6. Stephanie, Our AI Lending Assistant

Stephanie is an automated assistant built on artificial-intelligence language models. She is not a person. When you talk with her:

• Your conversation is recorded and kept. The transcript is stored with your lead record so a funding advisor can continue where you left off and so you can resume the conversation later. Members of our team review transcripts for quality, training and compliance.
• Models process what you say. To generate a reply, the text of your conversation is sent to the AI model providers we use as service providers. They are contractually prohibited from using your conversation to train their general-purpose models.
• Verification codes are protected. When Stephanie texts or emails you a one-time code to resume a session, the code is removed from the transcript before it is stored.
• She may be wrong. Stephanie's answers are generated automatically and may be incomplete, out of date or inaccurate. They are general information, not advice, and never a commitment of funding or terms.
• Keep sensitive data out of the chat. Do not type account numbers, passwords, Social Security numbers or full card numbers into the chat. When a lender needs documents, Stephanie gives you a secure, time-limited upload link; use it.

We disclose that Stephanie is automated at the start of every conversation and whenever you ask. You may request a human at any time by asking Stephanie, calling us, or using the Contact page.

7. Credit Reports and the Fair Credit Reporting Act

Arranging financing usually involves credit information. We handle it as follows:

• Soft inquiry for pre-approval. With your express authorization, we may obtain a consumer credit report or score through a soft inquiry, which does not affect your credit score, to understand which programs may fit. We obtain it only for a permissible purpose under the Fair Credit Reporting Act (15 U.S.C. § 1681b): a business transaction you initiate.
• Lender inquiries. A lender you apply to may obtain its own report, which may be a hard inquiry. The lender will tell you before it does so.
• Commercial credit. We may obtain business credit reports on your company from commercial bureaus.
• Use and retention. Credit information is used only for the financing request it was obtained for and for the record-keeping the law requires. We do not resell it, and we do not furnish information about you to consumer reporting agencies.
• Disputes. If a report contains inaccurate information, you have the right to dispute it directly with the agency that issued it. We will tell you which agency we used on request.

MercFinancial is not a credit repair organization and does not offer credit repair services.

8. Fair Lending

We arrange business credit without regard to race, color, religion, national origin, sex, marital status, age (provided the applicant has capacity to contract), receipt of public-assistance income, or the good-faith exercise of rights under the Consumer Credit Protection Act, consistent with the Equal Credit Opportunity Act (15 U.S.C. § 1691 et seq.) and Regulation B. We use the information we collect to match your request to lender programs, never to screen on a prohibited basis. If a lender declines your request, that lender is responsible for any statement of reasons the law requires; we will help you obtain it.

9. Gramm-Leach-Bliley Act Privacy Notice

This section is the privacy notice the Gramm-Leach-Bliley Act requires us to give you. It describes the nonpublic personal information we collect, the reasons we may share it, and whether you can limit that sharing.

9.1 What we collect

We collect your nonpublic personal information when you apply for financing, give us your contact and business details, provide financial statements, bank records and tax returns, authorize a credit report, or communicate with us. We also receive it from lenders, credit bureaus and others as described in Section 3.3.

9.2 Why we can share for everyday business purposes without your consent

Federal law gives you the right to limit only sharing for nonaffiliates' marketing, affiliates' use of creditworthiness information, and joint marketing. We do none of those. Sharing with lenders to arrange the financing you requested, and with the service providers who help us do it, is a disclosure necessary to effect and service the transaction you asked for (16 C.F.R. § 313.14) and to companies performing services for us under contract (16 C.F.R. § 313.13).

9.3 Former clients

We follow this Policy for former clients as well as current ones.

10. Cookies and Similar Technologies

We keep the Site's use of browser storage deliberately small. The items below are the only ones we set, and none of them is used to track you across other websites.

10.1 Your choices

The cookie notice shown on your first visit lets you accept or decline analytics; declining disables every analytics identifier and beacon. You can change your choice at any time by clearing the Site's data in your browser, which shows the notice again. Browser controls also let you block or delete cookies and local storage, though blocking essential items may stop forms, Stephanie or the Partner Portal from working.

10.2 Global Privacy Control and Do Not Track

Because we do not sell or share personal information for targeted advertising, there is nothing for an opt-out preference signal to switch off; we treat a Global Privacy Control signal as a declined analytics choice where our systems can detect it. The Site does not respond to "Do Not Track" headers, for which no industry standard exists.

10.3 Third-party content

Pages may embed maps, videos or links hosted by other companies. Those companies may set their own cookies when the content loads, under their own policies. We do not use third-party advertising pixels or social-media tracking tags on the Site.

11. Communications and Your Choices

11.1 Telephone calls

Calls with MercFinancial may be recorded or monitored for quality, training, verification and compliance. Where a call is recorded, we tell you at the start. If you prefer not to be recorded, say so and we will continue by another channel.

11.2 Text messages

We send text messages only after you ask for them: by entering your mobile number and agreeing in a form, by telling Stephanie or a funding advisor that you would like updates by text, or by texting us first. Messages include verification codes, appointment confirmations and reminders, document requests, status updates and, where you have agreed, information about programs. Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop, and HELP for help. Consent to receive texts is not a condition of any service. Carriers are not liable for delayed or undelivered messages.

11.3 Email

Every marketing email carries an unsubscribe link that works immediately. Unsubscribing does not stop transactional messages about an active request, such as a document request or a lender's offer, which you can stop by withdrawing the request.

11.4 Postal mail

Write to the address in Section 20 to be removed from any mailing.

11.5 Do Not Contact

Tell us by any channel that you do not want to be contacted and we will honor it within ten business days, including for numbers on a national or state do-not-call registry and for businesses we reached through a lead list. We keep a minimal suppression record so the request sticks.

12. How We Protect Information

We maintain a written information-security program designed to meet the FTC Safeguards Rule and appropriate to the sensitivity of financial information. It includes:

• Encryption of information in transit (TLS 1.2 or higher) and at rest in our databases and document storage;
• Access controls: role-based permissions, multi-factor authentication for staff, row-level access rules in our database so each person sees only the records their role requires, and prompt removal of access when a role changes;
• Secure channels for sensitive documents: time-limited, single-purpose upload links and encrypted storage, instead of email attachments or chat;
• Monitoring and logging of access to records, automated security scanning of our systems and code, and bot and abuse protection on every public form;
• Vendor oversight: due diligence on every service provider that touches information, written contracts requiring safeguards, and periodic review;
• Testing and training: regular testing of our safeguards, and security and privacy training for every team member with access;
• Incident response: a documented plan to contain, assess and remediate security events, with the notifications Section 17 describes; and
• Retention and disposal: the schedule in Section 13, with secure deletion when a period ends.

No system is perfectly secure. We cannot guarantee that unauthorized access will never occur, and you share responsibility for protecting your own devices, credentials and verification codes. Never share a verification code with anyone, including someone who says they are from MercFinancial. We will never ask you for a password.

13. How Long We Keep Information

We keep information only as long as it serves the purpose it was collected for, and then for the period the law, our regulators, our lenders or a pending dispute require. Our general schedule is:

When you ask us to delete information (Section 14), we delete what we are not required to keep and restrict the rest to the purposes that require it.

14. Your Rights and Choices

Whatever state you live in, you may ask us to:

• Confirm and access the information we hold about you and receive a copy of it;
• Correct information that is inaccurate or incomplete;
• Delete information, subject to the retention obligations in Section 13;
• Export the information you gave us in a portable, commonly used format;
• Restrict or object to a particular use, including marketing;
• Withdraw consent you previously gave, without affecting what was done before you withdrew it; and
• Opt out of any sale, sharing for targeted advertising or profiling that produces legal or similarly significant effects. We do none of these, so there is nothing to opt out of today; if that ever changes we will update this Policy and give you the opt-out first.

14.1 How to make a request

Email info@Merc.Financial with "Privacy Request" in the subject line, call (830) 587-5022, or write to the address in Section 20. Tell us which right you are exercising and how to reach you. A business may make a request about its own information through an authorized officer.

14.2 Verification

We must be sure a request comes from you, or from someone you authorized, before we act on it. We will match the details you give us against our records and may ask for more, such as a code sent to the mobile number or email on file. For a request about a business, we confirm the requester's authority to act for it. We never ask for a password or a full government identifier to verify a request.

14.3 Authorized agents

Where the law allows, you may use an authorized agent. We will ask for proof of the agent's authority, such as a signed permission or power of attorney, and may confirm the request with you directly.

14.4 Timing, appeals and no retaliation

We respond within 45 days of receiving a request and may extend once by another 45 days when reasonably necessary, telling you why. There is no charge for up to two requests a year; we may charge a reasonable fee or decline a request that is manifestly unfounded or excessive. If we decline all or part of a request, we will tell you why and how to appeal; reply within 60 days with "Privacy Appeal" in the subject line and a different member of our team will review it within 45 days. If your appeal is denied, we will give you the contact details of your state attorney general. We will never deny you a service, charge you a different price or treat you differently for exercising a privacy right.

15. Additional Disclosures for Residents of Certain States

State privacy laws apply to us in different ways. Several exclude financial institutions subject to the Gramm-Leach-Bliley Act, or the information those institutions collect under it, and most protect individuals acting in a personal or household capacity rather than as a representative of a business. Where a law applies to you and your information, we honor the rights it gives, in addition to those in Section 14.

15.1 California

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.), applies to information we hold about you, this subsection is our notice at collection. In the preceding twelve months we have collected the categories of personal information listed in Section 3, from the sources listed there, for the business purposes listed in Section 4, and have disclosed them for business purposes to the recipients listed in Section 5. Information covered by the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act is exempt from the CCPA and is handled under those laws instead.

• We do not sell personal information and have not sold it in the preceding twelve months. We do not share personal information for cross-context behavioral advertising. We have no actual knowledge that we sell or share the personal information of anyone under 16.
• Sensitive personal information (government identifiers, account credentials, precise geolocation) is used only to arrange and service the financing you request, to verify identity, to prevent fraud and to comply with law, which are the purposes permitted without a right to limit under Cal. Civ. Code § 1798.121(d).
• You have the right to know, delete, correct, and to receive the specific pieces of personal information we hold, and the right not to be discriminated against for exercising them. Section 14 explains how to make a request and how we verify it.
• Shine the Light. We do not disclose personal information to third parties for their direct-marketing purposes, so no Cal. Civ. Code § 1798.83 request is necessary.
• Automated chatbot disclosure. Stephanie is clearly disclosed as an automated assistant, consistent with Cal. Bus. & Prof. Code § 17941.

15.2 Texas

The Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541) excludes financial institutions subject to the Gramm-Leach-Bliley Act and data subject to it, and does not cover individuals acting in a commercial context. To the extent it applies to any information we hold about you, you have the rights to confirm, access, correct, delete and obtain a portable copy of your personal data, to opt out of targeted advertising, sale and profiling (none of which we do), and to appeal our decision on a request to us and then to the Texas Attorney General, as described in Section 14. We do not sell sensitive data and would obtain your consent before ever doing so.

15.3 Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, Rhode Island and other states with comprehensive privacy laws

Subject to the exemptions each law provides for financial institutions and for information collected in a commercial context, residents of these states have rights to confirm, access, correct, delete and obtain a portable copy of personal data; to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects (none of which we do); and to appeal a decision on a request. Section 14 explains how to make a request and how appeals work. Where a state law requires consent before processing sensitive data, we obtain it in the application or authorization you sign.

15.4 Nevada

We do not sell covered information as defined in Nev. Rev. Stat. § 603A.340, so no opt-out is needed. Nevada residents may still submit an opt-out request to the contact in Section 20 and we will record it.

15.5 Vermont

We do not share nonpublic personal information with nonaffiliates for marketing, or creditworthiness information with affiliates, without the consent Vermont law requires.

16. Children

The Site and the Services are for businesses and adults. We do not knowingly collect information from anyone under 18, and we do not market to minors. If you believe a minor has given us information, contact us and we will delete it.

17. Security Incidents

If a security incident affects your information, we will investigate, contain it and notify you and any regulator in the manner and time each applicable breach-notification law requires, including Tex. Bus. & Com. Code § 521.053 and the FTC Safeguards Rule's notification requirement (16 C.F.R. § 314.4(j)). Where we are a service provider to a lender or other party, we notify that party so it can meet its own obligations. We will tell you what happened, what information was involved, what we have done and what you can do.

18. Visitors From Outside the United States

The Site is operated from the United States, and the Services are offered only to businesses operating in the United States. Information you give us is stored and processed in the United States, where data-protection laws may differ from those where you live. If you contact us from outside the United States, you do so on your own initiative and consent to that transfer and processing.

19. Links to Other Sites and Lender Policies

The Site links to lenders, government resources, news sources and other websites we do not control. Their privacy practices are their own. When you apply to a lender we introduce, the lender's privacy notice governs its handling of your information from that point, alongside this Policy for the information we keep.

20. Changes to This Policy

We review this Policy at least annually and update it when our practices, our vendors or the law change. The effective date at the top tells you when the current version took effect. For a material change that reduces your rights or expands how we use information already collected, we will give at least 30 days' notice by email to the address on file or a prominent notice on the Site before the change takes effect, and we will obtain your consent where the law requires it. Earlier versions are available on request.

21. How to Contact Us

Questions, requests and complaints about this Policy or our privacy practices can be sent to:

MercFinancial, Attention: Privacy
24 Greenway Plaza, Suite 1800L
Houston, Texas 77046
Email: info@Merc.Financial (subject line "Privacy Request")
Telephone: (830) 587-5022, Monday through Friday, 8:00 AM to 6:00 PM, and Saturday, 9:00 AM to 2:00 PM Central

If we cannot resolve a concern, you may contact the Federal Trade Commission at ftc.gov, the Consumer Financial Protection Bureau at consumerfinance.gov, or your state attorney general. Texas residents may contact the Office of the Attorney General of Texas, Consumer Protection Division, P.O. Box 12548, Austin, Texas 78711-2548.