Privacy

This page says what this site collects, who gets it, how long it is kept and how to make it stop. It is written to be read, not to be survived.

Effective November 5, 2026.

Who is responsible

Alex (Alejandro) Espinoza, NMLS 1110038, a licensed mortgage loan originator sponsored by Coastal Pacific Lending, Inc., NMLS 965211, at 1100 Town & Country, Suite 1250, Orange, CA 92868. He runs this site and he decides what happens to what it collects, so he is the one answerable for it.

Write to privacy@offtheloan.com about anything on this page. That address reaches him.

What this site collects

No personal details until you submit the form. Nothing on this site asks who you are, and nothing about you is recorded, until you fill it in and send it. Reading the site sends only what the analytics section below describes, and only when analytics is on.

What you type

Your name, email address and phone number.
The state the property is in, what your situation is, where the decree has got to, when you need this sorted, and the best time to call.
Anything you type into the message box.
The reference of the professional who sent you, when you arrive on their link.
The figures from the calculator, but only if you press the button that sends them.

What the server records with it

Your IP address and your browser user agent, captured by the server when you submit.
The time you submitted, the version of the consent text on the page you read, and an id for the request.

What is never asked for

No form on this site asks for your Social Security number, date of birth, income or account numbers from any form on this site, your home address. If a page ever appears to, it is not this site.

The calculator

The buyout calculator runs entirely in your browser. The home value, the balance, your income, your debts and the support figures are not sent anywhere and are not stored anywhere while you use it. They reach Alex only if you press the button that carries them to the form, and you can see them on the form before you send it.

When you tick the box and submit, the site writes a record of exactly that: the information you entered, the version of the consent wording that was on the page you read, a fingerprint of that wording, your IP address, your browser user agent and the time. It is written before anything is emailed or sent anywhere else, and if it cannot be written the submission fails rather than going ahead without it.

That record exists for your protection as much as his. It is the thing that can show what you were shown and what you agreed to, rather than leaving it to anyone's memory.

Who receives it

This is the complete list. Nothing is sold, nothing is rented, and nothing goes to an advertising network or a lead broker.

Netlify: Receives the whole request, together with your IP address, your browser user agent, the version of the consent text you agreed to, and the time. Netlify hosts this site and stores the consent record. The record is what proves what you agreed to and when, which is the reason it exists.
Resend: Receives your name, email address and phone number, inside the two emails. Resend delivers the notification to Alex and the confirmation to you.
Alex's own email inbox: Receives the notification, so your name, email address, phone number and what you wrote. Alex reads these himself and replies to you from the same place.
Google Analytics: Receives a page view each time you open a page, and an event when you move through the calculator, send its figures to the form, move through a step of the form, submit it, or click the booking link. Those events can carry the calculator verdict, which is one of three words, and the reference of the professional who sent you. They never carry your name, your email address, your phone number or your IP address. Alex uses it to see which pages people read and where they give up on the form.; A measurement ID is configured for this build, so the events above are being sent.
Coastal Pacific Lending, Inc.: Receives your information, but only if you choose to go ahead with an application. Coastal Pacific is the lender Alex is sponsored by. Asking a question here does not send anything to them.; Nothing has been sent to the sponsor by this site. It happens only when you decide to apply, and you will know when you do.
A customer records system: Receives the whole request, as it was submitted. Alex keeps track of who asked what, so a question does not get lost and a reply is not sent twice.; Not connected yet. While it is not, the request lives in the consent record and in the email, and nowhere else. When it is connected this page will name it before it receives anything.

What the analytics sees

Google Analytics is on. Google receives a page view every time you open a page, and an event when you move through the calculator, send its figures to the form, move through a step of the form, submit it, or click the booking link. Those events can carry the calculator verdict, which is one of three words, and the reference of the professional who sent you. They never carry your name, your email address, your phone number or your IP address.

The server's own logs are the other thing that sees a submission, and they see nothing personal: the request id, the state and whether it worked. A test captures every line the code can emit, on the success path and on each failure path, and asserts none of them carries a name, an email address, a phone number or an IP address.

How long it is kept

Your consent record is kept for 48 months from the day it is created, then deleted. A consent record is the proof that you agreed to be contacted, and the law allows a claim about an unwanted call to be brought for four years, so Alex keeps that proof for as long as he could be asked to produce it. Keeping it is as much your protection as his: it is the record of what you were actually shown and what you actually agreed to.

Everything else is kept for 24 months and then deleted: the operational records of what the site did with your enquiry, such as a note that a handover to his customer records system failed and had to be done by hand. None of that is evidence of anything, so it is not kept as long.

A nightly backup copy of both is kept for 35 days, so that a mistake on Alex's side can be undone without losing your record. A backup is not an archive: it is deleted on its own 35 day clock, which means a deleted record can survive in a backup for at most 35 days after the window above and no longer.

Email is a separate matter. A message in Alex's inbox is kept as long as he keeps his email, the same as any correspondence with anyone, and you can ask him to delete it.

How to make it stop

Reply STOP to any text to stop the texts. Reply HELP for help.
Tell Alex to stop calling, in any words, on a call or in writing, and he will.
Email privacy@offtheloan.com to withdraw your agreement to be contacted, to ask what is held about you, or to ask for it to be deleted.

Withdrawing your agreement stops the contact. The consent record itself is kept for the window above even after you withdraw, because deleting the proof of what you agreed to the moment you withdraw would leave neither of you able to show what happened. If you want that record deleted too, say so and it will be.

If you live in California

The California Consumer Privacy Act gives you rights over the personal information a business holds about you. Those rights are:

To know what is collected about you, where it came from, why, and who it goes to.
To get a copy of it.
To have it corrected if it is wrong.
To have it deleted, with the narrow exceptions the law allows.
To opt out of the sale or sharing of it. Nothing on this site is sold or shared for advertising, so there is nothing here to opt out of, and this is said plainly rather than left to be inferred.
Not to be treated differently for exercising any of them.

To use any of them, email privacy@offtheloan.com. You will get an answer within 45 days, which is what the law allows, and usually sooner. You may ask through an authorized agent. Alex may need to check that the request really came from you, which for most people means replying from the email address on the request.

The categories above, in the law's own terms, are identifiers and commercial information. There is no sensitive personal information: this site never asks for a Social Security number, a date of birth, an account number or a precise location.

Changes to this page

If a new recipient is ever added, this page is changed in the same release that adds it, not afterwards. That is enforced in the code: the list above is generated from the same file the system is built against, and a test fails if the two disagree.