Privacy Policy
- Broker reports from merchants
- We take no client data
- Analytics and cookies
- Corrections and removal
- Funding applications
- How we protect your info
- The MCAFax member app
- Contact
MCAFax ("we") runs mcafax.com. This page explains what we collect and how we use it. MCAFax is not a lender or a law firm, and nothing here is legal or financial advice.
Broker reports from merchants
Merchants have told us about brokers who contacted them. We publish broker information from these reports only in aggregate and anonymously: the shop, the number of reports, and the first and last report dates. We never show who made a report, their contact details, the text of a report, or any other data about the reporter or their business.
We take no client data
The MCAFax finance skill keeps your call log, letters and notes in your own Google Sheet. We do not receive them. When you look up a number or email, only that one identifier is sent to us, and we do not record who looked it up.
Analytics and cookies
We use Google Analytics 4 (GA4) to understand how visitors use the site. GA4 sets cookies and collects data such as pages viewed, time on page, referring site, device and browser type, and approximate location derived from your IP address. We use this data only in aggregate to improve the site. Learn how Google uses data from sites that use its services: https://www.google.com/policies/privacy/partners/ To opt out, you can install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout), or block or delete cookies in your browser settings.
Corrections and removal
Anyone, including a listed business, can ask us to correct or remove a directory entry, or remove a phone number or email (for example, a reassigned number). Use the forms at /directory/correction and /lookup/dispute, or email us. We acknowledge within 2 business days and decide within 5 business days. Disputed items are hidden while we review. Outcomes are logged without the requester's personal details.
Funding applications
This section covers an application you send from mcafax.com/apply. It is separate from the member app described below.
What we collect depends on the questions that applied to your business, plus the contact details you choose to send:
- Estimate answers: whether the business is open and making sales, time in business, industry, state, amount, use of funds, how soon you need it, monthly deposits, how customers pay, average daily balance, days the balance is below zero or close to it, returned or bounced payments, credit range, existing cash advances and the follow-up questions about them, derogatory items, collateral, and (when a grant question applies) team size and the other grant follow-ups that question asks. When deposits, average balance, days below zero, or returned payments are read from bank statements you upload, we show you those figures to confirm instead of asking for them again. We do not read a credit range or a legal fact from a statement.
- Business name, your name, and email.
- Mobile phone, only if you type one. It is optional.
- How you asked us to follow up: email, a private link on your MCAFax estimate page, or a phone call.
- Best time to reach you, and whether you opted in to texts about this application, only if you gave a phone number.
- A lender you named, if you typed one, and any notes you added.
- Lenders you choose from the review list, the exact names shown to you, the consent wording, and the time you agreed. That record is labeled requested lenders / not yet sent. We do not email those lenders.
- The consent you gave, and the exact wording shown to you (email only, or email and phone).
We also store the page or campaign source that brought you to the application, such as a landing page or a link label. That source is not your contact details.
We use this to review this application and to contact you about it in the way you asked. We do not use it for advertising.
Who touches it:
- Google Cloud Firestore stores the application (loanApplications) and a separate consent record (consentRecords). Google processes that data only to host MCAFax's database.
- A PDF of the application is emailed to info@mcafax.com through Google Workspace. That message goes to MCAFax. It is not sent to a lender or a broker.
- Netlify hosts mcafax.com and runs the submit function, so the submission passes through Netlify.
- Google Analytics measures how the site is used. The funding_apply_submit event records a source label only. It does not include your name, email, or phone.
- Bank statements you upload are stored so MCAFax can review this application. They are not attached to the email copy of the application. To ask us to delete them, email info@mcafax.com.
- Google's Gemini API does not receive a funding application unless you opt in to outside statement reading and MCAFax has turned that reader on. It is off. While it is off, checking the opt-in does not send your statements or the rest of the application. If it is later turned on, MCAFax's server would send Google's Gemini API only the statement text you opted in to send, for the purpose of reading deposits, average balance, days below zero, and returned payments. The browser does not hold a Gemini key. This policy does not state a retention period for a reader that is not on. Gemini is also used for the member-app assistant, for prompt and blog tools, and for cover images. Those features are separate from the apply submit path.
We keep a closed or declined application for 24 months. Consent records, including a text opt-in and a STOP, are kept for 4 years.
To ask us to delete your information, email info@mcafax.com. We delete personal data we do not have to keep for a legal obligation.
MCAFax may earn a referral fee if, with your written permission, we introduce you to a lender you name. We never sell your information, and we never share your phone number or email with lenders or brokers.
How we protect your info
The application is stored in MCAFax's Google Cloud Firestore database. A PDF copy is emailed only to info@mcafax.com. Uploaded bank statements are stored for this application and are not included in that email. Before we store notes, we remove shapes that look like a Social Security number, an EIN, or a card number. The apply page and the submit endpoint use HTTPS. Gemini does not receive the application unless you opt in to statement reading and that reader is turned on. It is off. We do not send the application to a lender unless you later give separate written permission that names that lender.
The MCAFax member app
The sections above cover the public site: caller lookup, the MCAFax finance skill, and funding applications. The rest of this policy covers the MCAFax member app (the account, the letters and the shared broker database).
What we collect
Account and business information: your email address, name, business name, and business address, used to create your account and to fill in the letters you send.
Broker activity you log: broker emails and phone numbers you report, call logs, reviews you write, and scam reports you submit.
Letters: the letters you queue and send, including a copy of each sent letter and its delivery identifiers, so you have a verifiable paper trail.
Chat messages: conversations with the MCAFax assistant are stored so our team can review them and step in to help.
Gmail access
If you connect Gmail, we request Google's send-only permission (gmail.send) plus your email address. MCAFax cannot read, search, or access your existing email. The connection is used for exactly one thing: sending letters you have approved, from your address. You can revoke access at any time in the app or in your Google account settings.
MCAFax's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or as required by law.
What other members can see
MCAFax is a shared database: broker records are built from member reports. When you log a broker or submit a review, the broker's business contact details, aggregate report counts, review content, and AI-generated review summaries may be visible to other members (and, in limited teaser form, to visitors using the broker check). Your identity is not attached to what other members see: reports and reviews are shown without your name, email, or business name.
Scam-story submissions are private: they go to the MCAFax team only and are never published.
What we don't do
We do not sell your personal information. We do not share it with brokers. We do not use it for advertising. Your information is used to operate the service: generating and sending your letters, maintaining the shared broker database, and supporting your account.
Service providers
We run on Google Firebase and Google Cloud (database, authentication, hosting of backend functions), Netlify (website hosting), Google Analytics (site measurement, see "Analytics and cookies" above), and Google's Gemini API (the chat assistant and AI summaries of broker reviews). Each processes data only to provide their service to us.
Retention and deletion
We keep your letters and contact logs while your account is active because they are your evidence record. You can disconnect Gmail at any time, which deletes our stored sending tokens. To delete your account and associated personal data, email info@mcafax.com from your account email; we will delete personal data not needed to comply with legal obligations. Broker records built from member reports may persist in de-identified form.
Security, children, changes
Data is stored on Google's infrastructure with access controls; Gmail credentials are never seen by MCAFax (Google issues us a limited token). The service is for business owners and is not directed at children under 16. We may update this policy; changes will be posted here with a new "last updated" date.
Contact
info@mcafax.com Corrections: corrections@mcafax.com Disputes about a number or email: disputes@mcafax.com