Privacy Policy | 4 Pillar Funding

Last updated: August 27, 2026

1. Information We Collect

Personal Information

When you submit a consultation request, apply for capital, or otherwise interact with our services, we may collect:

Full name, email address, phone number
Company name, title, and role
Business address and mailing address
Social Security Number (SSN) or Employer Identification Number (EIN)

Business and Financial Information

To evaluate capital facility options, we may collect:

Business financial statements (P&L, balance sheet, cash flow)
Bank statements (typically 3–6 months)
Tax returns (business and/or personal)
Accounts receivable and accounts payable aging reports
Revenue data, industry classification, and years in operation
Existing debt schedules and UCC filings

Financial Documents

Documents you upload or transmit to us (bank statements, tax returns, contracts, purchase orders) are treated as sensitive financial information and handled according to the security and retention standards described below.

Identifiers and Internet or Other Electronic Network Activity

When you visit our website, we and the analytics and advertising providers described in Section 4 automatically collect:

IP address (anonymized where possible)
Browser type, operating system, device type, and device information
Pages visited, time on page, referring URL, and referral source
Click patterns, scroll depth, and other website interactions
Advertising identifiers and cookie identifiers
Geographic region (city/state level)

Cookies and Tracking Technologies

We use cookies, pixels, tags, and similar technologies to:

Ensure proper website functionality and remember your privacy choices (essential cookies)
Analyze site traffic and user behavior (analytics cookies)
Measure advertising performance, attribute inquiries to advertising, build advertising and retargeting audiences, and deliver relevant advertising on other websites and platforms (advertising cookies and pixels)

You can control analytics and advertising cookies at any time through the “Your Privacy Choices” link in the footer of every page of this website, and additionally through your browser settings. Disabling cookies may limit certain website features. Advertising technologies are described in more detail, together with your opt-out choices, in Section 4.

2. How We Use Your Information

We use the information we collect to:

Respond to consultation requests and assess preliminary fit for capital facilities
Match your business with appropriate capital partners and facility structures
Communicate with you about facility options, documentation needs, and status updates
Process and evaluate applications submitted through our platform
Send transactional communications (confirmations, updates, notifications)
Send marketing communications (with your consent), including newsletters, capital insights, and product updates
Improve our website, services, and user experience
Analyze site usage trends and optimize content
Measure and attribute the performance of our advertising, and build advertising and retargeting audiences, as described in Section 4
Comply with legal and regulatory obligations
Detect and prevent fraud or unauthorized access

3. Information Sharing and Third Parties

We do not sell your personal information for monetary consideration, and we do not sell inquiry or application data to third-party lead buyers. We may share information in the following circumstances:

Capital partners: With your explicit consent, we share business and financial information with lending partners solely to evaluate and structure a facility for your business.
Service providers: We use third-party vendors (described below) who process data on our behalf under contractual obligations to protect your information.
Advertising and analytics providers: As described in Section 4, we allow advertising and analytics providers (such as Google and Meta) to collect limited website and device information — identifiers, browser/device information, pages visited, referring URLs, advertising and cookie identifiers, and website interactions — through cookies, pixels, and similar technologies for analytics, advertising measurement and attribution, and the creation of advertising and retargeting audiences. As also described in Section 4, we may provide these providers with hashed contact identifiers from our customer and lead records to create matched advertising audiences.
Legal requirements: We may disclose information if required by law, regulation, subpoena, or court order.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
Protection of rights: We may share information to protect our rights, safety, or property, or that of our users or the public.

4. Advertising, Retargeting, and Your Privacy Choices

We use website analytics and online advertising to reach business operators who may benefit from our services and to measure whether that advertising works. To do this, we and our advertising providers use cookies, pixels, tags, software development kits, and similar technologies on the public pages of this website for:

Website analytics
Advertising measurement and attribution
Advertising cookies and pixels
Creation of advertising and retargeting audiences

The advertising and measurement providers we use or may use include:

Google (Google Analytics and Google Ads, including conversion measurement and remarketing)
Meta (the Meta Pixel supporting advertising on Facebook, Instagram, and other Meta services)
Other similar advertising, measurement, or attribution providers we may engage from time to time

These providers may collect or receive identifiers and internet or other electronic network activity information: IP address, browser and device information, pages visited, referring URL, advertising identifiers, cookie identifiers, and website interactions. Each provider processes this information under its own privacy policy, and may use it to match your browser or device to an account you hold on its platform.

Hashed contact information for conversion measurement. If you submit our public consultation form while Advertising cookies are allowed, Google’s “enhanced conversions” and Meta’s “advanced matching” features may transmit contact details you entered on that form — such as your email address or phone number — to Google or Meta in hashed (pseudonymized) form, solely to improve the accuracy of advertising conversion measurement and audience matching. This does not occur when you have opted out of Advertising through Your Privacy Choices or when we detect a Global Privacy Control signal.

Matched advertising audiences from our records. With the first-party consent we obtain when you inquire or do business with us, we may also share limited contact information from our customer and lead records — such as your email address or phone number — with advertising providers such as Google and Meta in hashed (pseudonymized) form to create matched, custom, or similar advertising audiences. We use these audiences to show our advertising to existing contacts, to exclude existing clients from acquisition advertising, and to allow advertising platforms to identify new audiences with similar characteristics (“lookalike” audiences). Only contact identifiers are used for this purpose; we do not upload application contents, financial details, or underwriting information. Under some state privacy laws, this activity may constitute “sharing,” “targeted advertising,” or “cross-context behavioral advertising,” and you may opt out as described below.

What we do not send to advertising providers. Other than the hashed contact information described above, we do not transmit the contents of consultation or application form fields, uploaded documents or their filenames, Social Security Numbers, EINs, bank or financial account information, credit information, requested funding amounts, revenue figures, underwriting information, approval or decline decisions, or any similar sensitive financial information through advertising pixels, advertising tags, or advertising events. Advertising technologies are not used on our application, client, or partner portals or other authenticated experiences.

“Sale,” “sharing,” and targeted advertising under state law. We do not sell personal information for monetary consideration and we do not sell inquiry or application data to third-party lead buyers. However, under some state privacy laws, making limited website and device information available to advertising providers for retargeting, measurement, or audience creation may itself be considered a “sale,” “sharing,” “targeted advertising,” or “cross-context behavioral advertising,” even though no money changes hands. We treat it that way for purposes of your rights below, and we provide the opt-out mechanisms these laws require.

How to Opt Out

Your Privacy Choices: Use the “Your Privacy Choices” link in the footer of every page of this website to turn off Analytics and/or Advertising / Targeted Advertising for this browser. Advertising technologies do not load while your opt-out is in effect, and your choice takes effect immediately without creating an account.
Global Privacy Control (GPC): We honor the Global Privacy Control browser signal, and other legally required universal opt-out preference signals where applicable, as a request to opt out of targeted advertising and the “sale” or “sharing” of personal information for the browser sending the signal. When we detect a GPC signal, advertising technologies do not load and the Your Privacy Choices panel reflects the opt-out.
Platform controls: You can also manage advertising preferences directly with providers, for example Google’s Ads Settings at adssettings.google.com, Meta’s ad preferences within your Facebook or Instagram settings, and the industry opt-out tools at optout.aboutads.info.
Email: You may also submit an opt-out request to operations@4pillarfunding.com with “Privacy Request” in the subject line, including a request to be excluded from matched advertising audiences created from our customer and lead records. Browser-based controls such as the Your Privacy Choices panel and Global Privacy Control apply to this browser only; an email request is the way to opt out of audience matching based on your contact information.

Opting out of advertising cookies does not stop you from seeing ads; it means the ads you see are less likely to be based on your visits to this website.

5. CCPA/CPRA Compliance (California Residents)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your information.

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, complying with legal obligations, internal uses reasonably aligned with your expectations).

Right to Opt Out of Sale or Sharing

You have the right to opt out of the “sale” of your personal information and of the “sharing” of your personal information for cross-context behavioral advertising. As explained in Section 4, we do not sell personal information for monetary consideration and we do not sell inquiry or application data to third-party lead buyers; however, our use of advertising cookies and pixels may constitute “sharing” (and in some cases “selling”) under the CCPA/CPRA. The categories involved are limited to identifiers and internet or other electronic network activity information collected from our public website and, for matched advertising audiences as described in Section 4, hashed contact identifiers (such as email address and phone number) from our customer and lead records.

“Your Privacy Choices” and Opt-Out Preference Signals

To exercise this opt-out, use the “Your Privacy Choices” link in the footer of every page of this website, or any of the other methods described in Section 4. We also honor the Global Privacy Control (GPC) signal and other legally required opt-out preference signals as a valid request to opt out of sale/sharing for the browser sending the signal. If you believe your data has been shared contrary to your expressed choices, contact us at operations@4pillarfunding.com.

Right to Correct

You have the right to request correction of inaccurate personal information that we maintain about you.

Right to Limit Use of Sensitive Personal Information

You may direct us to limit the use of sensitive personal information (such as SSN or financial account data) to purposes necessary to provide the services you requested.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. Exercising these rights will not result in different pricing, quality of service, or denial of services.

How to Submit a Request

To exercise any of these rights, contact us at operations@4pillarfunding.com or write to us at the address below. We will verify your identity before processing your request and respond within 45 days. Opt-outs of sale/sharing and targeted advertising made through the “Your Privacy Choices” link or a GPC signal take effect without identity verification.

Residents of Other States

If you reside in a state with a comprehensive privacy law — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others — you may have the right to opt out of “targeted advertising” and the “sale” of personal data as those laws define them, along with rights of access, correction, and deletion. The mechanisms in Section 4, including the “Your Privacy Choices” link and recognized universal opt-out preference signals such as GPC, are how we honor targeted-advertising opt-outs under these laws. Other requests may be submitted to operations@4pillarfunding.com.

6. Data Retention Schedule

Consultation and client data: Retained for 3 years from last interaction, then securely deleted unless an active engagement or legal obligation requires longer retention.
Financial documents (unfunded): If your application is not funded or you do not proceed, uploaded financial documents (bank statements, tax returns, etc.) are securely destroyed within 90 days.
Financial documents (funded): Retained for the duration of the facility and any applicable regulatory retention period.
Analytics data: Retained for 26 months, then aggregated or deleted.
Privacy choices: Your analytics/advertising preference is stored in your browser for up to 12 months so we can keep honoring it, and is refreshed when you update your choices.
Email marketing data: Retained until you unsubscribe, at which point your email is suppressed from future sends but retained on the suppression list to honor your preference.

7. Third-Party Service Providers and Advertising Partners

We use the following categories of third parties to operate our business:

Website analytics: To understand traffic patterns, user behavior, and site performance (e.g., Google Analytics or similar).
Advertising and measurement: To measure and attribute advertising and build advertising/retargeting audiences (e.g., Google Ads, Meta, or similar providers), as described in Section 4.
Email marketing: To send newsletters, capital insights, and transactional communications (e.g., Mailchimp, ActiveCampaign, or similar).
Customer relationship management (CRM): To manage client communications, pipeline tracking, and relationship data (e.g., HubSpot, Salesforce, or similar).
Cloud storage and document management: To securely store and transmit financial documents (e.g., AWS, Google Cloud, or similar enterprise-grade providers).
Payment processing: If applicable, to process fees or payments securely.
Communication tools: Phone, SMS, and video conferencing platforms to facilitate consultations.

Service providers that process data on our behalf are contractually obligated to protect your data and use it only for the purposes we specify. Advertising and measurement providers such as Google and Meta may also process the limited website and device information described in Section 4 for their own purposes under their own privacy policies; that is why we provide the opt-out choices in Section 4.

8. Data Security Measures

We implement industry-standard security measures to protect your information:

Encryption: All sensitive data, including SSNs and financial account numbers, is encrypted at rest using AES-256 encryption and in transit using TLS 1.2+.
Secure transmission: Documents are transmitted through encrypted channels. We never request sensitive information via unencrypted email.
Access controls: Access to personal and financial information is restricted to authorized personnel on a need-to-know basis, with role-based permissions and multi-factor authentication.
Regular audits: We conduct periodic reviews of our security practices and vendor compliance.
Incident response: We maintain procedures to detect, respond to, and notify affected parties in the event of a data breach, in compliance with applicable laws.

9. SMS and Marketing Communications

If you provide your phone number and consent to receive communications:

We may send SMS/text messages related to your consultation status, document requests, or facility updates.
We may send marketing messages about capital solutions, industry insights, or service offerings.
Message frequency varies. Message and data rates may apply.
You may opt out of SMS communications at any time by replying STOP to any message or contacting us directly.
Opting out of marketing SMS will not affect transactional messages related to an active engagement.

We will never share your phone number with third parties for their own marketing purposes.

10. Financial Information Handling

Given the sensitive nature of financial advisory services, we maintain heightened protections for financial data:

Social Security Numbers: SSNs are encrypted immediately upon receipt and stored in isolated, encrypted databases. Access is limited to personnel directly involved in underwriting evaluation.
Bank statements: Stored in secure, enterprise-grade cloud storage with encryption at rest and strict access controls. Destroyed per our retention schedule (90 days if unfunded).
Tax returns and financial statements: Handled with the same security protocols as bank statements. Never shared with third parties without your explicit written consent.
Document destruction: When documents reach their retention limit, they are permanently and irrecoverably deleted from all systems, including backups, within 30 days of the retention expiration.

11. Children's Privacy

Our services are intended for business owners and authorized representatives who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If we become aware that we have inadvertently collected information from a person under 18, we will take immediate steps to delete that information. If you believe a minor has provided us with personal information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last updated" date at the top of this page
Post a notice on our website for a reasonable period
Notify you via email if the changes materially affect how we handle your data (for existing clients)

Your continued use of our website and services after changes are posted constitutes acceptance of the revised policy.

13. California Residents — Additional Rights

In addition to the CCPA/CPRA rights described in Section 5, California residents have the following rights:

Shine the Light: Under California Civil Code Section 1798.83, you may request information about personal data we have disclosed to third parties for those third parties' own direct marketing purposes. We do not disclose personal information such as names, email addresses, or phone numbers to third parties for their own direct marketing.
Do Not Track: Our website does not currently respond to "Do Not Track" (DNT) browser signals, for which no common industry standard exists. DNT is distinct from the Global Privacy Control (GPC) signal, which we do honor as an opt-out of sale/sharing and targeted advertising as described in Sections 4 and 5. You may also opt out of analytics and advertising tracking at any time through the “Your Privacy Choices” link in the footer.
Authorized agents: You may designate an authorized agent to submit CCPA requests on your behalf by providing written authorization and verifying your identity.

14. Contact Information

For questions, concerns, or requests related to this Privacy Policy or your personal data, contact us:

4 Pillar Funding
268 Broadway, Suite 201
Saratoga Springs, NY 12866
Phone: 518.520.4552
Email: operations@4pillarfunding.com

For CCPA/CPRA requests, please include "Privacy Request" in the subject line of your email and specify which right you wish to exercise. We will respond within 45 days of receiving a verifiable request.