Privacy Policy

This Privacy Policy explains how rebel iQ, Inc. collects, uses, discloses and protects personal information, and the choices and rights you have. It applies to leadpops.com, rebeliq.com, rebeliq.ai, our customer applications (including app.leadpops.com and app.rebeliq.ai), and any other site or service of ours that links to this policy. This policy is part of our Terms of Service.

The short version

• We do not sell leads. We build lead-generation technology for mortgage and real estate professionals. The leads our customers capture with our technology belong to our customers, and we never sell them, rent them or give them to anyone else.
• We do not sell your personal information for money. Our websites do use advertising cookies and pixels from companies such as Google and Meta, as most websites do. Some state laws call that a "sale" or "sharing" of personal information even when no money changes hands, so we treat it that way and give you an easy way to turn it off. Your browser's Global Privacy Control signal turns it off automatically.
• We play two roles. For people who visit our websites, ask us for a demo or become our customers, rebel iQ decides how personal information is used, and this policy explains it. For people who fill out a form on a page that one of our customers built with our technology, that customer decides, and we process the information only on the customer's behalf (see "Information we process for our customers").
• You have rights, wherever you live in the United States. You can ask to know, get a copy of, correct or delete your personal information, and opt out of advertising cookies, marketing email, and calls and texts. Use our privacy request form, email privacy@rebeliq.com or call (855) 532-3767.

Contents

1. Who we are
2. Notice at collection: what we collect, why, and how long we keep it
3. Where we get personal information
4. How we use personal information
5. How we disclose personal information
6. Cookies, pixels and similar technologies
7. Global Privacy Control and Do Not Track
8. Information we process for our customers
9. Your privacy rights
10. How to submit a request
11. Additional information for California residents
12. Additional information for residents of other states
13. Text messages and phone calls
14. Marketing email
15. Job applicants
16. Security
17. Children
18. Visitors outside the United States
19. Changes to this policy
20. Contact us

1. Who we are

rebel iQ, Inc. ("rebel iQ," "we," "us" or "our") is headquartered at 4747 Morena Blvd. #375, San Diego, CA 92117. LeadPops and rebel Ai are brands of rebel iQ, Inc. We provide marketing and lead-generation software, websites, landing pages, calculators and related services to mortgage professionals, real estate professionals and other businesses ("customers").

2. Notice at collection: what we collect, why, and how long we keep it

This section is our notice at collection. It covers personal information we collect for our own purposes when you visit our websites, contact us, request a demo, subscribe to our content, use our free tools, or become a customer. It does not cover information we process for our customers (see section 8).

We have collected the categories below in the last 12 months. The category names are the ones California law uses.

We do not store financial account or payment card numbers; payment details are entered directly with our payment processor. We do not collect Social Security numbers, driver's license numbers, precise geolocation, biometric information, health information, or information about racial or ethnic origin, religion, sexual orientation, citizenship or immigration status for our own purposes. We do not use or disclose sensitive personal information for any purpose other than those permitted by California regulations (Cal. Code Regs. tit. 11, § 7027(m)), so we do not offer a separate right to limit its use.

Form information we save before you finish. Our demo request form saves your progress as you go. If you enter your NMLS ID, we immediately use it to look up your public licensing record and professional information from mortgage industry data providers, so we can prepare for your demo. We keep what you entered, what we found, and how far you got, even if you do not finish the form, and a member of our team may contact you about the request you started. We do not save the name, email or phone number you type until you submit the form.

How we decide how long to keep information. We keep personal information only as long as reasonably necessary for the purposes described in this policy. When deciding, we consider whether we have an active or possible business relationship with you; whether you have asked us to delete it; how sensitive it is; our legal, tax, accounting and audit obligations; and whether we need it to resolve disputes, enforce agreements or prevent fraud. When we no longer need it, we delete it or de-identify it so it can no longer reasonably be linked to you. If a customer deletes their account, we delete or anonymize the account's personal information within 30 days, except where we must keep it by law or for legitimate business purposes such as preventing fraud or resolving disputes. We keep records of privacy requests for at least 24 months, as the law requires. If you unsubscribe or opt out, we keep a minimal record (such as your email address or phone number) so we can keep honoring your choice.

3. Where we get personal information

• From you, when you fill out a form, request a demo, create an account, subscribe to our content, use a free tool such as our website grader, ROI calculator or growth report, answer questions on our sites, email or call us, or meet with us. Customers also give us the content they create in our applications, such as pages, forms, calculators and SWOT analyses. When you give us information, please make sure it is accurate and that you are authorized to give it; tell us if anything changes and we will correct it.
• Automatically, from your browser or device when you use our sites and open our emails, through cookies, pixels and similar technologies (section 6).
• From public sources, such as the NMLS Consumer Access licensing database, state licensing records, company websites, professional directories and social media profiles that are publicly available.
• From mortgage and real estate industry data providers that supply professional information, such as licensing, employer, contact details and loan production, about mortgage and real estate professionals.
• From a business-information provider that helped us understand which companies visited our sites. We stopped using it in October 2026.
• From our customers and partners, for example when a customer refers you to us or when a partner introduces us.

How we find businesses to contact. We research mortgage and real estate professionals and companies using public sources and industry data providers, to identify businesses that may benefit from our services, and we may contact them by email. Every marketing email includes an unsubscribe link, and you can ask us to delete the information we hold about you at any time (section 9).

4. How we use personal information

We use personal information we collect for our own purposes to:

• respond to your requests and questions, schedule and hold demos and calls, and prepare proposals;
• provide, operate, maintain and support our sites, applications and services;
• create and manage customer accounts, process payments, and keep business records;
• send transactional and service messages, such as confirmations, receipts and security notices;
• market our services to you by email, phone, text (with your consent where required) and advertising, and measure how well that marketing works;
• understand how our sites are used and improve our sites, products and services;
• research businesses that may benefit from our services;
• detect, prevent and respond to security incidents, fraud, spam and abuse;
• comply with law, respond to legal requests, and enforce our terms; and
• as described to you when we collect the information, or with your consent.

We may create de-identified or aggregated information, such as the total number of leads generated across our platform, that does not identify any person. We keep de-identified information in de-identified form, do not attempt to re-identify it, and require anyone we share it with to do the same.

Automated decisions and profiling. We do not use personal information to make automated decisions that produce legal or similarly significant effects about you, such as decisions about credit, housing, employment, insurance or access to essential goods or services. We use automated tools to help route demo requests to the right team and prioritize follow-up; a person makes the decisions about how we work with you.

AI and model training. We use artificial intelligence services from vendors to help process information, for example to analyze a website you ask us to grade or to help draft content in our applications. These vendors act as our service providers and may not use the information to train their own models. We do not use personal information to train large language models or other AI models, and we do not sell personal information for that purpose.

5. How we disclose personal information

We do not sell leads, and we do not sell personal information for money. We disclose personal information only as described here.

• Service providers. Companies that perform services for us under contracts that limit how they can use the information, including website and application hosting; databases and cloud storage; customer relationship management and marketing automation; email and text message delivery; workflow automation; scheduling; payment processing; analytics; artificial intelligence services; data enrichment and research providers; and professional advisers such as lawyers and accountants. In the last 12 months we disclosed identifiers, customer records information, commercial information, internet activity, approximate geolocation, audio or visual information, professional information, inferences and account credentials to service providers for business purposes.
• Advertising partners. Companies such as Google, Meta, LinkedIn and HubSpot collect online identifiers, approximate location and browsing activity on our sites through cookies and pixels, to show you ads and measure them. Until October 2026, Apollo.io also did this to identify which companies visited our sites. Under some state laws this is a "sale" or "sharing" for targeted advertising. You can opt out at any time (section 7 and privacy choices).
• Our affiliates and brands. Information may be shared between LeadPops, rebel Ai and other businesses under common ownership with rebel iQ, Inc., and they will handle it consistently with this policy.
• At your direction. When you ask us to share information, for example by connecting a third-party account or integration. Information you share with a third-party service this way is governed by that service's own terms and privacy policy, and we are not responsible for its practices.
• Legal and safety. To comply with law, regulation, legal process or government requests; to enforce our agreements; and to protect the rights, property and safety of rebel iQ, our customers and others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, subject to the commitments in this policy. We will notify you by email or a prominent notice on our sites before your information becomes subject to a different privacy policy.

We do not disclose personal information to third parties for their own direct marketing purposes.

6. Cookies, pixels and similar technologies

We and our partners use cookies, pixels, tags, local storage and similar technologies on our sites and in our emails. These technologies let companies collect information about your activity on our sites over time and, for some partners, across other websites.

Google Analytics. We use Google Analytics, including its advertising features, to understand how our sites are used. Google and other vendors may use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google advertising cookies) together. We do not combine personally identifiable information with information collected through Google advertising products unless the law and Google's policies allow it. You can opt out of Google Analytics advertising features through Google's Ads Settings, the Google Analytics opt-out browser add-on, or the Network Advertising Initiative opt-out.

You can turn off advertising cookies and pixels on our sites with the setting on our privacy choices page, or automatically with Global Privacy Control (section 7). You can also block or delete cookies in your browser settings; some features may not work without strictly necessary cookies. To learn more about these partners' practices and controls, see Google's How Google uses information from sites that use its services, Meta's ad preferences, and LinkedIn's advertising settings.

7. Global Privacy Control and Do Not Track

Global Privacy Control (GPC). GPC is a setting in some browsers and extensions that tells websites you want to opt out of the sale and sharing of your personal information. We honor it for every visitor, wherever you live. When we detect a GPC signal:

• our sites do not load our advertising cookies and pixels in that browser, and we treat the signal as a request to opt out of sale, sharing and targeted advertising for that browser and device;
• if we can connect that browser to a contact record we hold, for example because you previously submitted a form on our sites in that browser, we also apply the opt-out to that contact record; and
• our privacy choices page shows "Opt-Out Request Honored" so you can confirm it worked.

We process GPC without asking you for anything else. To use GPC, choose a browser or extension that supports it; you can find options at globalprivacycontrol.org. You can also opt out without GPC using the setting on our privacy choices page, or by submitting a request (section 10).

Do Not Track. Some browsers send a "Do Not Track" signal. Because there is no common standard for how to respond to it, our sites do not respond to Do Not Track signals. We do honor Global Privacy Control as described above.

8. Information we process for our customers

Our customers use our technology to build their own websites, landing pages, lead-capture forms, calculators and campaigns, and to communicate with the people who respond. When you submit information through a page, form or message created by one of our customers, such as a loan officer, lender, mortgage broker or real estate agent:

• The information belongs to the customer. It stays in the customer's account and is not deleted because of a plan change or downgrade.
• The customer is responsible for that information. The customer decides what to collect, how to use it and how to contact you, and the customer's own privacy notice applies. Our customers are responsible for giving you a notice at collection and for any advertising tools they choose to add to their pages.
• We process it only on the customer's behalf, under a written agreement and the customer's instructions, as a "service provider" or "processor" under state privacy laws. We use it only to provide and support our services to that customer, to keep our services secure and working, to improve our services as the law permits, and to comply with law.
• We do not sell it, use it for our own marketing, or combine it with information from other customers or from our own business, except as the law allows a service provider to do.
• Financial information rules may also apply. When our customer is a financial institution, the information may also be governed by the Gramm-Leach-Bliley Act and the customer's own privacy notice.
• To exercise your rights, contact the customer that collected your information. If you contact us instead, for example with our privacy request form, we will tell you that we process the information for our customer, and we will forward your request to the customer or act on the customer's instructions. We will help our customers respond to requests as the law requires.

If a customer sends you texts or calls through our technology, the customer is the sender, not rebel iQ. Our technology is designed to honor opt-outs: replying STOP to a text sent through our systems stops further texts from that sender through our systems.

9. Your privacy rights

We honor the following rights for every U.S. resident, whether or not your state's law requires it. We do not charge for requests, except as the law permits for requests that are manifestly unfounded, excessive or repetitive.

• Right to know and access. Ask whether we process your personal information, and for the categories of personal information we have collected about you, the categories of sources, our purposes, the categories of third parties we disclosed it to, and the specific pieces of personal information we hold. You can ask for information collected in the last 12 months or, if we have it, back to January 1, 2022.
• Right to a copy (portability). Ask for a copy of your personal information in a portable, readily usable format.
• Right to delete. Ask us to delete personal information we collected from or about you, subject to exceptions the law allows, for example when we need it to complete a transaction, keep our services secure, or comply with a legal obligation.
• Right to correct. Ask us to correct inaccurate personal information.
• Right to opt out of sale, sharing and targeted advertising. Ask us to stop disclosing your personal information through advertising cookies and pixels or otherwise for targeted advertising.
• Right to opt out of profiling. We do not profile in furtherance of decisions that produce legal or similarly significant effects, but you may still submit this request.
• Right to a list of third parties. Ask for a list of the specific third parties to which we have disclosed personal information.
• Right to limit use of sensitive personal information. We use sensitive personal information only for purposes permitted by law (section 2), so this right does not change how we use it, but you may still contact us.
• Right to stop marketing messages. Unsubscribe from marketing email, and stop marketing calls and texts (sections 13 and 14).
• Right to appeal. If we decline to act on your request, you can appeal (section 10).
• Right not to be retaliated against. We will not deny you goods or services, charge you a different price, provide a different quality of service, or otherwise retaliate against you for exercising your privacy rights, including if you are a job applicant, employee or independent contractor. We do not offer financial incentives for personal information.

10. How to submit a request

Ways to submit a request:

• Online: use our privacy request form. This is the fastest way.
• Email: privacy@rebeliq.com
• Phone (toll-free): (855) 532-3767

You do not need to create an account. Tell us whether you contacted us directly or submitted information on one of our customers' pages, so we can route your request correctly.

Opting out is immediate and needs no verification. To opt out of advertising cookies and pixels on the browser you are using, use the setting on our privacy choices page or turn on Global Privacy Control. To opt out across devices and for your contact record, submit an opt-out request; we may ask for your name and email address only so we can find your record. We act on opt-out requests as soon as possible and no later than 15 business days, and we tell the companies we disclosed your information to after your request that you opted out. We will not ask you to opt back in for at least 12 months.

Verification for other requests. For requests to know, access, get a copy, correct or delete, we must confirm you are the person the information is about. We do this by matching information you give us, such as your name, email address, phone number and company, with information we already hold, and we may contact you at the email address or phone number we have on file. For requests for specific pieces of personal information, we may ask you to match at least three pieces of information and to sign a declaration, under penalty of perjury, that you are the person the information is about. We never ask for your Social Security number, driver's license or other government ID, and we use information you give us for verification only to verify your request. If we cannot verify you, we will tell you why and, for a deletion request, we will treat it as a request to opt out of sale and sharing.

Authorized agents. You may have someone else make a request for you. We will ask the agent for proof that you gave them signed permission, and we may ask you to confirm your identity with us directly or confirm that you gave the agent permission. We do not require a power of attorney, but if the agent has one under the law, we will accept it instead. An agent may submit an opt-out request with your signed permission.

When we respond. We confirm we received a request within 10 business days and tell you how we will process it. We respond within 45 days of receiving it. If we need more time, we will tell you within those 45 days why, and take up to 45 more days. We may limit requests to know or for a copy to twice in a 12-month period. We keep a record of each request and our response for at least 24 months.

Appeals. If we decline to act on your request, in whole or in part, we will explain why. You may appeal by replying to our response, using our privacy request form and choosing "Appeal a decision," or emailing privacy@rebeliq.com with "Appeal" in the subject line. We will respond to your appeal in writing within 45 days, explain what we decided and why, and tell you how to contact your state Attorney General if you are not satisfied.

11. Additional information for California residents

This section supplements the rest of this policy and applies to California residents under the California Consumer Privacy Act, as amended ("CCPA"). The category, source, purpose, retention and disclosure information required by the CCPA for the last 12 months is in section 2, section 3, section 4 and section 5.

• Personal information sold or shared in the last 12 months: identifiers (online identifiers such as cookie and device IDs and IP address), internet or other electronic network activity, and geolocation data (approximate location from IP address only), to advertising partners (advertising networks, social media platforms, marketing technology providers and business-information providers), for the business purposes of advertising, advertising measurement, and identifying companies that visit our sites.
• Personal information disclosed for a business purpose in the last 12 months: all categories listed in section 2 to service providers and contractors, for the purposes described in section 4, and to the other recipients described in section 5.
• Consumers under 16: We do not have actual knowledge that we sell or share the personal information of consumers under 16.
• Sensitive personal information: We use and disclose sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m).
• Your California privacy rights are described in section 9, and how to use them in section 10. Our "Your Privacy Choices" link appears at the bottom of every page of our sites.
• Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

12. Additional information for residents of other states

The rights in section 9 include those provided by the comprehensive consumer privacy laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and other states as their laws take effect. Whether a particular law applies to a particular request depends on the law. We honor these rights for all U.S. residents regardless.

• Targeted advertising and sale. As described in section 5, our advertising partners collect online identifiers and browsing activity through cookies and pixels on our sites. Some state laws treat this as targeted advertising or a sale. You can opt out as described in section 10.
• Third-party lists (Connecticut, Minnesota, Oregon and others). You may request a list of the specific third parties to which we have disclosed personal information.
• Profiling (Minnesota and others). We do not make decisions that produce legal or similarly significant effects based on profiling.
• AI model training (Connecticut). We do not use personal information to train large language models and do not sell personal information for that purpose.
• Sensitive data. We do not process sensitive data, as these laws define it, for our own purposes, and we do not sell sensitive data.
• Nevada. We do not sell covered information as Nevada law defines it. Nevada residents may still submit an opt-out request using the methods in section 10.
• Appeals and complaints. You may appeal any decision as described in section 10. If you are not satisfied with our response to your appeal, you may contact your state Attorney General.

13. Text messages and phone calls

If you give us your phone number, we may call or text you about your request or account. We send marketing texts or autodialed or prerecorded marketing calls only with your prior express written consent, and consent is never a condition of purchase. Message frequency varies, and message and data rates may apply.

You can stop texts at any time by replying STOP (or QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE or OPT OUT) to any message, and reply HELP for help. You can also stop calls and texts by telling the person who calls you, using our privacy request form, or emailing privacy@rebeliq.com. We honor these requests within 10 business days, usually much sooner. We may send one text confirming your opt-out.

We do not share mobile phone numbers or text-messaging consent with third parties or affiliates for their own marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties, except service providers that deliver our messages.

If we record a call or video meeting, we will tell you at the start.

14. Marketing email

You can unsubscribe from our marketing email at any time with the link in any marketing email, by using our privacy request form, or by emailing privacy@rebeliq.com. We honor unsubscribe requests within 10 business days. We will still send you transactional and service messages related to your account or requests.

15. Job applicants

If you apply for a job with us, we collect the information you give us, such as your name, contact information, resume, work history, education, references and the role you applied for, along with interview notes, and information from references and background checks you authorize. We use it to evaluate your application, communicate with you, comply with law, and, if you are hired, for employment purposes. We disclose it only to service providers that help us recruit, to people involved in the hiring decision, and as required by law. We do not sell or share it. We keep it as long as needed to consider you for the role and as required by employment and record-keeping laws. You have the rights described in section 9 for this information, and you can use them as described in section 10.

16. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS), encryption at rest, access controls and limits on who can see personal information. Please use a strong, unique password for your account and tell us right away if you suspect unauthorized access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your information has been compromised, contact us right away at privacy@rebeliq.com.

17. Children

Our sites and services are for businesses and professionals and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it. If you are a California resident under 18 and a registered user, you may ask us to remove content you posted on our services (Cal. Bus. & Prof. Code § 22581); removal may not ensure complete removal of the content.

18. Visitors outside the United States

Our services are intended for businesses in the United States, and we store and process information primarily in the United States. If you visit our sites from outside the United States, your information will be transferred to and processed in the United States. If the laws of another jurisdiction, such as the EU General Data Protection Regulation, apply to our processing of your information, we will honor the rights those laws give you, including access, correction, deletion and objection, and you may complain to your local data protection authority.

19. Changes to this policy

We review this policy at least once every 12 months and update it when our practices change. We post the updated policy here and change the "Last updated" date at the top. If we make a material change, we will tell you at least 30 days before it takes effect by posting a notice on our sites or in our applications, or by emailing you, and we will not use personal information we already hold in a materially different way without your consent where the law requires it.

20. Contact us

For questions about this policy or our privacy practices, or to make a request:

rebel iQ, Inc. (LeadPops and rebel Ai)
Attn: Privacy
4747 Morena Blvd. #375
San Diego, CA 92117
Email: privacy@rebeliq.com
Toll-free: (855) 532-3767
Online: privacy request form