Privacy policy.
Last updated June 24, 2026
Introduction
Desert Rock Capital, Inc. ("Desert Rock Capital," "we," "us," or "our") is a Utah-licensed consumer lender. We are committed to protecting your privacy and safeguarding your personal information. This Privacy Policy describes what information we collect, how we use it, with whom we share it, and your choices regarding that information.
This Privacy Policy applies to all individuals who visit our website at www.desertrockcapital.com (the "Website"), submit a loan application, receive a loan, or otherwise interact with us.
By using our Website or services, you acknowledge and agree to the practices described in this Privacy Policy.
This Privacy Policy is incorporated into and forms part of our Terms of Service. If there is a conflict between this Privacy Policy and any other agreement you have with us, your loan agreement shall control with respect to your loan, and this Privacy Policy shall control with respect to website use and data practices.
Information We Collect
2.1 Information You Provide to Us
We collect nonpublic personal information ("NPI") that you voluntarily provide when you apply for a loan, create an account, contact us, or otherwise interact with our services.
• Full name, date of birth, and Social Security number
• Home address, email address, and telephone numbers
• Employment information including employer name, income, and position
• Financial information including bank account details and income
• Government-issued identification details
• Military service status
• References and emergency contact information
• Information submitted through loan applications or forms
2.2 Information We Collect Automatically
• IP address, browser type, operating system, and device information
• Approximate location (no more precise than city or metro level), estimated from your IP address
• Pages viewed, links clicked, and time spent
• Referring URLs and search terms
• Cookies and tracking technologies
2.3 Information We Obtain from Third Parties
• Public records databases
• Employment and income verification services
• Identity verification and fraud prevention services
• Military status verification databases
• Bankruptcy monitoring services
• Skip tracing and data enrichment providers
• Other sources permitted by law
How We Use Your Information
We use your personal information for business purposes including:
• Evaluating loan applications and creditworthiness
• Originating, servicing, and administering loans
• Processing payments and maintaining account records
• Communicating account updates and reminders
• Collecting delinquent accounts
• Verifying identity, employment, and preventing fraud
• Complying with laws and regulations
• Improving our website and services
• Responding to customer inquiries
• Sending marketing communications if opted in
SMS/Text Messaging Privacy
Mobile opt-in data and consent will not be shared with third parties for marketing purposes.
You may receive messages including:
• Payment reminders and confirmations
• Account alerts and servicing messages
• Collections communications
• Promotional messages if opted in
You may opt out anytime by replying STOP or contacting us directly.
Message frequency varies based on your account activity, and message and data rates may apply, charged by your mobile carrier and not by us. Reply HELP for help or contact us at 801-377-3333 or help@desertrockcapital.com. Your consent to marketing text messages is not a condition of obtaining a loan or any service. Carriers are not liable for delayed or undelivered messages. For the full text message program terms, see the SMS / Text Messaging Program Terms in our Terms of Service. Some of our calls may use automated or artificial-intelligence voice technology, and we may monitor or record calls for quality, training, verification, and recordkeeping where permitted by law.
How We Protect Your Information
We maintain physical, electronic, and procedural safeguards to protect your personal information.
• Encrypted communications
• Access controls and employee authorization
• Vendor confidentiality agreements
• Employee privacy training
• Secure facilities and storage
• Regular security testing and updates
While we use reasonable security measures, no system is completely secure.
We obtain information from the verification, public-records, fraud-prevention, and skip tracing sources listed in Section 2.3 only for permissible purposes allowed by the Fair Credit Reporting Act and other applicable law. The Verification Sources and Identity Theft section of this Privacy Policy describes how we use that information and how to reach us if you believe you are a victim of identity theft.
Your Choices and Rights
You may exercise your rights by contacting us.
• Opt out of information sharing
• Opt out of marketing communications
• Request access to your personal data
• Request corrections to inaccurate data
• Revoke communication consent
• Change your cookie and analytics choices at any time using the "Cookie preferences" link in the website footer (see Section 13)
How to correct your information or withdraw authorizations. You may ask us to correct information about you that is inaccurate or out of date, and we will update our records after we verify the change. You may also withdraw an authorization you gave us, such as consent to call, text, email, or use AI voice messaging, at any time. To stop text messages, reply STOP. To withdraw other consents, or to correct your information, contact our Privacy Department using the details in our Contact Us section, and tell us clearly what you want changed or withdrawn. We will verify your identity before acting on a request. Withdrawing consent for marketing or convenience communications does not stop the account servicing, payment, and legal notices we are required or permitted to send about your loan. Withdrawing an authorization does not undo anything we already did while it was in effect.
Analytics and How We Measure the Site
We use Google Analytics 4 ("GA4"), a measurement service provided by Google LLC, to understand how visitors use our Website. GA4 sets first-party cookies named _ga and _ga_* on your browser when you visit. This measurement runs by default; Section 13 lists the ways to opt out of it entirely, including a Google browser add-on that blocks GA4 on every site.
Through GA4 we collect:
• Usage data such as pages viewed, links and buttons clicked, time on page, and how you arrived at the site
• Approximate location estimated from your IP address, no more precise than the city or metro level
• Device and browser details such as device category, operating system, browser, screen size, and language
• Counts of actions such as starting an application, using the payment calculator, tapping the call button, or opening chat. These event counts carry no names, contact details, or application data.
We use this information to see which pages are useful, how people find us, and where the Website needs improvement. We do not send your name, Social Security number, loan application details, or any other nonpublic personal information to Google Analytics.
Google Signals and Advertising Features
We have enabled Google Signals in our GA4 property. If you are signed in to a Google account and have turned on Ads Personalization in your Google account settings, Google may associate your visits to our Website with that Google account. This supports cross-device measurement (recognizing that a phone visit and a laptop visit came from the same person) and gives us aggregated reports about the demographics and interests of our visitors, as estimated by Google.
Google applies minimum thresholds before showing us any of this data. We only ever see aggregate statistics. We cannot see your identity, your Google account, or your individual browsing.
We use these features for measurement and insight only. Our Website does not run third-party advertising networks, and we do not use Google Signals to build retargeting audiences or to show you personalized ads.
You can disconnect this association at any time in your Google account: review and delete activity at myactivity.google.com, and turn off Ads Personalization at adssettings.google.com.
Granular Location and Device Data
When analytics is running, Google Analytics estimates your approximate location from your IP address. This estimate is no more precise than the city or metro level. We do not collect GPS coordinates or precise location through our Website.
We also receive device metadata: device category (desktop, mobile, or tablet), operating system and version, browser and version, screen resolution, and language setting. We use it to make sure the Website works well on the devices our visitors actually use.
User-Provided Data and Measurement
Google Analytics offers a user-provided data capability, in which information a visitor knowingly gives a website (such as an email address typed into a form) can be hashed (converted into an irreversible code) and used by Google for aggregate measurement in a privacy-safe way under Google's user-provided data policy.
Today, our analytics events contain no names, email addresses, phone numbers, or application data, and we do not send user-provided data to Google Analytics.
If we use this capability in the future, the data would be hashed before it reaches Google and used for measurement only. We will update this Privacy Policy before doing so.
Your Analytics Choices and Opt-Outs
You are in control of how our Website measures and signals.
• Cookie banner: on your first visit, a banner explains our cookies. "Accept all" also allows Google's advertising-related signals (described in Section 9); "Measurement only" declines them. Basic analytics measurement runs in both cases and can be blocked entirely with the tools below.
• Cookie preferences: select the "Cookie preferences" link in the footer of any page to reopen the banner and change your choice at any time.
• Google Analytics opt-out browser add-on: install it from tools.google.com/dlpage/gaoptout to block Google Analytics in your browser on every website, including ours.
• Google account settings: manage or turn off Ads Personalization at adssettings.google.com, and review or delete activity Google has associated with your account at myactivity.google.com.
• Browser settings: you can also block or delete cookies in your browser at any time.
Do Not Track: our Website does not respond to browser "Do Not Track" signals. Your banner choice controls the advertising-related signals here, and the opt-outs above control analytics measurement; we honor those choices regardless of any Do Not Track setting.
Children's Privacy
Our services are not directed to individuals under age 18. We do not knowingly collect personal information from minors.
Our Website and services are intended only for adults, and we do not knowingly collect personal information from any child under the age of 13, consistent with the Children's Online Privacy Protection Act. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, or from anyone under 18 who is not eligible for our services, we will delete that information promptly. If you are a parent or guardian and believe your child has provided us information, contact our Privacy Department using the details in our Contact Us section and we will remove it.
Changes to This Privacy Policy
We may update this Privacy Policy at any time. Changes will be posted on this page.
June 11, 2026: updated the analytics and cookie sections to describe Google Analytics 4, Google Signals measurement features, the cookies our Website sets, and the cookie consent banner and preferences control.
June 24, 2026: added, without removing any existing terms, a data retention and disposal section, a data breach notification section, a verification sources and identity theft section, a special state requirements and authorized agents section, a where we process your information section, named categories of parties we may share information with, expanded SMS disclosures, an identity-correction and consent-withdrawal procedure, and the Gramm-Leach-Bliley reasons-we-share and how-to-limit details.
Contact Us
Desert Rock Capital, Inc.
Attn: Privacy Department
168 North 100 East, Suite #250, St. George, UT 84770
Phone: 801-377-3333
Email: help@desertrockcapital.com
Gramm-Leach-Bliley Act Notice
This Privacy Policy serves as Desert Rock Capital's notice under the Gramm-Leach-Bliley Act and applicable regulations.
We collect and disclose nonpublic personal information only as described in this Privacy Policy and as permitted or required by law.
Reasons we can share your nonpublic personal information, and whether you can limit it:
• For our everyday business purposes, such as processing your loan, servicing your account, collecting amounts you owe, verifying your identity and income, preventing fraud, responding to court orders and legal investigations, and reporting to government regulators: we do share, and you cannot limit this sharing under the law.
• For our own marketing to you, such as offers about our loan products: we do share, and you cannot limit this sharing.
• With companies that work for us under contract, such as our loan servicing platform, payment processors, identity and income verification services, and communication providers, so they can perform services on our behalf: we do share, and you cannot limit this sharing, because these providers may use your information only to perform work for us and may not use it for their own purposes.
• For joint marketing with other financial companies: we do not share.
• With affiliates for their own everyday business purposes: we do not have affiliates that we share with for this purpose, so there is nothing to limit.
• With affiliates so they can market to you: we do not do this.
• With nonaffiliated companies so they can market to you: we do not do this.
• With anyone for that company's own independent marketing: we do not do this, and we do not sell, rent, or lease your personal information.
How to limit what you can limit: where the law gives you the right to limit sharing, or to opt out of marketing from us, you may tell us by calling 801-377-3333, by emailing help@desertrockcapital.com with the words "Opt Out" in the subject line and your full name and the email or phone number on your account in the message, or by writing to Desert Rock Capital, Inc., Attn: Privacy Department, 168 North 100 East, Suite #250, St. George, UT 84770. Please allow up to 30 days for your request to take effect. Your choice stays in place until you tell us to change it. If you close your account or your account becomes inactive, we continue to protect your information as described in this Privacy Policy.
We provide this notice when you become our customer and make it available to you at any time on our Website. Because we share nonpublic personal information only as this Policy describes and as the Gramm-Leach-Bliley Act permits, and because we do not sell or share your information for others to market to you, there is no separate Gramm-Leach-Bliley opt-out you need to exercise to stop such sharing. We will notify you and provide a revised notice if our information-sharing practices change.
Data Retention and Disposal
We keep your personal information only as long as we need it for the purposes described in this Privacy Policy and as required by law. Loan and account records are retained for the life of your loan and afterward for the period required by Utah and federal lending, tax, anti-fraud, and recordkeeping law and by our regulators, and for as long as needed to enforce our rights, resolve disputes, and respond to legal and tax requirements, which is generally several years after your account is paid off or closed. Loan applications that do not result in a loan are retained for the period required by applicable lending and recordkeeping rules, including the Equal Credit Opportunity Act, and then disposed of. Website analytics data is retained on a rolling basis under our Google Analytics settings. When we no longer need information and are not required to keep it, we securely delete, destroy, or de-identify it. If you ask us to delete your information, we will honor your request to the extent the law allows, but we may keep records we are legally required to retain.
Data Breach Notification
We work to prevent unauthorized access to your information, but if we become aware of a breach of system security involving your personal information, we will investigate promptly and in good faith and take steps to contain and remediate it. If the investigation shows that misuse of your personal information for identity theft or fraud has occurred or is reasonably likely to occur, we will notify you in the most expedient time possible and without unreasonable delay, by mail, email, or telephone, consistent with the Utah Protection of Personal Information Act and the Gramm-Leach-Bliley Act Safeguards Rule. Our notice will describe, to the extent known, what happened, when it occurred and was discovered, the type of information involved, and steps you can take.
Verification Sources, Fair Credit Reporting Act, and Identity Theft
We obtain information from the verification, public-records, fraud-prevention, and skip tracing sources listed in Section 2.3 only for permissible purposes allowed by the Fair Credit Reporting Act and other applicable law, such as evaluating an application that you initiated, verifying your identity and income, preventing and investigating fraud, and servicing or collecting on your account. We do not furnish information about your loan to the national consumer credit reporting agencies. If you believe you are the victim of identity theft, or that someone applied for or obtained a loan in your name without your authorization, contact our Privacy Department immediately using the details in our Contact Us section so we can investigate, and you may also place a fraud alert or security freeze with the national consumer reporting agencies and report the matter to the Federal Trade Commission at IdentityTheft.gov.
Where We Process Your Information
We are a Utah business and we serve Utah residents. Your personal information is collected, stored, and processed in the United States. We do not transfer your personal information outside the United States, except that some of our service providers, such as our analytics and communication providers, may process limited technical data on infrastructure that operates internationally. When that happens, those providers are bound by contract to protect your information consistent with this Privacy Policy and applicable law.