Privacy policy.
Last updated October 13, 2026
Introduction
Desert Rock Capital, Inc. ("Desert Rock Capital," "we," "us," or "our") is a Utah-licensed consumer lender. We are committed to protecting your privacy and safeguarding your personal information. This Privacy Policy describes what information we collect, how we use it, with whom we share it, and your choices regarding that information.
This Privacy Policy applies to all individuals who visit our website at www.desertrockcapital.com (the "Website"), submit a loan application, receive a loan, or otherwise interact with us.
By using our Website or services, you acknowledge and agree to the practices described in this Privacy Policy.
This Privacy Policy is incorporated into and forms part of our Terms of Service. If there is a conflict between this Privacy Policy and any other agreement you have with us, your loan agreement shall control with respect to your loan, and this Privacy Policy shall control with respect to website use and data practices.
Information We Collect
2.1 Information You Provide to Us
We collect nonpublic personal information ("NPI") that you voluntarily provide when you apply for a loan, create an account, contact us, or otherwise interact with our services.
• Full name, date of birth, and Social Security number
• Home address, email address, and telephone numbers
• Employment information including employer name, income, and position
• Financial information including bank account details and income
• Government-issued identification details
• Military service status
• References and emergency contact information
• Information submitted through loan applications or forms
2.2 Information We Collect Automatically
• IP address, browser type, operating system, and device information
• Approximate location, such as your city or postal code area, estimated from your IP address
• Pages viewed, links clicked, and time spent
• Referring URLs and search terms
• Cookies and tracking technologies
• How you interact with pages, such as clicks, taps, scrolling, and movement between pages
• A randomly generated identifier stored in your browser that lets our measurement tools recognize the same browser across visits
• If you choose to allow it, a session replay of your visit to our public pages, as described in Section 8.3
• Answers you choose to give to an on-site feedback question
• Technical error reports when a page fails to load or work correctly
2.3 Information We Obtain from Third Parties
• Public records databases
• Employment and income verification services
• Identity verification and fraud prevention services
• Military status verification databases
• Bankruptcy monitoring services
• Skip tracing and data enrichment providers
• Other sources permitted by law
How We Use Your Information
We use your personal information for business purposes including:
• Evaluating loan applications and creditworthiness
• Originating, servicing, and administering loans
• Processing payments and maintaining account records
• Communicating account updates and reminders
• Collecting delinquent accounts
• Verifying identity, employment, and preventing fraud
• Complying with laws and regulations
• Improving our website and services
• Diagnosing errors and testing changes to our Website
• Responding to customer inquiries
• Sending marketing communications if opted in
SMS/Text Messaging Privacy
Mobile opt-in data and consent will not be shared with third parties for marketing purposes.
You may receive messages including:
• Payment reminders and confirmations
• Account alerts and servicing messages
• Collections communications
• Promotional messages if opted in
You may opt out anytime by replying STOP or contacting us directly.
Message frequency varies based on your account activity, and message and data rates may apply, charged by your mobile carrier and not by us. Reply HELP for help or contact us at 801-377-3333 or help@desertrockcapital.com. Your consent to marketing text messages is not a condition of obtaining a loan or any service. Carriers are not liable for delayed or undelivered messages. For the full text message program terms, see the SMS / Text Messaging Program Terms in our Terms of Service. Some of our calls may use automated or artificial-intelligence voice technology, and we may monitor or record calls for quality, training, verification, and recordkeeping where permitted by law.
How We Protect Your Information
We maintain physical, electronic, and procedural safeguards to protect your personal information.
• Encrypted communications
• Access controls and employee authorization
• Vendor confidentiality agreements
• Employee privacy training
• Secure facilities and storage
• Regular security testing and updates
While we use reasonable security measures, no system is completely secure.
We obtain information from the verification, public-records, fraud-prevention, and skip tracing sources listed in Section 2.3 only for permissible purposes allowed by the Fair Credit Reporting Act and other applicable law. The Verification Sources and Identity Theft section of this Privacy Policy describes how we use that information and how to reach us if you believe you are a victim of identity theft.
Your Choices and Rights
You may exercise your rights by contacting us.
• Opt out of information sharing
• Opt out of marketing communications
• Request access to your personal data
• Request corrections to inaccurate data
• Revoke communication consent
• Change your cookie, measurement, and session replay choices at any time using the "Cookie preferences" link in the website footer (see Section 13)
How to correct your information or withdraw authorizations. You may ask us to correct information about you that is inaccurate or out of date, and we will update our records after we verify the change. You may also withdraw an authorization you gave us, such as consent to call, text, email, or use AI voice messaging, at any time. To stop text messages, reply STOP. To withdraw other consents, or to correct your information, contact our Privacy Department using the details in our Contact Us section, and tell us clearly what you want changed or withdrawn. We will verify your identity before acting on a request. Withdrawing consent for marketing or convenience communications does not stop the account servicing, payment, and legal notices we are required or permitted to send about your loan. Withdrawing an authorization does not undo anything we already did while it was in effect.
Analytics and How We Measure the Site
8.1 Google Analytics
We use Google Analytics 4 ("GA4"), a measurement service provided by Google LLC, to understand how visitors use our Website. GA4 sets first-party cookies named _ga and _ga_* on your browser once it is running. This measurement runs by default for browsers set to the Mountain time zone, which covers Utah, and only after you allow it everywhere else. Section 13 explains this and lists the ways to turn it off, including the Cookie preferences control on our Website and a Google browser add-on that blocks GA4 on every site.
Through GA4 we collect:
• Usage data such as pages viewed, links and buttons clicked, time on page, and how you arrived at the site
• Approximate location estimated from your IP address, no more precise than the city or metro level
• Device and browser details such as device category, operating system, browser, screen size, and language
• Counts of actions such as starting an application, using the payment calculator, tapping the call button, or opening chat. These event counts carry no names, contact details, or application data.
We use this information to see which pages are useful, how people find us, and where the Website needs improvement. We do not send your name, Social Security number, loan application details, or any other nonpublic personal information to Google Analytics.
8.2 Product analytics
We also use a second measurement service, operated for us by a service provider under contract, to understand how the Website's pages, forms, and tools perform. It runs alongside Google Analytics under the same rules: by default for browsers set to the Mountain time zone, only after you allow it everywhere else, and never once you turn measurement off in Cookie preferences (Section 13).
Through this service we collect:
• Pages viewed, buttons and links clicked, how far a page was scrolled, and the order of steps taken, such as starting or leaving a form
• An approximate area, such as your city and postal code, estimated from your IP address. We have set the service to discard your IP address once that estimate is made.
• Device and browser details such as device category, operating system, browser, screen size, and language
• A randomly generated identifier kept in your browser, described in Section 11
• Counts of actions such as starting an application, using the payment calculator, tapping the call button, or opening chat, along with page speed measurements and technical error reports
We use this information to find pages and steps that confuse or slow people down, and to fix them. We do not send this service your name, contact details, Social Security number, income, or the information you enter in an application. We do record that an application or booking was started, how far it got, and which step or field caused a problem. Web addresses are trimmed before they are sent so that any personal details carried in a link are left out. What you type into a form is never included.
8.3 Session replay and heatmaps
With your permission, we use a session replay tool, operated for us by a service provider under contract, to see how visits to our public pages actually go, so we can fix confusing layouts and broken steps. Session replay is off unless you turn it on, either by choosing "Accept all" in our cookie banner or by switching it on in Cookie preferences. It only runs while measurement is on. You can switch it off again at any time, and it stops recording right away.
When it is on, the tool records what happens on the page during your visit: the pages you open, the content shown on them, where you click or tap, how you scroll, and how the pointer moves. It sends this to our service provider, which rebuilds it into a replay that authorized Desert Rock Capital staff can watch. The same information produces heatmaps, which are summary pictures of where visitors click and how far they scroll.
Session replay is built to leave your personal details out:
• Anything you type into a form field is masked in your browser before the recording leaves your device, so neither we nor our provider receive it
• It does not run on our application, pre-qualification, appointment, confirmation, or video assistant pages
• Our chat window and the loan and booking forms that appear on other pages are blocked out of every recording
• It does not record sound, your camera, other browser tabs, or anything outside our Website
Recordings are deleted automatically under our retention setting, currently 30 days. We use them only to improve the Website. We do not use them to make lending decisions, and we do not sell them or share them for anyone else's marketing.
8.4 Feedback questions, site testing, and error reports
From time to time we may show a short, optional feedback question on a page. Answering is voluntary. Please do not put personal or account details in an answer.
We may show different versions of a page's layout or wording to different visitors to learn which is clearer. These tests change presentation only. They never change the loan terms, pricing, or eligibility offered to anyone.
When a page fails to load or work correctly, the Website may send us a technical error report so we can fix it.
Google Signals and Advertising Features
We have enabled Google Signals in our GA4 property. If you are signed in to a Google account and have turned on Ads Personalization in your Google account settings, Google may associate your visits to our Website with that Google account. This supports cross-device measurement (recognizing that a phone visit and a laptop visit came from the same person) and gives us aggregated reports about the demographics and interests of our visitors, as estimated by Google.
Google applies minimum thresholds before showing us any of this data. We only ever see aggregate statistics. We cannot see your identity, your Google account, or your individual browsing.
We use these features for measurement and insight only. Our Website does not run third-party advertising networks, and we do not use Google Signals to build retargeting audiences or to show you personalized ads.
You can disconnect this association at any time in your Google account: review and delete activity at myactivity.google.com, and turn off Ads Personalization at adssettings.google.com.
Granular Location and Device Data
When measurement is running, Google Analytics estimates your approximate location from your IP address. This estimate is no more precise than the city or metro level. Our product analytics service makes a similar estimate, which can include a postal code. We do not collect GPS coordinates or precise location through our Website.
We also receive device metadata: device category (desktop, mobile, or tablet), operating system and version, browser and version, screen resolution, and language setting. We use it to make sure the Website works well on the devices our visitors actually use.
User-Provided Data and Measurement
Google Analytics offers a user-provided data capability, in which information a visitor knowingly gives a website (such as an email address typed into a form) can be hashed (converted into an irreversible code) and used by Google for aggregate measurement in a privacy-safe way under Google's user-provided data policy.
Today, our analytics events contain no names, email addresses, phone numbers, or application data, and we do not send user-provided data to Google Analytics.
If we use this capability in the future, the data would be hashed before it reaches Google and used for measurement only. We will update this Privacy Policy before doing so.
Your Analytics Choices and Opt-Outs
You are in control of how our Website measures and signals.
• Where your browser is set: for browsers set to the Mountain time zone, which covers Utah, measurement (Sections 8.1 and 8.2) runs by default and you can turn it off. Everywhere else, nothing is measured until you make a choice in the cookie banner. Session replay and advertising signals are off everywhere until you turn them on.
• Cookie banner: on your first visit, a banner explains our cookies and gives three choices. "Accept all" turns on measurement, session replay and heatmaps (Section 8.3), and Google's advertising-related signals (Section 9). The second button keeps session replay and advertising signals off: it reads "Measurement only" where measurement runs by default, and "Necessary only" elsewhere, where it also keeps measurement off. "Choose" opens Cookie preferences so you can set each one yourself. If you made a choice on our earlier banner, we ask again.
• Cookie preferences: select the "Cookie preferences" link in the footer of any page to see separate switches for measurement, session replay and heatmaps, and advertising signals, and to change any of them at any time. Changes take effect right away.
• Turning measurement off: switching measurement off in Cookie preferences stops both Google Analytics and our product analytics service from collecting on our Website in that browser, and removes their cookies and identifiers from it. Events from the few seconds before the switch may still finish sending.
• Global Privacy Control: if your browser sends a Global Privacy Control signal, advertising signals stay off unless you switch them on in Cookie preferences while the signal is on. If you have not made a choice, session replay stays off as well and we do not ask you to turn either on.
• Google Analytics opt-out browser add-on: install it from tools.google.com/dlpage/gaoptout to block Google Analytics in your browser on every website, including ours.
• Google account settings: manage or turn off Ads Personalization at adssettings.google.com, and review or delete activity Google has associated with your account at myactivity.google.com.
• Browser settings: you can also block or delete cookies in your browser at any time.
Do Not Track: our Website does not respond to the older browser "Do Not Track" signal, which has no common standard. We do honor the Global Privacy Control signal as described above, and your choices in Cookie preferences always apply.
Children's Privacy
Our services are not directed to individuals under age 18. We do not knowingly collect personal information from minors.
Our Website and services are intended only for adults, and we do not knowingly collect personal information from any child under the age of 13, consistent with the Children's Online Privacy Protection Act. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, or from anyone under 18 who is not eligible for our services, we will delete that information promptly. If you are a parent or guardian and believe your child has provided us information, contact our Privacy Department using the details in our Contact Us section and we will remove it.
Changes to This Privacy Policy
We may update this Privacy Policy at any time. Changes will be posted on this page.
June 11, 2026: updated the analytics and cookie sections to describe Google Analytics 4, Google Signals measurement features, the cookies our Website sets, and the cookie consent banner and preferences control.
June 24, 2026: added, without removing any existing terms, a data retention and disposal section, a data breach notification section, a verification sources and identity theft section, a special state requirements and authorized agents section, a where we process your information section, named categories of parties we may share information with, expanded SMS disclosures, an identity-correction and consent-withdrawal procedure, and the Gramm-Leach-Bliley reasons-we-share and how-to-limit details.
October 13, 2026: added a second website measurement service; added optional session replay and heatmaps, which run only with your permission; added optional feedback questions, site testing, and error reports; changed measurement so that it waits for your choice outside the Mountain time zone; added separate switches in Cookie preferences, including a way to turn measurement off; began honoring the Global Privacy Control signal; and corrected the list of cookies and browser storage.
Contact Us
Desert Rock Capital, Inc.
Attn: Privacy Department
168 North 100 East, Suite #250, St. George, UT 84770
Phone: 801-377-3333
Email: help@desertrockcapital.com
Gramm-Leach-Bliley Act Notice
This Privacy Policy serves as Desert Rock Capital's notice under the Gramm-Leach-Bliley Act and applicable regulations.
We collect and disclose nonpublic personal information only as described in this Privacy Policy and as permitted or required by law.
Reasons we can share your nonpublic personal information, and whether you can limit it:
• For our everyday business purposes, such as processing your loan, servicing your account, collecting amounts you owe, verifying your identity and income, preventing fraud, responding to court orders and legal investigations, and reporting to government regulators: we do share, and you cannot limit this sharing under the law.
• For our own marketing to you, such as offers about our loan products: we do share, and you cannot limit this sharing.
• With companies that work for us under contract, such as our loan servicing platform, payment processors, identity and income verification services, and communication providers, so they can perform services on our behalf: we do share, and you cannot limit this sharing, because these providers may use your information only to perform work for us and may not use it for their own purposes.
• For joint marketing with other financial companies: we do not share.
• With affiliates for their own everyday business purposes: we do not have affiliates that we share with for this purpose, so there is nothing to limit.
• With affiliates so they can market to you: we do not do this.
• With nonaffiliated companies so they can market to you: we do not do this.
• With anyone for that company's own independent marketing: we do not do this, and we do not sell, rent, or lease your personal information.
How to limit what you can limit: where the law gives you the right to limit sharing, or to opt out of marketing from us, you may tell us by calling 801-377-3333, by emailing help@desertrockcapital.com with the words "Opt Out" in the subject line and your full name and the email or phone number on your account in the message, or by writing to Desert Rock Capital, Inc., Attn: Privacy Department, 168 North 100 East, Suite #250, St. George, UT 84770. Please allow up to 30 days for your request to take effect. Your choice stays in place until you tell us to change it. If you close your account or your account becomes inactive, we continue to protect your information as described in this Privacy Policy.
We provide this notice when you become our customer and make it available to you at any time on our Website. Because we share nonpublic personal information only as this Policy describes and as the Gramm-Leach-Bliley Act permits, and because we do not sell or share your information for others to market to you, there is no separate Gramm-Leach-Bliley opt-out you need to exercise to stop such sharing. We will notify you and provide a revised notice if our information-sharing practices change.
Data Retention and Disposal
We keep your personal information only as long as we need it for the purposes described in this Privacy Policy and as required by law. Loan and account records are retained for the life of your loan and afterward for the period required by Utah and federal lending, tax, anti-fraud, and recordkeeping law and by our regulators, and for as long as needed to enforce our rights, resolve disputes, and respond to legal and tax requirements, which is generally several years after your account is paid off or closed. Loan applications that do not result in a loan are retained for the period required by applicable lending and recordkeeping rules, including the Equal Credit Opportunity Act, and then disposed of. Website measurement data is retained on a rolling basis under the settings of our measurement services: under our Google Analytics settings for Google Analytics, and for the retention period of our product analytics provider's plan, currently about one year. Session replay recordings are deleted automatically under our retention setting, currently 30 days. When we no longer need information and are not required to keep it, we securely delete, destroy, or de-identify it. If you ask us to delete your information, we will honor your request to the extent the law allows, but we may keep records we are legally required to retain.
Data Breach Notification
We work to prevent unauthorized access to your information, but if we become aware of a breach of system security involving your personal information, we will investigate promptly and in good faith and take steps to contain and remediate it. If the investigation shows that misuse of your personal information for identity theft or fraud has occurred or is reasonably likely to occur, we will notify you in the most expedient time possible and without unreasonable delay, by mail, email, or telephone, consistent with the Utah Protection of Personal Information Act and the Gramm-Leach-Bliley Act Safeguards Rule. Our notice will describe, to the extent known, what happened, when it occurred and was discovered, the type of information involved, and steps you can take.
Verification Sources, Fair Credit Reporting Act, and Identity Theft
We obtain information from the verification, public-records, fraud-prevention, and skip tracing sources listed in Section 2.3 only for permissible purposes allowed by the Fair Credit Reporting Act and other applicable law, such as evaluating an application that you initiated, verifying your identity and income, preventing and investigating fraud, and servicing or collecting on your account. We do not furnish information about your loan to the national consumer credit reporting agencies. If you believe you are the victim of identity theft, or that someone applied for or obtained a loan in your name without your authorization, contact our Privacy Department immediately using the details in our Contact Us section so we can investigate, and you may also place a fraud alert or security freeze with the national consumer reporting agencies and report the matter to the Federal Trade Commission at IdentityTheft.gov.
Where We Process Your Information
We are a Utah business and we serve Utah residents. Your personal information is collected, stored, and processed in the United States. We do not transfer your personal information outside the United States, except that some of our service providers, such as our analytics and communication providers, may process website usage data, including session replays, and limited technical data on infrastructure that operates internationally. When that happens, those providers are bound by contract to protect your information consistent with this Privacy Policy and applicable law.