Privacy Policy
Effective September 28, 2026
This policy explains what the Hawaii Mortgage Toolkit collects when you use it, why, who sees it, and how long it is kept. It covers this website only. It does not cover CMG Home Loans’ own websites or loan application pages, which have their own policies.
Who we are
This site is Keri Shepherd’s toolkit for Hawaii agents and buyers. Keri is Regional Sales Manager at CMG Mortgage, Inc. dba CMG Home Loans (NMLS #1820) and a licensed mortgage loan originator (NMLS #350844). In this policy, “we,” “us” and “our” mean Keri and her team at CMG Home Loans.
Information you send through this site goes to Keri and CMG Home Loans staff so they can respond to you. If you go on to apply for a loan, CMG’s own privacy notice also applies (see When you apply for a loan below).
Who runs the site. SBREAD, the web studio that built and runs this site for Keri, hosts and maintains it as Keri’s service provider. SBREAD handles your information only on Keri’s behalf, to run, secure and fix the site. It does not use your information for its own purposes, sell it, or contact you. SBREAD is not a lender or a loan originator.
The site has no user accounts or logins, no advertising or remarketing pixels, and no analytics at launch.
What we collect
We only collect what you type into a form or upload, plus the limited technical data described after the table.
| Tool or form | What we collect | Why |
|---|---|---|
| Buydown calculator | Nothing. The numbers are computed in your browser and are not sent to us unless you use one of the forms below. | — |
| “Email me this calculation” | Your email address; your name and phone number if you give them; and the calculator inputs (ZIP code, price, down payment, interest rate, term, buydown structure and loan type). | To email you the report. A copy goes to Keri’s team inbox, theshepherdgroup@cmghomeloans.com. |
| Pre-approval request | Your name; your email and/or phone number; whether you are an agent or a buyer; the buyer’s name (optional); anything you write in the notes box; the calculator numbers; the required acknowledgment checkbox; and the optional checkbox agreeing to calls and texts, including autodialed ones. | So Keri’s team can contact you about a pre-approval. We send you a confirmation and notify the team. |
| Condo list check | The condo name, street address, city, island and ZIP code; the project phase; which financing types you want checked; your name, phone and email; your role (buyer’s agent, listing agent or buyer); your brokerage or agent; whether the buyer is pre-approved; the lender’s name; the required agreement checkbox; and the optional calls-and-texts checkbox. | To check the project against the approved lists and get back to you. |
| Condo document upload | Association documents you upload as PDF or image files (budget, minutes, financials, 105C, and insurance summary and certificate); project details such as the address, phase, asking price and association or management company; yes/no answers about litigation, repairs or special assessments, recreational leases and leasehold, with any details you add; and your contact details. | To review whether the condo project is eligible for financing. |
Consent records. When you submit a form with a consent or acknowledgment checkbox, we record your answer with the date and time, your IP address, your browser’s user agent, the page you were on, and the version of the wording you saw. This is our proof of what you agreed to.
Please don’t send sensitive financial information. The notes box asks you not to enter income, account numbers or Social Security numbers, and the upload page asks you not to upload Social Security numbers, bank statements, pay stubs or tax returns. Keri’s team collects what a loan needs through CMG’s secure document upload and application. If you send something we didn’t ask for, we may delete it and ask you to use CMG’s secure channels instead.
Information about other people. Association documents can name owners, board members or vendors, and a pre-approval request can name a buyer. We use that information only for the request it came with. By sending it, you confirm you are allowed to share it with us.
Collected automatically
- Hosting. Like any website, our host (Vercel) receives your IP address and basic browser information when it delivers a page or a form submission.
- Spam check. The “Verify you are human” box has your browser solve a small puzzle from this site’s server. It sets no cookies and collects nothing beyond the request itself. The forms also use a hidden field, a minimum time to fill them in, and limits on how often one IP address can submit. If we switch to Cloudflare Turnstile, it will check signals from your browser to tell people from bots, and Cloudflare will handle that data under its privacy policy.
- ZIP code lookups. Hawaii ZIP codes are looked up in your browser against bundled public data (GeoNames, CC BY 4.0, and the U.S. Census Bureau). Only a non-Hawaii ZIP code is sent to this site’s own server to look up.
How we use it
- To respond to your request: send your calculation, check a condo, review association documents, or contact you about a pre-approval.
- To send you a confirmation and notify Keri’s team.
- To call or text you with automated technology, but only if you checked the optional consent box.
- To follow up by email about your request or related mortgage topics. Every marketing email has an unsubscribe link.
- To keep a private record of each submission, so no request is lost if an email fails.
- To keep the forms free of spam and abuse.
- To meet legal, regulatory and CMG record-keeping duties.
How we share it
We share your information only with:
- Keri Shepherd and CMG Home Loans staff, so they can respond to your request.
- Service providers that run the site for us, only as needed to do that work:
- SBREAD: builds, hosts and maintains the site, and can access stored submissions and files only to run, secure and fix it;
- Vercel: hosting, serverless functions, and encrypted private storage for uploaded documents and submission records;
- Resend: email delivery. Resend keeps copies of the emails it sends for up to 30 days;
- Cloudflare: the Turnstile spam check, if we turn it on.
- Others when the law requires it, for example in response to a subpoena or a regulator’s request.
Association documents are used only to decide whether the project is eligible for financing. They are not shared with buyers, sellers, other agents or other third parties.
No selling, no ad tracking
We do not sell your personal information. We do not share it for cross-context behavioral advertising. The site has no advertising or remarketing pixels, such as those from Meta, Google or TikTok. If that ever changes, we will update this policy and add a way to opt out first.
Cookies and browser storage
- The site sets no cookies of its own. Cloudflare Turnstile may set a cookie, and only when it is turned on.
- The condo form keeps your progress in your browser’s sessionStorage, so a page refresh doesn’t lose your place. That data stays on your device and is cleared when you close the tab.
- Fonts are served from this site, so your browser does not contact Google Fonts.
Do Not Track
Some browsers can send a “Do Not Track” signal. We don’t track visitors across other websites, and no advertising or analytics company collects information about your activity here. So a Do Not Track signal doesn’t change how the site works.
Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information. We don’t sell or share personal information, so there is nothing more to turn off today. If our practices change, we will honor the signal.
How long we keep it
- Uploaded condo documents: deleted from this site’s storage after 90 days.
- Submission records (including consent records): kept for 24 months, then deleted.
- Backups: our host keeps encrypted backups for up to 30 days, so a deleted file or record can remain in a backup for up to 30 more days until that backup expires.
- Emails: our email provider keeps copies of sent emails for up to 30 days. Copies in Keri’s team inbox and other CMG systems are kept under CMG’s own record-retention policies.
- Condo form progress in sessionStorage: until you close the tab.
How we protect it
- Every page and form submission uses HTTPS.
- Uploaded documents and submission records are kept in private storage, encrypted by our host (AES-256). They are not publicly accessible.
- The upload accepts PDF and image files only, and each file is checked to make sure it really is one. Forms have a spam check and rate limits.
- Documents reach Keri’s team only as signed download links that expire. Each link works for 30 days and opens a download address that is valid for 10 minutes. The links are sent only to Keri’s team.
- SBREAD can reach stored files and records only to run, secure and fix the site. No one else has access.
- Files and records are deleted on the schedule above.
No way of sending or storing information online is completely secure, and we can’t guarantee that yours will never be accessed without permission. Please send only what the forms ask for. If we learn of a security incident that affects your information, we will tell CMG and notify you as the law requires.
Emails and texts from us
Emails from this site are sent on Keri’s behalf from a website sending domain. Replies go to theshepherdgroup@cmghomeloans.com. Every marketing follow-up email has an unsubscribe link, and you can also unsubscribe at our unsubscribe page. If you agreed to texts, reply STOP to any text to opt out. See our Terms of Use for the full messaging terms.
When you apply for a loan
This site is not a loan application. Once you apply for a loan with CMG Home Loans, CMG’s Privacy Notice, required by the federal Gramm-Leach-Bliley Act (GLBA), governs how CMG collects, uses and shares your financial information. Where that notice and this policy differ for information CMG holds as your lender, CMG’s Privacy Notice controls. CMG’s website Privacy Policy covers its own websites.
California residents
If you live in California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the right to:
- know what personal information we collect, use and disclose;
- delete it;
- correct it if it’s wrong;
- opt out of its sale or sharing (we don’t sell or share it);
- limit the use of sensitive personal information (we don’t ask for it); and
- be free from retaliation for using these rights.
In CCPA terms, the categories we collect are identifiers (such as name, email, phone and IP address), professional information (your role and brokerage), property and loan-scenario details you enter, and basic internet or device information (such as your browser’s user agent). The sources, purposes, recipients and retention periods are described above.
Loan information is handled differently. Information collected under the GLBA, such as information you give CMG to apply for a loan, is exempt from most CCPA rights. CMG’s Privacy Notice governs it instead.
To make a request, email theshepherdgroup@cmghomeloans.com or call (808) 223-4118. We will confirm your identity by matching details you gave us, such as the email address or phone number you used. An authorized agent may make a request for you with your signed permission. We respond within the time the law allows, generally 45 days.
Children
This site is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has sent us information, contact us and we will delete it.
Hawaii residents
Hawaii law (HRS chapter 487N) requires notice of a security breach involving certain personal information, such as a name together with a Social Security, driver’s license or financial account number. Our forms don’t ask for those numbers, and we ask you not to send them. If a breach ever affects information you sent us, we will notify CMG and you as Hawaii law requires. We also delete data on the schedule described above.
How to contact us
Email theshepherdgroup@cmghomeloans.com, call (808) 223-4118, or write to Keri Shepherd, CMG Home Loans, 500 Ala Moana Blvd., Suite 5-325, Honolulu, HI 96813.
Changes to this policy
If we change this policy, we will post the new version here and update the effective date at the top. If a change is material, such as adding analytics or using your information in a new way, we will also post a notice on the site before the change takes effect.