Online / website
Use the Catapult Contact page and state that the message is a “California Privacy Request.” Do not include SSN, bank passwords or full account credentials in the initial message.
Open Contact pageCalifornia Privacy Rights · CCPA / CPRA
California Consumer Privacy Act (CCPA)
California residents may have rights over personal information, including rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive information and avoid discrimination where the CCPA applies.
On this page · 7 sections
California privacy rights.
This page is provided to explain and facilitate California privacy choices. The CCPA applies only when its coverage requirements are met, and exemptions may apply to particular information or processing.
Where the CCPA applies, California residents may have the rights shown below.
| Right | What it can mean |
|---|---|
| Know / access | Ask for categories and, in appropriate cases, specific pieces of personal information, sources, purposes and categories of recipients. |
| Delete | Ask for deletion of personal information collected from you, subject to legal and operational exceptions. |
| Correct | Ask to correct inaccurate personal information. |
| Opt out of sale or sharing | Direct a covered business to stop selling personal information or sharing it for cross-context behavioral advertising. |
| Limit use/disclosure of sensitive information | Limit certain uses of sensitive personal information where that right applies. |
| Non-discrimination | Exercise applicable privacy rights without unlawful discriminatory treatment. |
Do Not Sell or Share My Personal Information.
Catapult does not state that it sells personal information for money. A loan-loan application process can involve disclosure of information to specifically identified providers or networks so that the request can be evaluated. Whether a particular disclosure is legally treated as a “sale” or “sharing” depends on the processing, purpose and applicable law.
Where an opt-out right applies, you may direct Catapult to stop covered sale or sharing. A valid Global Privacy Control signal is recognized as an opt-out signal where required by applicable law.
How to submit a California privacy request.
Phone
Call (813) 400-0402 and ask to route a California privacy request.
Write to Catapult Funding, Inc., 100 Ashley Dr S #600, Tampa, FL 33602. Include enough information to identify the request but avoid sending unnecessary sensitive data.
Verification and authorized agents.
Access, deletion or correction requests may require reasonable verification so that information is not disclosed or changed for the wrong person. Information collected for verification should be used for that purpose and related security/compliance needs.
An authorized agent may submit a request where permitted. Catapult may request proof of authority and, when allowed, direct verification or confirmation from the consumer.
Response timing and exceptions.
For verified requests to know, delete or correct, covered businesses generally respond within 45 calendar days and may extend the response period when permitted and with notice. Covered opt-out requests must be handled as soon as feasibly possible and, under current California guidance, within the applicable statutory/regulatory period.
A request can be limited or denied when an exemption applies, identity cannot be verified, information must be retained for a legal reason, or another lawful exception applies. When appropriate, the response should explain the basis.
Global Privacy Control (GPC).
GPC is a browser-based signal that can communicate a user’s preference to opt out of sale or sharing. California guidance treats a valid GPC signal as an opt-out request for covered businesses where the right applies.
Privacy choices can be browser/device specific depending on the technology and processing. Review the Privacy Policy for the broader data-handling context.
Requests about a lender or other provider.
If your information is held by a lender, servicer, application provider or other company that received it, that company may be a separate business/controller and may require a request through its own privacy channel. Use the privacy notice or agreement provided by that company.
Catapult can address Catapult-controlled website data, but it cannot guarantee deletion or correction inside a separate company’s systems.
Need help with a different question?
Use the loan guides or support routes to get to the page that owns your question.