This Privacy Policy describes how M4 Labs LLC, operating the BedrWay brand (“BedrWay,” “we,” “us,” or “our”), collects, uses, shares, and protects information about you when you visit our websites, submit a form, respond to a Meta (Facebook or Instagram) Lead Ad, call or text us, or otherwise interact with our mortgage lead generation services (collectively, the “Services”).
BedrWay is a mortgage lead generation service. We are not a lender, mortgage broker, credit reporting agency, or government agency. When you submit your information through our Services, you authorize us to share that information with one or more licensed mortgage loan officers, mortgage brokers, lenders, or related service providers (“Lender Partners”) so they can contact you about mortgage products and related services. Please read this Policy carefully — by submitting a form or responding to a BedrWay advertisement, you agree to the practices described here.
BedrWay is a brand operated by M4 Labs LLC (EIN 41-2467058), a Wyoming limited liability company. We provide an online lead generation platform that connects U.S. consumers interested in residential mortgage products with licensed Lender Partners.
This Policy applies to information collected through:
This Policy does not apply to the privacy practices of Lender Partners, lenders, brokers, or other third parties that may receive your information from us. Once your information is shared with a Lender Partner, that party becomes an independent controller of your information and is governed by its own privacy policy. We encourage you to review the privacy policy of any Lender Partner that contacts you.
For purposes of this Policy:
We collect the following categories of Personal Information about you, depending on how you interact with us:
_fbp, Meta click ID _fbc, Google click ID gclid)fb_lead_id)We do NOT pull, obtain, or store consumer credit reports. Credit-related fields are self-reported ranges only and are used to match you with appropriate Lender Partners. Any actual credit underwriting is performed by the Lender Partner directly with your separate authorization.
utm_source, utm_medium, utm_campaign, utm_content, utm_term)_fbp) and click ID (_fbc)gclid)We do not collect Social Security numbers, government-issued ID numbers, bank account numbers, biometric information, precise GPS geolocation, health information, or login credentials through our lead generation Services.
We collect Personal Information from the following sources:
We do not purchase consumer leads from third-party data brokers. Every lead in our system originated from a form, ad, or interaction the consumer initiated.
We use Personal Information for the following business purposes:
We do not use your Personal Information for purposes materially different from those described above without first providing notice and, where required, obtaining your consent.
When you submit a form on a BedrWay website or landing page, you are presented with — and by clicking the submit button you agree to — the following consent disclosure (or substantively equivalent language). The exact wording on the form you submitted is the controlling consent record:
“By clicking ‘Submit’ (or equivalent), I provide my prior express written consent to receive marketing and informational telephone calls and SMS/MMS text messages from BedrWay and up to [N] of its mortgage Lender Partners, at the phone number I provided, including calls and texts delivered using an automatic telephone dialing system, artificial or prerecorded voice, or autodialed/AI-dialed technology, regarding mortgage products and related services, even if my number is on a federal or state Do Not Call list. I understand that consent is not a condition of any purchase and that message and data rates may apply. Message frequency varies. I may revoke consent at any time by replying STOP to any text message, by asking the caller to remove me, or by emailing info@m4labs.co. I have read and agree to the Privacy Policy and Terms of Use.”
Your consent authorizes BedrWay and our Lender Partners to contact you using:
…about mortgage products and related services, even if your phone number is registered on the Federal Trade Commission’s National Do Not Call Registry or any state Do Not Call list. Federal Communications Commission rules under the Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, expressly permit calls and texts that are made with prior express written consent.
Outbound voice calls placed by BedrWay or its Lender Partners are signed in accordance with FCC STIR/SHAKEN call-authentication rules where required. This helps you verify that calls displaying our Caller ID are legitimate.
You may revoke your consent at any time and at no cost:
Revoking consent does not affect the lawfulness of communications sent before the revocation. Revocation may take up to 10 business days to take full effect across all systems.
Your consent to receive marketing calls and texts is NOT a condition of receiving any service from BedrWay, any quote from a Lender Partner, or any mortgage product. You may submit an inquiry through other means (such as emailing info@m4labs.co) without providing consent to autodialed calls or texts.
We share your Personal Information with the following categories of recipients:
When you submit a BedrWay form or Meta Lead Form, your information may be shared with one or more licensed U.S. mortgage Lender Partners. Each Lender Partner becomes an independent controller of your information and will use it according to its own privacy policy. Lender Partners may include:
The number of Lender Partners that receive your information depends on the consent language on the form you submitted. Some forms authorize sharing with a single matched Lender Partner; others authorize sharing with multiple. The form you submitted is the controlling consent.
We use the following categories of Service Providers to operate the Services. Each is bound by a written contract that limits their use of Personal Information to the services they provide to us:
| Service Provider Category | Purpose | Examples |
|---|---|---|
| Hosting and database | Store and process lead data | Supabase (EU region) |
| Frontend hosting | Serve websites and landing pages | Vercel (US region) |
| Workflow automation | Route leads between systems | Make.com (EU region) |
| CRM and lead routing | Distribute leads to Lender Partners | GoHighLevel (US region) |
| Consent capture | Independent proof of TCPA consent | TrustedForm / ActiveProspect (US region) |
| Advertising measurement | Match and attribute ad-driven leads | Meta Conversions API (US region) |
| Analytics | Measure site usage | Google Analytics or equivalent (US region) |
| Email delivery | Send transactional and marketing email | SMTP and email delivery providers |
| SMS delivery | Send SMS through Lender Partner CRMs | Twilio and equivalent telephony providers |
We may add or change Service Providers from time to time. Any new Service Provider will be bound by equivalent contractual protections.
We may disclose Personal Information when we reasonably believe disclosure is required to:
If BedrWay or M4 Labs LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your Personal Information may be transferred to the successor or acquiring entity as part of that transaction, subject to standard confidentiality protections.
We may disclose Personal Information to any other party at your direction or with your consent.
For transparency: Under the broad definitions of “sale” and “sharing” in the California Privacy Rights Act (CPRA) and similar laws in other U.S. states, the transfer of your Personal Information to a Lender Partner in exchange for a fee constitutes a “sale” of Personal Information. The transmission of advertising and conversion data to Meta, Google, and other advertising platforms may constitute “sharing” for cross-context behavioral advertising purposes.
We disclose this openly and rely on the prior express consent you provided through the lead form. You have the right to opt out of the sale and sharing of your Personal Information at any time — see Section 11 for California residents and Section 12 for residents of other states.
We retain Personal Information only as long as reasonably necessary for the purposes described in this Policy and to comply with applicable law. Specific retention periods include:
| Category of Information | Retention Period |
|---|---|
| Lead form submissions and contact details | Up to 7 years after submission, to comply with Gramm-Leach-Bliley Act (GLBA) financial record-keeping obligations |
| Consent records (including TrustedForm certificates) | At least 5 years after the last contact, to evidence TCPA compliance |
| Communications records (call logs, SMS records) | Up to 4 years |
| Advertising and attribution data | Up to 2 years |
| Website analytics (cookies, IP addresses) | Up to 24 months |
| Records related to disputes or active legal matters | Until the matter is fully resolved, plus the applicable statute of limitations |
After the applicable retention period, we delete, de-identify, or anonymize Personal Information in accordance with our internal retention schedule. You may request deletion at any time as described in Section 11 and Section 12.
We and our Service Providers use cookies, pixels, software development kits (SDKs), web beacons, and similar technologies on our websites and in our emails to:
The categories of tracking technologies we use include:
_fbp, _fbc) and click identifiers (gclid, fbclid, utm_*) to measure ad performance and to enable conversion measurement via the Meta Conversions API and similar APIs.You can manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies, although doing so may affect Service functionality.
Global Privacy Control (GPC): We honor browser-based GPC signals as a valid request to opt out of the sale and sharing of Personal Information for visitors from California and other states whose laws require recognition of opt-out preference signals.
We do not currently honor “Do Not Track” browser signals because there is no industry-standard interpretation of those signals.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), gives you the rights described in this section.
We collect the categories of Personal Information described in Section 3. We collect this information for the business and commercial purposes described in Section 5. We sell and share this information with Lender Partners and advertising platforms as described in Sections 7 and 8. We retain this information for the periods described in Section 9.
| CCPA Category | Examples Collected | Source | Business Purpose | Sold / Shared |
|---|---|---|---|---|
| A. Identifiers | Name, email, phone, IP, mailing address, online identifiers, fb_lead_id | You; Meta Lead Ads; cookies | Lead matching, communication, fraud prevention | Yes — sold to Lender Partners; shared with ad platforms |
| B. Customer records (Cal. Civ. Code § 1798.80(e)) | Name, telephone, address | You | Lead matching, communication | Yes — sold to Lender Partners |
| C. Protected classifications | Not collected | — | — | No |
| D. Commercial information | Mortgage inquiry details (loan purpose, property type, timeline) | You | Lead matching | Yes — sold to Lender Partners |
| E. Biometric information | Not collected | — | — | No |
| F. Internet/network activity | Browser, OS, pages viewed, referrer, ad IDs, UTM | Cookies; ad platforms | Analytics, attribution, fraud prevention | Yes — shared with ad platforms |
| G. Geolocation | State, ZIP, IP-based approximate location (no precise GPS) | You; cookies | Lender licensing match, attribution | Yes — sold to Lender Partners |
| H. Audio / electronic / visual | Call recordings (where lawful, with notice); SMS records | Calls and SMS | Service quality, dispute resolution | No |
| I. Professional / employment | Self-reported employment type (if asked) | You | Lender matching | Yes — sold to Lender Partners |
| J. Education | Not collected | — | — | No |
| K. Inferences | Lender-fit scoring derived from above | Internal | Lead matching | Yes — sold to Lender Partners |
| L. Sensitive Personal Information | Self-reported credit score range, household income range, home value (treated as Sensitive PI under CPRA) | You | Lender matching | Yes — sold to Lender Partners (you may limit; see Section 11.4) |
As a California resident, you have the right to:
You may also use an authorized agent. We will require reasonable proof of authorization.
We will respond to verifiable consumer requests within 45 days, with a possible extension of an additional 45 days where reasonably necessary, and we will notify you of any extension.
California residents may request information regarding our disclosure of Personal Information to third parties for direct marketing purposes by contacting us at info@m4labs.co.
If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, New Jersey, Delaware, New Hampshire, Minnesota, Maryland, Rhode Island, or any other U.S. state with a comprehensive consumer privacy law in effect, you have rights similar to those described above for California, including:
Maryland (MODPA — effective October 1, 2025): Maryland imposes additional data minimization requirements. We limit our collection of your Personal Information to what is reasonably necessary and proportionate to provide the requested mortgage-matching service and to perform the purposes disclosed in this Policy. We will not sell your Sensitive Personal Information.
Minnesota (MCDPA — effective July 31, 2025): You have an additional right to question the result of profiling that produces a legal or similarly significant effect, and to be informed of the reason for that profile.
Tennessee (TIPA — effective July 1, 2025): Same core rights as above.
We will respond within 45 days where required by your state’s law, with a possible 45-day extension where reasonably necessary.
The Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. § 6801 et seq., regulates the collection, use, and disclosure of “nonpublic personal information” by financial institutions. Although BedrWay is a lead generation service rather than a lender, we treat the information you provide through the Services as nonpublic personal information protected by GLBA principles:
The Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681 et seq., governs consumer reporting agencies and the use of consumer reports. BedrWay is not a consumer reporting agency. We do NOT pull, request, or store consumer credit reports.
If a Lender Partner subsequently obtains your authorization and pulls your credit report, that pull is governed by the Lender Partner’s own FCRA disclosures and consumer-report practices, not by this Policy.
You can stop receiving marketing communications from BedrWay and our Lender Partners as follows:
| Channel | How to Opt Out |
|---|---|
| SMS / Text messages | Reply STOP to any text. We will send one confirmation and stop. |
| Phone calls from BedrWay | Tell the caller to add you to our internal Do-Not-Call list, or email info@m4labs.co with subject “Do Not Call.” |
| Phone calls from Lender Partners | Ask each Lender Partner directly. We will, on request, notify Lender Partners of your revocation. |
| Click “unsubscribe” in any email, or email info@m4labs.co. | |
| National Do Not Call Registry | Register at donotcall.gov. (Note: your prior express written consent overrides Do Not Call status until revoked.) |
| Browser-based opt-out | Enable Global Privacy Control (GPC) in your browser. We honor GPC as an opt-out of sale and sharing where required. |
We process opt-out requests within 10 business days, and in any event within the timeframes required by applicable law.
The Services are intended for adults aged 18 or older. We do not knowingly collect Personal Information from children under 13 in violation of the Children’s Online Privacy Protection Act (COPPA), nor do we knowingly market to anyone under 18.
If you believe we have inadvertently collected Personal Information from a child under 13, please contact us at info@m4labs.co and we will delete the information promptly.
We maintain administrative, technical, and physical safeguards reasonably designed to protect Personal Information against unauthorized access, disclosure, alteration, or destruction. These include:
No security measure is perfect, and we cannot guarantee that Personal Information will never be subject to unauthorized access. In the event of a security breach affecting your Personal Information, we will notify you and applicable regulators as required by law (including state breach-notification laws).
BedrWay is a U.S.-based service operated by M4 Labs LLC, a Wyoming limited liability company. Our Services are directed to U.S. consumers only and we do not solicit business from individuals outside the United States. Some of our Service Providers may store or process data outside the United States (for example, Supabase database operations in the European Union). Where such transfers occur, we rely on standard contractual safeguards and data-processing agreements with those providers.
BedrWay’s Services are intended for U.S. residents. If you access the Services from outside the United States, you understand that your Personal Information may be processed and stored in countries other than your own, including the United States (via our frontend hosting and CRM providers) and the European Union (via our database and workflow-automation providers, located in EU regions).
If you reside in the European Economic Area, the United Kingdom, or Switzerland and your Personal Information is nonetheless collected, our lawful bases for processing under the GDPR are:
You have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent under the GDPR, exercisable by emailing info@m4labs.co. You also have the right to lodge a complaint with a supervisory authority.
For transfers of Personal Information from the EEA, UK, or Switzerland to the United States or other non-adequate jurisdictions, we rely on Standard Contractual Clauses and equivalent transfer mechanisms with our Service Providers.
When you submit a Meta (Facebook or Instagram) Lead Form attached to a BedrWay advertisement, the form data is collected on Meta’s platform and delivered to BedrWay through Meta’s Lead Ads API. The data Meta makes available to us — including your name, contact details, and form responses — is then governed by this Privacy Policy from the moment we receive it.
We use the Meta Pixel and the Meta Conversions API to measure the performance of our advertisements and to attribute conversions to specific campaigns. Personal Information sent to Meta for these purposes is hashed (one-way SHA-256) before transmission. We do not send to Meta any of the FCRA-regulated financial-range fields (credit score, income, home value).
Meta is an independent controller for the data it collects directly from you on its platform. Please review Meta’s Privacy Policy at facebook.com/privacy/policy for information on how Meta processes your data.
Our Services may contain links to third-party websites, including the websites of Lender Partners. This Policy does not apply to those third-party websites. We encourage you to review the privacy policies of any third-party site you visit.
We may update this Policy from time to time to reflect changes in our practices, our Services, or applicable law. The “Last updated” date at the top of this Policy indicates when it was last revised. We will provide notice of material changes by posting the revised Policy on our website and, where required by law, by other appropriate means (such as email). Your continued use of the Services after the effective date of an updated Policy constitutes your acceptance of the changes.
If you have questions about this Policy, want to exercise any of the rights described above, or wish to file a complaint, please contact us:
Data Controller / Operator of the BedrWay brand:
M4 Labs LLC (EIN 41-2467058)
30 N Gould St, Ste R
Sheridan, WY 82801
United States
Privacy contact email: info@m4labs.co
Phone: (321) 327-9574
Privacy mailing address: Same as above
For California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, New Jersey, Delaware, New Hampshire, Minnesota, Maryland, Rhode Island, and other state privacy requests: include the relevant state in the subject line
Governing law and disputes: This Policy is governed by the laws of the State of Wyoming and applicable U.S. federal law. With respect to U.S. consumer-rights claims, the laws of the U.S. state in which the consumer resides also apply. Disputes that cannot be informally resolved are subject to the dispute-resolution provisions of our Terms of Use.