Operation Finance, Inc. d/b/a OperFi
Privacy Policy
Version 2026-09-18. Effective September 18, 2026. Replaces the policy dated May 16, 2019.
1. Who this covers
This policy describes how Operation Finance, Inc., a Texas corporation doing business as OperFi ("OperFi," "we," "us"), collects, uses, and discloses personal information. It applies to operfi.com and to every OperFi web property and portal, including the broker portal, the factoring company portal at factors.operfi.com, the carrier setup form, the payment status lookup, and the funding application.
OperFi provides accounts receivable factoring and related services to businesses. Most of the information we handle is business information about companies. Some of it identifies individuals, including sole proprietors, owner-operators, officers, beneficial owners, and the employees of our clients and their counterparties. This policy addresses that information.
2. Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identifiers | Name, business and mailing address, email address, telephone number, job title | You, our clients, public records |
| Business and regulatory identifiers | Legal entity name and DBA, USDOT number, MC number, EIN, state of formation, operating authority and insurance status | You, FMCSA, third-party data providers |
| Government identifiers | Social Security number and date of birth, where a sole proprietor or a beneficial owner must be identified; driver's license or other government ID | You |
| Financial and transaction information | Bank account and routing numbers, voided checks and bank letters, invoices, load and settlement detail, payment history, reserves, fees, credit decisions and limits | You, our clients, banks, our factoring system of record |
| Credit and risk information | Commercial credit reports and scores, payment experience, liens and UCC filings, bankruptcy and litigation records, fraud and identity signals | Credit bureaus and risk vendors, public records |
| Documents you send us | Rate confirmations, bills of lading, proof of delivery, invoices, notices of assignment and releases, W-9s, certificates of insurance, signed agreements | You, our clients, carriers, other factoring companies |
| Account and authentication data | Email address used to sign in, authentication events, sign-in times, roles and permissions, records of your acceptance of our terms | You, our identity provider |
| Device and usage data | IP address, browser and operating system, pages viewed, actions taken in a portal, timestamps | Automatically, when you use a portal |
| Communications | Email, telephone and text correspondence with us, and call records where a call is recorded | You |
We do not knowingly collect information from anyone under 18, and our services are not directed to children.
3. How we use it
- To provide factoring services: underwriting, verification, funding, collections, reserve and fee accounting, and reporting.
- To onboard and verify carriers, brokers, and factoring companies, including confirming operating authority, insurance, banking, and assignment status.
- To detect, investigate, and prevent fraud, identity theft, double brokering, and misdirected payments. This is a core use for us and a significant reason we collect identity and banking data.
- To operate, secure, support, and improve our portals.
- To communicate with you about transactions, accounts, and service changes.
- To comply with law, including tax reporting, sanctions screening, anti-money-laundering obligations, subpoenas, and other legal process.
- To establish, exercise, or defend legal claims.
We do not sell personal information for money. Some US state privacy laws define "sharing" broadly enough to include analytics and advertising cookies on a public website; where our marketing site's analytics fall within that definition, you can decline through the cookie banner on that site, and declining has no effect on any service we provide you. Nothing in the signed-in portals is sold or shared with anyone for advertising.
4. Cookies and tracking
Our signed-in portals and our public marketing site behave differently, so we describe them separately rather than making one claim that would be wrong about half of them.
4.1 The signed-in portals
We use no advertising cookies, analytics cookies, pixels, web beacons, or cross-site tracking of any kind in the portals. No third-party advertising is served there and no advertising network receives anything from them.
Visiting a portal sets no cookies at all. If you land on a portal sign-in page and leave without signing in, nothing is stored on your device by us. Cookies are set only once you actively begin signing in, and only these two:
| Cookie | Set when | Purpose | Lifetime |
|---|---|---|---|
factor_login_stateand its equivalents on our other portals |
You click Sign in | Protects the handoff to our identity provider against cross-site request forgery. Contains a single-use random value and nothing about you. | 10 minutes |
| Session cookie | You successfully sign in | Holds your authenticated session so you are not asked to sign in on every page. Encrypted and readable only by our servers. | Until it expires or you sign out |
Both are set with the HttpOnly, Secure, and
SameSite=Lax attributes, which means they cannot be read by
scripts, are sent only over HTTPS, and are not sent on cross-site requests.
Both are strictly necessary to deliver a service you have asked for, so the
portals do not present a cookie consent banner. If you block them, you will
not be able to sign in. Because the portals do no tracking, there is nothing
for us to change there in response to a Do Not Track or Global Privacy
Control signal.
4.2 The marketing site at operfi.com
Our public website is a normal marketing site and does use third-party services that set cookies:
| Service | What it does | Cookies |
|---|---|---|
| Google Analytics 4 | Measures how the site is used, so we can improve it. May pass information to Google advertising domains where Google advertising features are enabled. | _ga, _ga_* |
| Zoho SalesIQ | The live chat widget, and the session behind a chat you start. | Zoho session cookies |
| CookieYes | Records the cookie choice you make in the banner. | cookieyes-consent |
The marketing site presents a cookie consent banner, and the choice you make there is what governs these. You can change it at any time through the banner, and you can opt out of Google Analytics entirely with Google's browser add-on. None of this applies to the signed-in portals, which run none of it.
5. When we disclose information
- To our clients and their counterparties, as needed to fund, verify, and settle transactions. A factoring company sees payment information for carriers it has identified to us and for which it holds an assignment. It does not see the identity of our clients' customers.
- To service providers who act on our instructions: identity and authentication, hosting and databases, document storage, e-signature, credit and risk data, telephony and email, and payment processing. They may use the information only to provide the service.
- To banks and payment networks to originate and trace payments.
- To professional advisors, auditors, and insurers.
- For legal reasons: to comply with law or legal process, to respond to lawful requests from public authorities, to enforce our agreements, and to protect the rights, property, or safety of OperFi, our clients, or others, including fraud prevention and reporting.
- In a corporate transaction: to a successor or acquirer in connection with a merger, financing, or sale of assets, subject to this policy.
6. How long we keep it
We keep information for as long as needed to provide services and then for the periods required by our record retention obligations, applicable tax, banking, and commercial law, our agreements, and any legal hold. Transaction and funding records are typically retained for at least seven years after the relationship ends. Authentication logs and portal activity records are kept for a shorter period sufficient for security and audit purposes.
7. Security
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, encrypted session credentials, role-based access controls, least-privilege database access, and logging of administrative access to client records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If you believe your credentials have been compromised, contact us immediately at info@operfi.com.
8. Your choices and rights
You may ask us to access, correct, or delete personal information about you, to tell you how we have disclosed it, or to stop sending you marketing email. Marketing email also carries an unsubscribe link. Write to info@operfi.com or to the address in section 11.
Depending on where you live, you may have specific rights under state law, including rights to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, or targeted advertising, and to appeal a denial. Residents of Texas, California, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, and other states with comprehensive privacy laws may exercise the rights their state provides, including any right to opt out of sale, sharing, or targeted advertising. For our marketing site, the cookie banner is that opt-out. The signed-in portals involve no sale, sharing, or targeted advertising at all.
We will verify your request by matching the information you give us against our records, and will respond within the period your state's law allows. We will not discriminate against you for exercising a right. If we deny a request, you may appeal by replying to our response; we will inform you of the outcome and, where your state provides one, of your right to contact your state attorney general.
Note that many state privacy laws do not apply to information we hold about individuals acting in a commercial or employment capacity, and that some information cannot be deleted because we are required to retain it.
9. Third-party sites
Our sites may link to sites we do not control. This policy does not apply to them, and we are not responsible for their practices.
10. Changes
We may update this policy. We will post the revised version with a new version identifier and effective date, and where the change is material and affects portal users, we will present it at your next sign-in.
11. Contact us
Operation Finance, Inc. d/b/a OperFi
Attn: Privacy
610 Uptown Blvd., Suite 2000
Cedar Hill, TX 75104
info@operfi.com