That is a huge violation of privacy policies of all major lenders / banks and is a disclosure in most loan packets. (biggerpockets.com)
This will be explained in privacy policies and terms of service, as well as individual contracts between the provider and user. (lawtechnologytoday.org)