Privacy Policy

1. Information We Collect

We collect the minimum information needed to provide our service:

• Account information: your name, email address, and profile image from your authentication provider (Google or GitHub) when you sign in.
• Loan file data: loan parameters you enter (loan type, occupancy, property type, borrower name, etc.) and the generated readiness checklists.
• Uploaded documents: files you upload to checklist items (PDFs, images, Word documents) are stored in secure cloud storage.
• Payment information: if you subscribe to a paid plan, payment details are collected and processed by Stripe. We do not store your credit card number, CVC, or full card details on our servers.
• Usage data: we maintain audit logs of actions taken within the Service (file creation, document uploads, sign-in events) for security and troubleshooting purposes.

2. How We Use Your Data

Your data is used solely to provide, maintain, and improve the Loanwright service. We do not sell, rent, or share your personal information or loan file data for marketing or any other purpose. Data is shared only with the infrastructure providers listed in Section 5 as required to operate the Service.

3. Cookies and Sessions

We use essential cookies to maintain your authenticated session. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use tracking cookies, analytics cookies, or advertising cookies. No third-party trackers are loaded.

4. Data Security

All data is encrypted in transit using TLS. Our database provider (Neon PostgreSQL) encrypts data at rest. Uploaded documents are stored in Vercel Blob Storage with access mediated through authenticated server routes. Access is scoped to your authenticated session; you can only view your own loan files, documents, and results. All server actions validate inputs and verify authentication before reading or writing data.

5. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and all associated data (including uploaded documents) at any time by contacting us. Upon receiving a verified deletion request, we will remove your data within 30 days, except where retention is required by law.

6. Third-Party Services

We use the following third-party services to operate Loanwright. Each has its own privacy policy:

• Google & GitHub (via Auth.js): authentication and identity verification.
• Neon PostgreSQL: database hosting (stores account data, loan files, checklists, and audit logs).
• Vercel: application hosting and blob storage for uploaded documents.
• Stripe: payment processing for paid subscriptions. Stripe receives your payment method details and billing address directly. See Stripe's Privacy Policy.

7. Your Rights (Including CCPA/CPRA)

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Delete your personal information and account.
• Correct inaccurate personal information.
• Know what categories of personal information we collect and how it is used.
• Opt out of the sale or sharing of personal information. We do not sell or share your personal information, so this right is satisfied by default.
• Non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us at hello@loanwright.io. We will respond within 30 days.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will promptly delete that information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice within the Service. The "Last updated" date at the top of this page indicates the most recent revision.

10. Contact

If you have questions about this policy, please reach out to us at hello@loanwright.io.