Privacy Policy

Effective 25 September 2026

LoanLedger is operated by Maple Linens Inc., Canada. This policy explains what we collect, why, and how it is protected. We follow the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

• Account details: name, email, mobile number, an optional profile photo, and a password (stored only as a bcrypt hash).
• Loan records you enter: lender name, account or mortgage number, property name and address, loan amounts, rates, dates, payments and prepayments. We never ask for card numbers, online-banking logins or social insurance numbers.
• Usage records: sign-ins, approvals and changes (with IP address) in an audit log, and the questions you ask the AI assistant.

How it is used

Only to run the Service for your household: to show your ledger and calculations, to let your household admin manage members, and to answer your questions in the assistant. We do not sell or share personal information for marketing.

Who can see your records

Only the members of your household, according to the permission your household admin sets. The LoanLedger master admin can see household names, admin contact details, statuses and counts, but never loan amounts, balances or payments. Every request is checked on the server against the signed-in account's household.

AI assistant

When you ask the assistant a question, the figures from your household's ledger (loan facts, balances, totals, prepayments, allowance and next-payment details) and your conversation are sent to Google's Gemini API to generate the answer. Your name and email are not included beyond your first name and role. If you do not want this, do not use the assistant tab; the rest of the Service does not use it.

Security

• All traffic is encrypted in transit (HTTPS/TLS, HSTS).
• Passwords are bcrypt-hashed; session tokens are stored as SHA-256 hashes and expire after 30 days.
• Account/mortgage numbers and all API keys are encrypted at rest with AES-256-GCM using a key kept outside the web root.
• Profile photos are stored outside the web root and served only to the household.
• Data is stored on infrastructure operated by Maple Linens Inc.; nightly encrypted backups are kept for 7 days.

Your rights

You can view and edit your profile in the app. To export or delete your account and household data, email [email protected] from your account email; we act within 30 days. Deleting a household removes its properties, loans, payments and assistant history.

Retention

Records are kept while your household is active. Inactive households are deleted after 12 months unless you ask sooner.

Contact

Privacy questions: [email protected]. Maple Linens Inc., Canada.