Privacy Policy

1. Scope and who is responsible

This Privacy Policy explains how LoonieLodge Inc. handles personal information in connection with LOONIELODGE. We are the organization responsible for your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector ("Law 25").

2. Information we collect

• Account information: your name, email address, password (stored only as a secure hash), language preference, two-factor authentication settings, and a record of when you accepted these documents and which version.
• The province or territory you live in, if you tell us. This one is not for you: we ask it so we can see which provinces our members are in, and that is its only use. Answering is optional and you can clear it again at any time from your settings; if you leave it blank we do not guess it from anything else, and you are counted as ‘not stated’. It is only ever a count — no feature reads it, it never changes what you see or what you pay, and it is not shared with anyone.
• Mortgage and property information: lender, rate, balances, terms, payments, prepayments, the nickname and estimated value you give a property, its occupancy, the province or territory it is in, insurance, and related figures you enter — including what it costs you to hold: property tax, condo fees, heating and home insurance. If you record your property-tax bills, we also hold, for each year, the amounts billed, the due dates and amounts of their instalments, whether and when each instalment was paid, and whether your lender or you pay the bill. All of those are optional, and we only have them if you type them. A property's province is used to estimate your closing costs, to show you that province's property-tax deadlines, and, if you rent the property out, to name the right year-end tax forms and, in Ontario, to compare its tax increase with the rent increase guideline — and for nothing else. If you dismiss one of those deadline cards, we keep a record of which card and which year, so it stays dismissed on the website and in the app. We do not ask for or store a property's street address.
• Affordability estimates: if you use the affordability calculator and choose to save an estimate, we keep the figures you entered — household income, monthly debt payments and down payment — but never the result, which is recalculated each time you look at it. Estimates you save are private to you. If your account is managed by a partner, runs your broker prepares for you are separate and visible to them, and you can delete those at any time.
• Plans you activate: if you turn a saved simulation into a plan, we keep the levers you committed to, the dates you said you would act on, and whether each step was carried out. This is a record of what you intend to do with your own money, so we hold it only while the plan is running and for two years after it ends, and we use it for one purpose — reminding you as each date comes, in the app and by email. You can pause the reminders without losing the plan, end the plan at any time, and turn the emails off entirely from your notification settings. We never keep a second copy of the money: a step is marked done by the prepayment you record against the mortgage itself.
• Co-borrower information: names and email addresses you enter about other people connected to a mortgage.
• Records you restore from an export: if you open a LOONIELODGE export to bring your mortgages back — moving to a new account, or returning after closing one — we read your properties, mortgages, terms, payments, prepayments, rate changes, property-tax bills and their instalments, and co-borrower records from it and store them as new records on your account. This adds no category of information beyond what is already listed above; what differs is where it came from, so we log that an import happened and how much arrived. We do not keep the file itself, and we do not restore anything that is our own record of what we did — notifications, billing, support requests, community activity or the audit trail — or that would assert someone else's consent.
• Billing information: which plan and term you hold, the price you paid and when, when it started and ends, the version of our Terms you accepted and when, when we sent renewal notices and the contract copy, and the Stripe or Apple reference for the purchase. Card payments are processed by Stripe, or by Apple for purchases made in the iPhone app; we do not receive or store your full card number. Stripe also keeps the version of our Terms you accepted and when you accepted it, with the payment record.
• AI usage counts: how many LLODGE questions you have used in each period of your plan, and, for each request we send to our AI provider on your behalf, which feature sent it, which model answered, how much text it used (counted in tokens), its estimated cost, and whether it succeeded. These records never contain what you asked, what was answered, or any figure about your mortgage. The records of individual requests are linked to your account only once you have accepted this version of the Terms and Privacy Policy; until then they are kept without your account identifier.
• Plan events: the dates on which you bought a plan, moved from the Free plan to a paid one, or cancelled a plan, your account moved to the Free plan, or you used all of a period's LLODGE questions — with the plan, the term, and whether the purchase was made on the website or in the app. We use them only to count, in totals, how many people choose, keep and leave each plan.
• Support requests: the messages you send us, and the rating and comments you leave once a request is resolved. The support desk does not accept file attachments, so we hold no documents you have sent us.
• Community activity: the topics, replies and reactions you post — including those you post anonymously, which are hidden from other members but stay linked to your account internally so the space can be moderated — along with your reputation score, any reports you file, and the members you block.
• Suggestions: the product ideas you send us and the ideas you vote for. A suggestion is private by default — only you and our administrators can see it — and it is never made public unless you have agreed to that in advance or in answer to a request. When you agree, you choose whether it carries your name or appears anonymously, and you can take a suggestion back at any time before it is answered.
• Partner applications: if you apply to join our partner program, your legal name (including any middle name), the province or territory you are licensed in, your professional registration number, and optionally your brokerage. We collect these for one purpose — to find you on your regulator's public register and confirm you are licensed — and we ask your permission to make that check before you submit. Only our administrators see them. They are not shown to clients, not used for marketing, and not shared with anyone.
• Devices and sessions: your sign-in activity, and for any device you connect, its name, platform, app version, when it was last used, and its push-notification registration.
• Referral information, if a referral programme is running: the referral code issued to your account, the fact that one account signed up through another account's link, and the rewards earned and when. We do not collect anything about your payment card for this purpose. An earlier version of this programme paid in free subscription time and hashed the card behind a first payment to detect self-referral; the reward is now extra capacity on the account that earned it, which nobody gains by faking, and that collection was removed rather than kept in case it became useful.
• Security and technical data: hashed IP addresses used to limit abuse (we do not keep the addresses themselves), audit records of sensitive actions on your account, and cookies strictly necessary to keep you signed in and to remember your language.
• Usage of our public pages: when you visit a page anyone can reach — the home page, pricing, the free calculator — we count the visit and measure how quickly the page loaded. That record holds the page you viewed, the site that referred you, your browser, your device type and your country. It sets no cookie, keeps no identifier that follows you from one day to the next, and is not loaded on any screen you have to sign in to reach. We use it to see which pages people find useful and which are too slow.

3. Why we use it and our legal basis

We use your information, with your consent, to: create and secure your account; run the mortgage engine, simulations, reminders, and notices about your repayment progress; power the LLODGE assistant using your own mortgage figures; process the billing for your plan; count your LLODGE questions against your plan and keep the cost of our AI features within a daily limit; count, in totals, how many people start, keep and leave each plan; send you service and notification emails; provide support; operate the community forum; understand what to build next from the suggestions you send us; run any referral programme and check that rewards are genuinely earned; and meet legal obligations. We do not sell your personal information, and we do not use it for third-party advertising.

4. Service providers and sharing

We share personal information only with service providers that help us operate the Service, under contracts that limit their use of it, and where required by law. Our key providers are:

• Supabase (database hosting, Montréal, Canada) — stores your account and mortgage data.
• Vercel (application hosting, Montréal, Canada) — runs the app. We store no uploaded files anywhere, so there is no file storage in this list.
• Stripe (payments, United States) — processes subscriptions and card payments.
• Apple (in-app purchases on iOS, United States) — sells the plans bought inside the iPhone app, renews the subscriptions, and tells us whether a purchase is active. We never see your card; Apple sends us a transaction identifier and the purchase's status.
• OpenAI (AI features, United States) — receives the mortgage figures behind an advisor answer, the questions you ask the in-app assistant, what you write when you describe a mortgage to the setup assistant instead of filling the form in yourself — that is your own free text and can carry whatever you put in it, so we remove email addresses, phone numbers, postal codes, nine-digit government numbers, payment card numbers and civic addresses before it is sent, and we never send the nickname you give a property — the figures behind a Bank of Canada rate-change notification — including your lender's name — community posts and replies as they are screened before publication, the text of a suggestion when it is screened for personal information, the full text of a support request thread when a reply is drafted or summarised for staff, a partner's draft text when the Polish button rewrites it — which can include a partner application's legal name and licence number, or a note about a named client — and an entry from our internal audit trail when an administrator expands it to read a plain-language explanation. An audit entry can record an action taken on your account; it is masked before it is sent, with email addresses obscured, the entry's details redacted, and record identifiers shortened. This is every path in production; a new one is added here in the same change that ships it.
• Resend (email, United States) — delivers notification and account emails.
• Expo (push notifications, United States) — receives the title and text of a notification if you have connected a mobile device, and hands it to Apple (APNs) or Google (Firebase Cloud Messaging) to deliver to that device.
• Sentry (error monitoring, United States) — receives a report when the mobile app crashes — what the app was doing and where the code failed, with no account attached.
• Google Analytics (website analytics, United States) — counts visits to our public pages — which page was viewed, the site that referred you, your browser, device type and approximate region. It is configured to store nothing on your device: no cookie is set, no identifier is kept that would recognise you on a later visit or on any other website, and no advertising signal is sent. It is not loaded on any screen you have to sign in to reach. We also send it a count of accounts created, with no information about who created them.
• Vercel Analytics (website analytics, United States) — counts visits to our public pages and measures how quickly they load — which page was viewed, the site that referred you, your browser, device type and country. It sets no cookies, keeps no identifier that follows you between days, builds no profile of you across sites, and is not loaded on any signed-in screen.

5. Partners who manage your account

Some accounts are set up and administered by a partner — a broker, advisor, or other organization that uses LOONIELODGE to work with the people they serve. A partner is a separate organization from us.

Before anyone becomes a partner we check their professional registration against their provincial regulator's public register, and we record who checked it, against which register, and when the licence they showed us expires. We do not re-check it continuously: a partner whose licence lapses cannot take on new clients until we have verified it again, and an administrator can suspend a partner while a question about their registration is being settled.

A partner who manages your account can always see that your mortgages exist, who the lender is, and when the term matures. They cannot see your financial figures — balances, rates, payment amounts, property values, income or debts — unless you have approved it.

To see those figures, or to act on your file, your partner has to ask you. You decide whether to agree, whether to allow acting as well as viewing, and for how long, from a short list of periods. You are shown the date the access ends before you agree to it, and you can end it earlier at any time from Settings. If you say no, or say nothing, nothing changes.

Renewing, restructuring, discharging and deleting your mortgages are yours. Your partner can do those things only while you have granted them access to act, and only for as long as that access lasts.

You can ask to be released from partner management at any time from your settings. Once you are released, the partner's access to your mortgages ends and the mortgages become yours alone.

6. Transfers outside Canada

Your account and mortgage data are stored in Montréal, Canada, by Supabase, our database host, and the application itself runs on Vercel's servers in the same city. Every other provider listed above is located in the United States or processes data there. We do not claim from this that your data never leaves Canada, and you should not read it that way: a Canadian region changes where the data is kept and where our code executes, not who operates the machines — Supabase and Vercel are both United States companies — and the other providers still receive what the list above says they receive.

So some of your personal information is still transferred outside Canada — to those providers, for the purposes listed beside them — and may be accessible to foreign authorities under the laws of those countries. We take reasonable contractual and security measures to protect it. By using the Service you consent to this transfer. For Quebec residents, we conduct the privacy assessments Law 25 requires before such transfers.

7. Automated processing, the LLODGE assistant, and moderation

When you use the LLODGE assistant, the mortgage figures for that mortgage are sent to our AI provider to generate an explanation. The advisor is informational only, does not provide licensed advice, and makes no decision about you.

Whether LLODGE answers depends on the plan you hold and the questions left in it. That is the plan you bought, applied as our Terms describe — not an assessment of you — and if you think it has been applied wrongly, you can reach a person using the details below.

You can also set a mortgage up by describing it to an assistant instead of filling in the form. What you type is sent to our AI provider to work out which figures you mean. The assistant fills the form in and nothing is saved until you check it and press the button yourself — it cannot create a mortgage. Before your words are sent we remove email addresses, phone numbers, postal codes, nine-digit government numbers, payment card numbers and civic addresses, and we never send the nickname you give a property. None of that is needed, and the form remains available if you would rather not use the assistant at all.

Community posts are screened automatically before they appear. Content the screen flags is not rejected: it is kept off the public list and queued for a person to review. Decisions that affect your account — removing content, a posting ban, a suspension — are made by a person, not by the screen.

Suggestions are screened the same way, for a narrower purpose: to notice personal or financial details before anything is published. A flagged suggestion is never rejected and is always still visible to you; it simply cannot go on the public board until an administrator has read it.

When an administrator reviews our internal audit trail, an entry can be summarised in plain language so that the review is readable. The summary is written from the masked entry, may only restate what the entry already records, and makes no decision about you.

We do not use any of this to profile you. One decision is made automatically, with no person reviewing it first: an account left signed out for 250 days is deleted, along with its mortgages, unless you sign in before then — that is all it takes to stop it. We tell you by email before it happens and again shortly before the deadline, and you can reach a person by replying to either email, or using the details below about any decision affecting your account.

8. How long we keep it

We keep your information while your account is active. When you delete a mortgage or close your account, we retain it for a short cooling-off period (so you can undo the request) and then permanently delete it. If your account is inactive for a long period, we warn you by email and then delete it after a grace period.

The inactivity deletion does not apply to every account. We do not delete an account that has a live paid or complimentary subscription, one that an administrator has disabled, one a partner set up and manages for you, or one with no email address on it — we never delete an account without warning it first, so an account we cannot write to is never deleted this way. In those cases the account stays until it is closed some other way. It does not apply to our own staff accounts either.

Some records are kept on their own schedule and deleted automatically once it runs out:

• Audit records of sensitive actions on your account: 5 years.
• Notifications: 12 months after you have read one, and 24 months in any case.
• Conversations with the AI advisor: 12 months after the last message in one. The clock restarts every time you add to a conversation, so nothing you are still using is deleted by this.
• AI usage records: 400 days, then deleted.
• Your LLODGE question count for a period: 400 days after that period ends.
• Plan events: 2 years.
• A mortgage you started describing to the setup assistant and did not finish: 30 days after you last added to it. We keep the figures so you can pick it up again; we do not keep the conversation itself at all. Finishing it deletes the draft in the same moment the mortgage is created.
• Affordability estimates you saved: 24 months after you last touched one. These hold the household income, monthly debt payments and down payment you entered, and after two years they are not merely old but wrong — you can delete one yourself at any time before then.
• Support requests sent from your account: 24 months after the request is resolved or closed, and 3 years from when it was sent in any case — including one that was never settled. The messages on it go with it.
• Support requests sent through the public form without an account: 12 months after the request is closed, and 24 months from when it was sent in any case — including a request that was never closed.
• Devices you have signed out: 90 days after you sign one out. Until then we keep the device name you gave it and the date it was signed out, so an unexpected sign-out can still be looked into.
• Suggestions: kept as a record of what we built and why, but no longer linked to you 24 months after we have answered them or you have withdrawn them, and 3 years after you sent one in any case — including one we never answered.
• Partner applications: if we approve you, 7 years from the decision — it is the record of the basis on which you were given access to other people's financial information. If we do not approve you, 18 months, so we can answer questions about the decision. If you withdraw one, 90 days. After that we remove your legal name and registration number and keep only the fact that an application was made and how it ended.
• Short-lived technical records, such as abuse-prevention counters and the keys used to recognise a retried request: 7 days.
• One list is deliberately kept with no time limit, and we would rather say so than leave it out: if an email we send you bounces permanently, or you report one of ours as spam, we record that email address so that we stop sending to it. That record has to outlive the account it came from — otherwise closing an account and opening a new one with the same address would start the mail again, which is exactly what a spam report asked us not to do. It holds the address, the reason and the date, and nothing else. Ask us using the details below and we will remove it.

9. What stays behind, and what the law requires

Community posts remain in the discussion when an account is closed, but stop being attributed to anyone — the thread is also a record of the conversation for the members who took part in it. The same applies to messages on a support request that involved someone else, and to suggestions, which stay as the record of why a feature exists but stop being attributed to you. Votes you cast on other people's suggestions are deleted outright. We keep limited records where the law requires, for example billing records. Those sit with Stripe, our payment processor, in the United States: when your account is destroyed we strip your name, email address, telephone number and billing address from your customer record there and detach every saved payment method, so no card details stay attached to it, and we mark the record with the date of the deletion. What remains is the financial history itself — the payments and invoices — which tax and financial-record law requires us to keep.

When your account is deleted, the AI usage records, plan events, and plan records that concerned you are deleted with it, and only daily cost totals that name no one are kept; the payment records stay with Stripe or Apple, as described above.

10. Your rights

Subject to legal limits, you have the right to: access the personal information we hold about you; correct it; export a copy of your data; withdraw consent and delete your account; and, for Quebec residents, additional rights under Law 25. You can export or delete your data from your security settings, or contact us using the details below. You also have the right to complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

11. Security

We protect your information with encryption in transit and at rest, hashed passwords, optional two-factor authentication, access controls, and audit logging on sensitive actions. No system is perfectly secure, but we work to protect your data and will notify you and the appropriate regulator of a breach that poses a real risk of significant harm under federal law — or, for a Quebec resident, a risk of serious injury under Law 25 — as the law requires.

12. Cookies

We use cookies that are necessary to operate the Service — to keep you signed in and to remember your chosen language. If you arrive through someone's referral link, we also set one cookie holding only that referral code, so the invitation can be credited if you create an account; it is set by us and no one else, it lasts 30 days, it holds nothing that identifies you, and it is deleted as soon as you sign up. We do not use advertising or third-party tracking cookies, and we do not track you across other websites.

13. Children

The Service is for adults at the age of majority in their province or territory. We do not knowingly collect personal information from minors. If you believe a minor has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy. If a change is material we will take reasonable steps to notify you. The effective date at the top shows when it last changed.

15. Contact and Privacy Officer

To exercise your rights or ask a privacy question, contact our Privacy Officer, LoonieLodge Team, at admin@loonielodge.com. The name of the person who holds this role is available on request. General contact: admin@loonielodge.com · LoonieLodge Inc., 2148 Carling Avenue, Unit #2, Suite 1031, Ottawa, ON K2A 1H1, Canada.