Privacy Policy

1. Scope and who is responsible

This Privacy Policy explains how LoonieLodge Inc. handles personal information in connection with LOONIELODGE. We are the organization responsible for your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector ("Law 25").

2. Information we collect

• Account information: your name, email address, password (stored only as a secure hash), language preference, two-factor authentication settings, and a record of when you accepted these documents and which version.
• Mortgage and property information: lender, rate, balances, terms, payments, prepayments, property address and value, occupancy, insurance, and related figures you enter.
• Co-borrower information: names and email addresses you enter about other people connected to a mortgage.
• Billing information: subscription and payment records. Card payments are processed by Stripe; we do not receive or store your full card number.
• Support requests: the messages you send us, and the rating and comments you leave once a request is resolved. The support desk does not accept file attachments, so we hold no documents you have sent us.
• Community activity: the topics, replies and reactions you post — including those you post anonymously, which are hidden from other members but stay linked to your account internally so the space can be moderated — along with your reputation score, any reports you file, and the members you block.
• Suggestions: the product ideas you send us and the ideas you vote for. A suggestion is private by default — only you and our administrators can see it — and it is never made public unless you have agreed to that in advance or in answer to a request. When you agree, you choose whether it carries your name or appears anonymously, and you can take a suggestion back at any time before it is answered.
• Devices and sessions: your sign-in activity, and for any device you connect, its name, platform, app version, when it was last used, and its push-notification registration.
• Security and technical data: hashed IP addresses used to limit abuse (we do not keep the addresses themselves), audit records of sensitive actions on your account, and cookies strictly necessary to keep you signed in and to remember your language.

3. Why we use it and our legal basis

We use your information, with your consent, to: create and secure your account; run the mortgage engine, simulations, reminders, and notices about your repayment progress; power the AI advisor using your own mortgage figures; process your subscription billing; send you service and notification emails; provide support; operate the community forum; understand what to build next from the suggestions you send us; and meet legal obligations. We do not sell your personal information, and we do not use it for third-party advertising.

4. Service providers and sharing

We share personal information only with service providers that help us operate the Service, under contracts that limit their use of it, and where required by law. Our key providers are:

• Neon (database hosting) — stores your account and mortgage data.
• Vercel (application hosting) — runs the app. We store no uploaded files anywhere, so there is no file storage in this list.
• Stripe (payments) — processes subscriptions and card payments.
• OpenAI (AI features) — receives the mortgage figures behind an advisor answer, the questions you ask the in-app assistant, community posts and replies as they are screened before publication, the text of a suggestion when it is screened for personal information, and the contents of a support request when a summary of it is generated for staff.
• Resend (email) — delivers notification and account emails.
• Google (optional sign-in) — used only if you choose to sign in with Google.
• Expo (push notifications) — receives the title and text of a notification if you have connected a mobile device.

5. Partners who manage your mortgage

Some accounts are set up and administered by a partner — a broker, advisor, or other organization that uses LOONIELODGE to manage mortgages for the people they work with. A partner is a separate organization from us.

If a partner set up your account or one of your mortgages, they can see and work on the mortgages they manage for you, including the figures you enter, the payments and prepayments you record, and the support requests you send about them. Your account shows which partner manages it.

You can ask to be released from partner management at any time from your settings. Once you are released, the partner's access to your mortgages ends and the mortgages become yours to manage in full.

6. Transfers outside Canada

The service providers above are located in, or process data in, the United States. This means your personal information is transferred outside Canada and may be accessible to foreign authorities under the laws of those countries. We take reasonable contractual and security measures to protect it. By using the Service you consent to this transfer. For Quebec residents, we conduct the privacy assessments Law 25 requires before such transfers.

7. Automated processing, the AI advisor, and moderation

When you use the AI advisor, the mortgage figures for that mortgage are sent to our AI provider to generate an explanation. The advisor is informational only, does not provide licensed advice, and makes no decision about you.

Community posts are screened automatically before they appear. Content the screen flags is not rejected: it is kept off the public list and queued for a person to review. Decisions that affect your account — removing content, a posting ban, a suspension — are made by a person, not by the screen.

Suggestions are screened the same way, for a narrower purpose: to notice personal or financial details before anything is published. A flagged suggestion is never rejected and is always still visible to you; it simply cannot go on the public board until an administrator has read it.

We do not use any of this to profile you, and we do not make automated decisions about you that produce legal or similarly significant effects. You can contact us using the details below about any decision affecting your account.

8. How long we keep it

We keep your information while your account is active. When you delete a mortgage or close your account, we retain it for a short cooling-off period (so you can undo the request) and then permanently delete it. If your account is inactive for a long period, we warn you by email and then delete it after a grace period.

Some records are kept on their own schedule and deleted automatically once it runs out:

• Audit records of sensitive actions on your account: 24 months.
• Notifications: 12 months after you have read one, and 24 months in any case.
• Support requests sent through the public form without an account: 12 months after the request is closed.
• Suggestions: kept as a record of what we built and why, but no longer linked to you 24 months after we have answered them or you have withdrawn them.
• Short-lived technical records, such as abuse-prevention counters and the keys used to recognise a retried request: 7 days.

9. What stays behind, and what the law requires

Community posts remain in the discussion when an account is closed, but stop being attributed to anyone — the thread is also a record of the conversation for the members who took part in it. The same applies to messages on a support request that involved someone else, and to suggestions, which stay as the record of why a feature exists but stop being attributed to you. Votes you cast on other people's suggestions are deleted outright. We keep limited records where the law requires, for example billing records.

10. Your rights

Subject to legal limits, you have the right to: access the personal information we hold about you; correct it; export a copy of your data; withdraw consent and delete your account; and, for Quebec residents, additional rights under Law 25. You can export or delete your data from your security settings, or contact us using the details below. You also have the right to complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

11. Security

We protect your information with encryption in transit and at rest, hashed passwords, optional two-factor authentication, access controls, and audit logging on sensitive actions. No system is perfectly secure, but we work to protect your data and will notify you and the appropriate regulator of a breach that poses a real risk of significant harm, as the law requires.

12. Cookies

We use only cookies that are strictly necessary to operate the Service — to keep you signed in and to remember your chosen language. We do not use advertising or third-party tracking cookies.

13. Children

The Service is for adults at the age of majority in their province or territory. We do not knowingly collect personal information from minors. If you believe a minor has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy. If a change is material we will take reasonable steps to notify you. The effective date at the top shows when it last changed.

15. Contact and Privacy Officer

To exercise your rights or ask a privacy question, contact our Privacy Officer: admin@loonielodge.com. General contact: admin@loonielodge.com · LoonieLodge Inc., 2148 Carling Avenue, Unit #2, Ottawa, ON K2A 1H1, Canada.