Privacy notice

This website

When you use the contact form we collect your name, email address, organisation, the topic you choose and your message. We use them only to reply to you and to keep a record of the conversation.

We keep a small preference cookie, cf_theme, to remember whether you chose a light or dark appearance. It does not identify you and carries no tracking. We do not run advertising or analytics trackers on these pages.

Our role for institutions

For borrower and application data inside the platform, the lending institution decides why and how the data is used and we process it on the institution’s behalf. Questions about your own loan, your data or your rights should go first to the institution that holds your account.

Each institution’s data is kept separate from every other institution’s, and access is limited to people with an authorised role, scope and purpose.

What the platform records

Depending on how an institution configures it, the platform can hold:

• identity and contact details, identifiers and relationship information;
• financial statements, repayment history, collateral and security records;
• documents and evidence, with hashes and version history;
• consent, dispute and correction records;
• audit records of who accessed or changed what, and when.

Purpose and legal basis

Every processing activity is recorded with its purpose, categories of data, subject, source, recipients, legal basis and retention period. The legal basis for institution data is set by the institution and the applicable law. Consent is captured, and can be withdrawn, where it is the basis relied on.

AI and third parties

Where AI features are enabled, text is minimised and redacted before it is sent to an approved provider, and providers may not train on it unless contractually approved. Messaging, verification and e-signature providers receive only what a request needs, under the institution’s own agreements.

Retention and legal holds

Retention periods are configured per institution and jurisdiction and are not hard-coded by us. A legal hold blocks deletion. When data is deleted or anonymised, a manifest and the minimum proof the law requires are kept. Enquiries from this website are kept only as long as needed to handle them.

Your rights

Depending on where you are, you may have the right to:

• access the personal data held about you;
• ask for it to be corrected, and dispute what you believe is wrong;
• ask for processing to be restricted, or withdraw consent;
• complain to your data protection authority.

The platform provides a dispute workflow that preserves the submission, investigation, decision, correction and communication history. To exercise a right over website data, use the contact page.

Security

We use access control, encryption of sensitive configuration, private evidence storage, redacted logs and an append-only audit trail. See the security page for what is and is not yet in place. No system is perfectly secure, and we will notify affected parties as the law requires.

Changes and contact

We will update this notice when our practices change and show the date at the top. The responsible legal entity, its address and a data protection contact will be added here after legal review. Until then, please use the contact page.