This Data Processing Policy explains how Loanlens (“we”, “our”, or “us”) processes personal data in Loanlens, and in particular the data inside the Loan Estimates and Closing Disclosures you upload. It works together with our Privacy Policy and Terms of Use.
1.Scope and Roles
This policy covers all personal data processed through Loanlens. For your account and payment data, we decide why and how the data is used. For the data inside the documents you upload, which can include your own and a co-borrower’s details, we process it only to provide the analysis you ask for, and we follow your instructions to upload it, view it, and delete it. We do not use it for any other purpose. You confirm that you have the right to upload the documents.
2.Data We Process
| Category | Examples | Source |
|---|---|---|
| Account | Email address, password hash, sign-up and last-login times | You |
| Sessions | Hashed session token, creation and expiry times | Generated at login |
| Chats | Your messages, the replies, chat titles | You and the AI model |
| Loan document data | Borrower names, property address, lender details, loan amount, rate, APR, fees, closing dates | Your uploaded documents |
| Document records | File name, size, checksum, detected form type, page count, how it was read | Generated on upload |
| Analysis output | Extracted fields with confidence, check results, the analysis | Generated by Loanlens |
| Payments | Amount, currency, status, Stripe checkout and payment identifiers | You and Stripe |
| Technical logs | IP address, browser type, request details | Collected automatically |
What you enter in “What can I afford?” is used to compute your result and is not saved in our database. We do not ask for sensitive categories of data such as health or biometric data. Loan Estimates and Closing Disclosures should not contain Social Security or bank account numbers; if a page you upload does, please redact it first.
3.Purposes of Processing
We process personal data only to:
- Provide Loanlens: run your account, read your documents, check them, give you your analysis, and answer your questions
- Take payment for the analysis you buy
- Keep Loanlens secure, prevent abuse and fraud, and fix faults
- Meet our legal obligations and respond to your requests
We do not sell personal data, use it for advertising, or use your documents to train our own models.
4.How a Document Is Processed
- Upload. Your PDF is sent to us over HTTPS and held temporarily on our server.
- Reading. We name the form and read its loan fields, using the text inside the PDF first. Where needed, images of its pages go to a vision model, which returns the loan fields.
- Deletion of the PDF. As soon as it has been read, the PDF is deleted. Only the extracted fields, the check results, and the analysis are kept.
- Review. You can look at every extracted field before deciding to pay.
- Checks. After payment, our rule engine runs on our own server over the saved fields. No AI model is involved in deciding a result.
- Analysis and chat. Your analysis is put together from the check results on our own server. A text model answers your questions. It receives your messages and the check results, not the page images.
- Deletion. You can ask us to delete a chat or your account at any time (section 7).
5.Sub-processors
We use the following providers to run Loanlens. Each handles only what its role needs.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosts the website and passes your requests on to our server | United States, with a global edge network |
| Railway | Runs our server, which reads documents and runs the checks, and the PostgreSQL database that stores your account and results | Cloud region chosen by us |
| Stripe | Takes payment on its hosted checkout page | United States and other regions, per Stripe |
| Resend | Sends the emails we send you (confirming your address, resetting your password). It receives your email address and the message | United States and other regions, per Resend |
| OpenRouter and the model providers behind it | Run the vision and text AI models used to read documents and write text | Varies by model provider |
We choose these providers carefully and give them only the data they need. We update this list when it changes. Ask us at support@loanlens.example if you want to know which model provider handled a request.
6.Security Measures
- Connections between your browser and Loanlens use HTTPS
- Passwords are hashed with argon2id, and session tokens are stored only as hashes
- The session cookie is HttpOnly and SameSite=Lax, and marked Secure on HTTPS
- Every query is limited to the signed-in user’s own records
- Failed logins are throttled
- Uploaded PDFs are deleted as soon as they have been read
- Access to production systems is limited to the people who need it to run and support Loanlens
No system is completely secure, but we work to limit access to data and protect it from misuse.
7.Retention and Deletion
| Data | How long we keep it |
|---|---|
| Uploaded PDFs | Deleted as soon as they have been read, and when you delete the chat |
| Extracted fields, check results, analyses, chats | Until you ask us to delete them |
| Account and login sessions | Until you ask us to delete your account; a session also ends when it expires or you log out |
| Payment records | As long as needed for accounting, tax, and legal reasons |
| Backups and server logs | Removed on our providers’ normal schedules |
To have a chat or your account deleted, email support@loanlens.example from the address on your account. Deleting a chat removes its messages, documents, extracted fields, check results, and analysis. We complete deletion requests within 30 days.
8.Your Requests
You can ask us to give you a copy of your data, correct it, restrict how we use it, or delete it. Email support@loanlens.example. We may confirm it is you before acting, and we reply within 30 days.
9.Personal Data Breaches
If a breach affects your personal data, we will contact you without undue delay with what happened, what data was involved, and what you can do, and we will notify regulators where the law requires.
10.International Transfers
The providers above may process data in the United States and other countries. We take reasonable steps to protect the data wherever it is processed.
11.Changes to This Policy
We may update this Data Processing Policy periodically. Changes become effective when posted on this page, and the “Last Updated” date above will change.
12.Contact Us
Loanlens
Email: support@loanlens.example