Privacy Policy

Effective date: October 27, 2026 · Last updated: November 2, 2026

Who we are. This policy explains how Loan-Pitch Pro (“we”, “us”), operated by Loan-Pitch Pro LLC, a California limited liability company, 2108 N St, Suite N, Sacramento, CA 95816, handles personal information on loanpitchpro.com and in the Loan-Pitch Pro app (the “Service”). Contact: support@loanpitchpro.com. Our Terms of Service also apply.

1. The short version

We collect only what we need to sell and run a subscription: your email address, your subscription and billing status (payments are handled by Stripe), a sign-in cookie, and basic server logs.
The debt, balance, payment, client-name and loan information you type, paste or read from a screenshot into the app is processed inside your web browser. If you turn on the optional cloud auto-save, the scenario numbers (not client names or notes) are encrypted in your browser with a key only you hold and stored with us so they open on your other devices. We cannot read them. (Sections 3 and 3A explain exactly what that means and its limits.)
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not run advertising trackers or third-party analytics on our pages.

2. What we collect

Account and billing. Your email address, and billing and subscription details needed to run your plan (plan, trial and renewal dates, discounts used, payment status, invoices, the last four digits and brand of your card). This is collected and stored by our payment processor, Stripe, when you check out. Your full card number is handled by Stripe and never touches our servers. We may also store small flags on your Stripe subscription (for example that the welcome email was sent, or that a one-time stay offer was used).
Agreement record. When you start a free trial we store, with your subscription at Stripe, the date and time you ticked the agreement box, the version of the Terms, and the price you were shown. We do not record your IP address for this. We keep it to prove your agreement, as automatic-renewal laws require (see section 7).
Sign-in. When you ask for a sign-in link, the email address you enter is checked against our customer records at Stripe and, if you have a subscription, used to email you a one-time link through our email provider, Resend. We also send a welcome email after you subscribe. The emails come from login@loanpitchpro.com. Resend processes your email address and the message content to deliver it.
Cookies. See section 5.
Logs. Our host, Netlify, and our functions generate standard technical logs such as IP address, date and time, pages and API calls requested, browser type and error details. We use these to run, secure and debug the Service. Our own code does not write customer data to its logs.
Messages you send us. If you email support, we keep the message and your reply to help you.
Information we do not ask for. We do not ask for Social Security numbers, dates of birth, account numbers, or credit reports. Please do not email them to us.

3. What stays in your browser (and what we do not collect)

This section describes the app with cloud auto-save off (the default). If you turn cloud auto-save on, section 3A applies as well.

When you use the app, these things are processed in your browser only: debt tables (creditor names, balances, payments), client names, loan details (amounts, rates, home value and similar), the screenshots you paste or drop, the text read from them, and the graphics, CSV, zip and PDF files you create. The screenshot reader (OCR) runs in your browser using software files we serve to you. The app’s security policy (Content-Security-Policy) only lets the app page contact our own site, and the app’s code contains no calls that upload this information. The only things the app sends to our servers are your sign-in and subscription requests (your email when you ask for a sign-in link, the Stripe checkout reference after you pay, and billing-portal or cancel requests). The app page also sends the cookieless visitor count described in section 5 (the page address, referring site and device type only). Those requests do not contain any client or debt data.

Your Settings (logo, name, NMLS and license lines, default rates and disclaimers) are saved in your browser’s local storage on your device, as is the reference data you edit in the optional tools (rate-sheet rows and notice, message templates, mortgage-insurance table, cash-out limits and pipeline status names). A small acknowledgement flag is saved in your browser’s session storage for the current session only. Clearing browser data removes these; use Settings → Backup and Save scenario to keep your own copies. Because these are stored only on your device, we cannot see or recover them.

Client files. If you use “Save client file”, the client name, your optional note, the debts, loan options and extra-payment inputs, any pipeline status, follow-up date and notes you add, and the created and updated times are saved in your browser’s local storage on your device only (the “Client files” list in the app). They are never sent to us or anyone else, and we cannot see, search or recover them. They stay until you delete them or clear your browser data, and they are not available in another browser or on another computer. Client files have their own export and import (a JSON file you download and keep yourself), kept separate from the Settings backup, which never contains client data. Anything you export is then in your hands: store it securely and keep it only as long as your company’s data-retention policy and the law allow. Please save only what you are allowed to keep under that policy.

AI summary (optional). Only if you click “AI summary”, the app sends a short set of numbers from the pitch you are viewing (monthly payments today and new, monthly difference, number and total of debts paid off, cash back, and the extra-payment amount, payoff time and effective rate) to our server, which passes them to an AI text provider to write a draft message. No client name, creditor names, NMLS details or other personal information are sent. We do not store the numbers or the draft; we keep only a daily count of AI summaries per account (to enforce a limit). The provider processes the numbers under its API terms.

3A. Cloud auto-save (optional, end-to-end encrypted)

Updated Nov 2, 2026.

It is off unless you turn it on. If you turn on cloud auto-save in the app, your client files save automatically as you work and you can open them on other devices you sign in on.

What is uploaded: only the scenario numbers of each client file: debts (balance, monthly payment, account type, and the creditor name with any run of four or more digits and any email address removed), loan inputs (amounts, rates, terms, program and similar), the follow-up date if you set one, and the created and edited times. Each client file is stored under a random record id.
What is never uploaded: client names, your notes, the property description, pipeline notes and status, document-checklist text, messages the screenshot reader shows, and screenshots or credit-report images (the app never stores those anywhere). On another device, a client file appears as “Client – date, time” until you name it there.
End-to-end encrypted: the numbers are encrypted in your browser (AES-256-GCM) with a key created on your device. We store only the encrypted data. The key is kept on each device you set up and, for new devices, in a form locked by a recovery code that only you see. We never receive the key or the code, so we cannot read, search or use your client data, and we cannot recover it if you lose your recovery code and every device you set up.
What we can see: technical information needed to sync: your account id, record ids, how many records you have, their size, revision numbers, when they changed, a device type label (for example “iPhone”) and standard server logs.
Where: stored with our host, Netlify (Netlify Blobs).
Deleting: deleting a client file removes it on all your devices; it can be restored for 30 days and is then permanently deleted. “Delete my cloud data” in Settings deletes everything stored for your account at once. Copies in your browser stay until you delete them there.
After you cancel: your encrypted data stays available for you to open and download for 90 days after your subscription ends, and is then permanently deleted.
Your company’s rules: if you work for a lender or broker, check its vendor and data policies before you turn on cloud auto-save. You decide what client information you keep, as described in section 3 “Limits”.

Limits. This describes how the Service is built today. It does not cover what you do with files you create (for example emailing or texting a graphic, saving it to a cloud drive, or pasting a screenshot from a site that logs it), browser extensions, or your device and network security. You are responsible for protecting your clients’ information and for any privacy or data-security laws that apply to you as a loan originator (for example the Gramm-Leach-Bliley Act and state laws). If a future version of the Service sends client data to us in any way other than the encrypted cloud auto-save in section 3A, we will update this policy and tell you first.

4. How we use and share information

We use personal information to: provide and bill for the Service, sign you in, send you receipts, account and security notices and the emails described above, answer support requests, prevent fraud and abuse, improve and debug the Service, and comply with law. We share it only with service providers who help us run the Service and who may use it only for that purpose: Stripe (payments and billing), Netlify (hosting and logs) and Resend (email delivery). We may also disclose information when required by law or legal process, to protect rights, safety and security, or in connection with a sale or reorganization of the business. We do not sell personal information, and we do not “share” it for cross-context behavioral advertising (as those terms are used in California law), and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

5. Cookies and similar technologies

Sign-in cookie (lpp_session): essential. It is a signed, HttpOnly, Secure, SameSite cookie that keeps you signed in for up to 30 days and lets us confirm your subscription. Without it the app will not open.
Local storage and session storage: used by the app for your Settings, for any client files you choose to save, and for a one-time acknowledgement (section 3). They stay on your device.
Stripe may set its own cookies on its checkout and billing pages under its own privacy policy.
Visitor counts (no cookies): our pages, including the app page, send our own server a small, cookieless page-view note: the page address (without any query details except an optional campaign tag such as utm_source), the website you came from (its domain only), the device type (mobile, tablet or desktop, worked out from your browser’s user agent), and clicks on a few named buttons (for example “Start free trial”, starting checkout, opening the sample sheet or following us on LinkedIn). To count different visitors per day without cookies, our server turns your IP address and user agent into a one-way code that changes every day; we do not store your IP address, the code cannot be turned back into it, and the counts are kept only as daily totals. No client or debt data, names or emails are ever included, nothing is stored on your device, and we do not use a third-party analytics service.
We do not use advertising or analytics cookies on loanpitchpro.com. Because we do not sell or share personal information for advertising, we do not show a cookie banner for essential cookies. Because we do not sell or share personal information, there is nothing to opt out of; if that ever changes we will add an opt-out and honor browser opt-out signals such as Global Privacy Control as the law requires.

6. Your privacy rights

Everyone. You can cancel and update billing details in the app. You can ask us to tell you what we hold about you, correct it or delete it by emailing support@loanpitchpro.com from the address on your account.

California (CCPA/CPRA) and similar state laws. If you live in California (and some other states), you have the right to: know what personal information we collect, use, disclose and (if ever) sell or share, and get a copy; delete personal information we collected from you, with some legal exceptions (for example records we must keep for tax, accounting or fraud prevention); correct inaccurate personal information; opt out of the sale or sharing of personal information (we do neither); limit the use of sensitive personal information (we do not collect sensitive personal information other than a payment card handled by Stripe); and not be discriminated against for using these rights. To make a request, email support@loanpitchpro.com. We will verify your identity by confirming control of the email address on your account, and respond within 45 days (we may extend once by 45 days and will tell you why). An authorized agent may make a request for you with your written permission. If we deny a request you may appeal by replying to our response. Categories of personal information in the past 12 months: identifiers (email address, IP address), commercial information (subscription and purchase history), internet or network activity (server logs), and payment information handled by Stripe.

Other states. Some states give additional privacy rights (for example to know, delete, correct or limit the use of personal information, or to opt out of sale, sharing or certain profiling). We honor the rights described above for any U.S. user who asks, whatever their state, and will follow your state’s law where it gives you more. We do not sell or share personal information.

Some of the data in your Settings, scenarios and graphics exists only on your device, so we cannot access, correct or delete it; you control it by clearing your browser data. Cloud auto-save data (section 3A) is encrypted with a key we do not have: we can delete it at your request (or you can, in Settings), but we cannot read, correct or provide a readable copy of it. You can download a readable copy yourself in Settings → Download a copy.

7. How long we keep information

We keep account and billing records for as long as you have a subscription and afterwards for as long as needed to meet tax, accounting, legal, consent-record and fraud-prevention requirements (California’s automatic renewal law, for example, calls for keeping consent records for at least three years or one year after the subscription ends, whichever is longer). Server logs are kept for the period set by Netlify. Encrypted cloud auto-save data is kept until you delete it; deleted client files are permanently removed after 30 days; and all of it is permanently deleted 90 days after your subscription ends (section 3A). Support emails are kept while they are useful and then deleted.

8. Security

We use reasonable measures: encrypted connections (HTTPS), signed and HttpOnly session cookies, one-time sign-in links that expire after 15 minutes, and restricting access to our accounts with service providers. The app’s code is served only to signed-in subscribers. Cloud auto-save data is end-to-end encrypted in your browser; we hold only the encrypted data. No system is perfectly secure, and we cannot guarantee security. Protect your email account, since anyone who controls it can request a sign-in link. If a breach affects your personal information we will notify you as the law requires.

9. Children

The Service is for business use by adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email us and we will delete it.

10. International users

The Service is offered only in the United States, to U.S. users. It is operated from, and intended for use in, the United States. Our service providers may process information in the United States and other countries. If you use the Service from elsewhere, you understand your information will be transferred to and processed in the United States, which may have different data-protection laws from your country.

11. Changes to this policy

We may update this policy. We will post the new version with a new “last updated” date and, for a material change, email you before it takes effect.

12. Contact

Loan-Pitch Pro LLC, a California limited liability company, 2108 N St, Suite N, Sacramento, CA 95816. Email: support@loanpitchpro.com.