Privacy Policy

Effective November 5, 2026

Who we are

LoanPrep is run by Studio OS LLC, a Wyoming limited liability company ("LoanPrep," "we" or "us"). You can reach us at support@loanprep.app or 30 N Gould St Ste N, Sheridan, WY 82801.

What we collect

• What you enter. The loan you want, the business's owners and their shares, business debts, personal financial statements, tax return lines you type in, your answers to questions such as the SBA eligibility questions, and your notes for a letter to your lender.
• Documents you upload. Tax returns, financial statements, debt schedules and personal financial statements, and the bank, brokerage, retirement and loan statements you add to fill in your answers. These can include names, addresses, income, assets, debts and identification numbers, for you and for other people, such as co-owners or a spouse.
• What you say, if you answer out loud. A recording of what you say to fill in your personal financial statement or your business's debts, and the words written out from it. We don't keep either.
• If you sign in. Your email address, and the applications you save: your answers, results, written review, any letter to your lender, and your documents (each one is saved as soon as you add it). We also keep a record of each check you run: its grade, its main figures and what it flagged. What you save is locked, as "Locked with your recovery code" explains below.
• If you share a report. A copy of the report you share, locked as "Locked with your recovery code" explains below, when its link was made and when it stops working, and how many times and when it was last opened.
• If you add a passkey. Which passkey it is, and a copy of your recovery code locked so that only that passkey can open it.
• If you pay. Stripe takes your card on its own page, so we never see it. We tell Stripe which account and application the payment is for. We keep what it paid for, the amount, when it was paid and used, whether it was refunded or disputed, and which version of our Terms of Use was in effect when you paid. Stripe keeps its own record of the payment.
• If you ask for early access. Your name, email and anything else you put on the form, only to invite you to the beta and, if you ask as an advisor, to learn what would help advisors and their clients. If you tick the newsletter box on that form, your email also joins the newsletter list.
• If you ask for the newsletter. Your email address, the words beside the box you ticked, and when you ticked it.
• Technical information. Like most websites, our hosting provider records basic details of each visit, such as your IP address, browser type and the pages you open, to run and secure the site. It also counts visits to each page, the site that sent you, and your country, browser and kind of device, without cookies. We count how many visitors reach each step of a check, keeping only the step, the day, the page the visit began on and the site or ad that sent it. We also count the processing each task uses, such as reading documents or writing a review: the kind of task, the day, the amount of processing, and how many pages or seconds of recording, never what was read or written. None of these counts is linked to you or your application. Separately, to prevent misuse, we count how many times each account, or each access code, uses each of those tasks in a day, and delete those daily counts after two days. Google Analytics also counts visits to our public pages, and a few steps of a check, as described below.
• Cookies and your browser. We use cookies to sign you in and keep you signed in, and for up to an hour to remember a newsletter tick until you open your sign-in link. Your browser keeps your recovery code on your device until you sign out, so sign out on a computer other people use. While the tab is open, your browser also notes where your visit began, for the step counts, and holds your access code while you're on Stripe's payment page. On our public pages, such as the home page, guides, calculators and this policy, we use Google Analytics, loaded through Google Tag Manager, to see how visitors find and use the site. It sets cookies that let it recognize your browser when you come back. It isn't loaded on the check, shared reports or sign-in, so nothing you type or upload there reaches Google, and we don't use it for advertising. If it has counted your visit on our public pages, our server also tells it, under the number it gave your browser, when you run the quick estimate, ask for an invitation, create an account, start or finish a check, start paying or pay, with the plan you chose and its price. It never gets your name, email, answers, figures or documents, or the addresses of those pages. To turn it off in your browser, which stops both, use "Turn off analytics" at the bottom of our public pages. It's also off in a browser that sends the Global Privacy Control signal.

We don't check your credit, and we don't get information about you from credit bureaus or data brokers.

How we use it

• To read your documents and statements, fill in answers from them or from what you say out loud, run your numbers, and write your review and, if you ask, a letter to your lender.
• To save your work and email you sign-in codes, if you sign in. If you leave a saved check unfinished, we may email you one reminder about it, which you can turn off.
• To take payment through Stripe, when a check costs money.
• To send you our newsletter, with lending news, LoanPrep updates, tips and offers from LoanPrep, but only if you ticked the box for it. The box is never ticked for you.
• To keep LoanPrep secure, prevent misuse, fix problems and work out what it costs to run.
• To follow the law.

We don't sell your personal information or share it for advertising. We don't send it to lenders. We don't use it to train any models, and our document-processing provider doesn't either.

How we protect identification numbers

Before a document is read, our server finds Social Security numbers, EINs, ITINs, account and routing numbers, and dates of birth marked as such. It blacks them out on each page image. In the text it sends with each page, and in Word, Excel and CSV files, it replaces all but the last four digits with stars. Photos are redrawn before they're read, which also drops hidden details stored in them, such as where a photo was taken.

Your original file comes to our server so it can be masked there. Only the masked copy, with your file's name, goes on to our document-processing provider, OpenAI. Masking hides identification numbers, not who you are: names, addresses, dollar amounts and most dates aren't masked, because your review needs them.

Scanned pages and photos are read on our own server with text recognition, so the same numbers can be found and blacked out there, and nothing is sent anywhere else for this. A page that has typed text and a picture on it is checked by its typed text, so a number shown only in the picture may not be found. If a scanned page or photo is too unclear to check, we tell you before it's sent to be read. You can upload a clearer copy, redact it yourself, type in the figures, or choose to send it as it is, with only the numbers we could find blacked out. Automatic masking can also miss a number printed in an unusual way, so redacting a document yourself is the surest way.

Answers you say out loud

If you answer out loud, your browser records what you say and sends it to our server, which sends it to OpenAI to be written out, with your business's and owners' names so they're spelled right. A recording can't be masked before it's written out, so don't say Social Security, account or card numbers. What's written out is masked, then read to fill in your answers, and you check each one before it's used. We don't keep the recording or the words written out from it.

Locked with your recovery code

If you sign in, your browser locks what you save before it's sent to us: your answers, results and written review, any letter to your lender, each document, and the names of your applications and files. It's locked with a recovery code that only you have. We keep only a fingerprint of the code, which can't be turned back into it. So we can't open what you save, and we can't recover, resend or reset your code. Keep it somewhere safe.

If you lose it, haven't added a passkey and aren't still signed in on a browser that remembers it, your saved applications can't be opened. Starting over deletes them, with their documents and check records. Their payment records stay, as "How long we keep it" explains, so a refund you're due for a check you paid for but hadn't run still stands.

Each check record (its grade, main figures and what it flagged) is locked by our server, with a key your browser sends for that check and that we don't keep.

If you add a passkey on a device that supports it, such as Face ID or a fingerprint, we keep a copy of your code locked with a secret only that passkey can give, and which passkey it is. Your browser opens that copy after you unlock the passkey on your device. Not every device's passkeys can do this, and LoanPrep tells you when yours can't. You can remove your passkeys from your account at any time; the passkey itself stays on your device or in your password manager until you delete it there.

If you share a report with your banker, your browser locks a copy of it with a new key that's only in the link, after the # sign, which browsers don't send to us. We store the locked copy, and the link's key locked with your recovery code so you can copy the link again. Anyone who has the whole link can open the copy, so send it only to the people you mean to. It works for the 7, 14 or 30 days you choose, or until you turn it off. Then it stops opening, and we delete it the next time you look at your links, someone opens the link, or our daily cleanup runs. Deleting the application deletes its links too.

When you run a check, your browser sends your answers, and each document with its own key and name, plus a key for that application's check records. Our server opens the files in memory, masks them, runs your numbers and locks the check record, then lets the files and keys go. It doesn't store the keys or an unlocked copy. While a check, review or letter is being made, our server can read what it's working on; that's how it works out your results.

A few things aren't locked, because we need them to run your account: your email address and sign-in records; a fingerprint of the access code you used; when each application was saved and the step you're on; whether and when you've run a check, whether it was a re-check, and which version of our Terms of Use you agreed to for it; whether we've sent you a reminder or you've turned them off; the size, date and kind of each document; which passkeys you've added; when each shared link was made and stops working, and how often it was opened; how many times you used each task in the last two days; and payment records. Anything you saved before we added the recovery code stays unlocked until you next open it. Early-access requests, the newsletter list, and the step and processing counts aren't locked either.

Who else handles your information

We use these service providers, only to run LoanPrep:

• OpenAI, our document-processing provider, reads the masked copy of your documents and statements to pull out the figures, writes out what you say if you answer out loud, and helps write your review and any letter to your lender. For those it also gets your figures and the names of your business, its owners and your files. We send everything with each request rather than storing files with OpenAI, and we ask it not to save its answers. OpenAI uses what we send only to do this and to watch for misuse, and doesn't train its models on it. It keeps it for up to 30 days, then deletes it, unless the law requires it to keep it longer.
• Supabase stores accounts and sign-in records, the locked copies of saved work and the few unlocked details listed above, early-access requests, the newsletter list, and the step and processing counts. It can't open the locked copies.
• Resend sends sign-in codes and links, and the one reminder email if you leave a saved check unfinished.
• Cloudflare runs the check that a person, not a program, is asking for a sign-in email, when we've turned that check on. It gets your IP address and details of your browser and device, not your email address or anything else you've entered.
• Stripe takes the payment when a check costs money. You pay on Stripe's own page, so we never see your card.
• Vercel runs our website and our server, so your files pass through it, in memory, while they're masked and read. It keeps short-lived records of each request, and our server's error notes, which are written to leave out your documents and figures. It also counts visits without cookies.
• Google runs Google Analytics and Tag Manager on our public pages, as described under "Cookies and your browser." It gets the addresses and titles of the pages you open there, the site that sent you, your browser and kind of device, and your rough location from your IP address. From the check and sign-in it gets only the steps listed under "Cookies and your browser," never what you type or upload, and it gets nothing from shared reports.

If you use your own assistant or agent with LoanPrep, such as a chatbot or a browser extension, what it reads or receives is handled by its provider under that provider's own terms and privacy policy, not this one, as our Terms of Use explain.

We may also share information if the law requires it, to protect someone's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

How long we keep it

• If you don't sign in, we don't keep your documents, figures or answers. Your files are read in memory on our server to build your results, then discarded. We do keep the step and processing counts described above, which aren't linked to you, and for two days how many times your access code was used for each task. Our hosting provider keeps its usual short-lived records of each visit, and OpenAI keeps what it was sent for up to 30 days, as described above.
• If you sign in, each document is deleted automatically once it's 30 days old, by a job that runs every day. Your answers, results, reviews and letters stay until you delete the application, which also deletes its check records. You can delete any of these sooner. A payment's record, described under "What we collect", stays after you delete its application, for 2 years from the payment, so we can still handle a refund or a question about the charge; then the same daily job deletes it. Passkeys stay until you remove them. If you lose your recovery code and start over, the applications it locked are deleted, with their documents and check records, and your passkeys; their payment records stay for the same 2 years.
• A shared report stops opening when its link expires or you turn it off, and is deleted then or soon after, as "Locked with your recovery code" explains.
• Your account stays until you ask us to delete it. Deleting it deletes its payment records too.
• Early-access requests stay until you ask us to delete yours.
• The newsletter list keeps your email while you're subscribed. If you unsubscribe, we keep a note that you did, so we don't email you again by mistake. Ask us and we'll delete that note too.
• The step and processing counts aren't linked to anyone, and we keep them as long as they help us run LoanPrep.
• The daily task counts are deleted after two days.
• Backups. Our database provider makes a backup every day and keeps each one for 7 days, so something you delete can stay in a backup for up to 7 days before it's overwritten. Uploaded documents aren't in those backups.
• OpenAI keeps what it was sent, including any recordings, for up to 30 days, as described above.

Your choices

• Use LoanPrep without signing in, so your documents and answers aren't saved. When checks cost money, you'll need to sign in to run one.
• Type in your tax return figures instead of uploading the returns. Your figures, but not your documents, still go to OpenAI to help write your review.
• Type your answers instead of saying them out loud.
• Redact your documents before you upload them.
• Delete a document or an application at any time.
• Turn off a link to a shared report at any time.
• Add a passkey, or remove your passkeys, from your account.
• Unsubscribe from the newsletter with the link in any issue, or by unticking the box in your account.
• Email us at support@loanprep.app to get a copy of what we hold about you, correct your email, or delete your account and everything in it, including your newsletter and early-access records. What you saved is locked with your recovery code, so we can send only the locked copy and the details listed under "A few things aren't locked". To read your saved work, open it in LoanPrep with your code. Depending on where you live, you may have other rights under state law, and we'll honor them.

Information about other people

If you enter or upload information about someone else, such as a co-owner or a spouse, make sure they know and agree. They can contact us to ask what we hold about them.

Security

What you save is locked in your browser before it's sent, so we can't open it where it's stored. Documents are kept in private storage, and each person can reach only their own applications and files. Information is encrypted on its way to and from LoanPrep, and our providers encrypt it where it's stored. The sign-in cookie can't be read by scripts on the page. Your browser keeps your recovery code until you sign out, so sign out on a computer other people use. No system is perfectly secure, so we can't promise that information will never be exposed.

Children

LoanPrep is for adults running a business. It isn't meant for anyone under 18, and we don't knowingly collect their information.

Changes to this policy

If we change this policy, we'll post the new version here with a new effective date. If a change is significant, we'll also say so on the site, and email people who have an account.

Contact

Studio OS LLC, 30 N Gould St Ste N, Sheridan, WY 82801, support@loanprep.app