Privacy Policy

Your account (brokers and team members). We are responsible for the information you give us to use LoanTracker.

Your clients' information. The broker who enters a client's details collected that information and remains responsible for it under the Privacy Act, including telling clients how it is handled and getting any consent needed. We hold and process it only on the broker's behalf, only to provide LoanTracker to that broker. We do not sell it, use it for our own marketing, or contact a broker's clients. If you are a broker's client and have a question about your information, please contact your broker first. We will help them respond.

About brokers and team members:

• name, email address, mobile number and password (stored only as a secure hash);
• business details: business name, ABN, credit licence or credit representative number, aggregator and time zone;
• two-factor sign-in (2FA) settings, signed-in devices and sessions (including approximate device and browser details and IP address), and a record of security events such as password changes;
• your plan and billing status. Card details are entered on Stripe's secure page and held by Stripe, not by us;
• team membership: the email addresses of people you invite and their access;
• messages you send us for support.

About people who ask us for a demo or callback: the name, email address, phone number, business name, preferred call time and message they give us. We use these only to contact them about LoanTracker.

About brokers' clients, as entered or imported by the broker:

• names, contact details, date of birth, and entity or trust names;
• joint borrowers and their relationship to the loan;
• loan details: lender, balance, interest rate and type, repayment type, settlement, fixed-rate and interest-only expiry dates, property value, and estimated commission;
• notes, reminders, review dates and contact history the broker records.

We do not ask for or need clients' tax file numbers, government identifiers, bank account or card numbers, or credit reports. Please do not enter them. When a broker imports a spreadsheet, the file is read in the broker's own browser. We keep only the resulting records, the file's name and the import totals, not the file itself.

We also use public lender interest rates from the Australian Government's Consumer Data Right product register. These contain no personal information.

We collect information directly from you when you sign up, set up your business, use LoanTracker or contact us. Client information comes from the broker who enters or imports it. Stripe tells us when a payment succeeds or fails. We use only cookies that are needed to keep you signed in and secure. We do not use advertising or tracking cookies.

• to provide LoanTracker: storing records, showing reminders and alerts, imports and exports;
• to keep accounts secure: sign-in, 2FA, detecting misuse, and limiting repeated attempts;
• to manage plans, trials and payments;
• to send emails that the service needs, such as sign-up confirmations, password resets, security notices, team invitations, billing notices and alert digests you switch on;
• to provide support, fix problems and improve LoanTracker, using totals and statistics wherever possible rather than individual records;
• to meet our legal obligations.

We do not use personal information for direct marketing without your consent, and every optional email includes a way to stop it.

LoanTracker uses rules in its software to help brokers decide where to spend their time. These features include repricing and expiry alerts, the Clients at Risk score (based on a client's loan dates, rate compared with the lender's current rates, and time since last contact), clawback warnings, and suggested check-in emails written from the client's loan details.

These are suggestions for the broker only. LoanTracker does not decide whether anyone gets a loan, changes lender or receives an offer, and it does not contact clients. The broker reviews every suggestion and decides what to do. Check-in drafts are created by LoanTracker's own templates, and no client information is sent to an outside AI service.

We share information only with service providers that help us run LoanTracker, and only what each one needs:

• Supabase: our database and sign-in, hosted in Sydney, Australia;
• Vercel: hosts the LoanTracker website;
• Stripe: payments and invoices (brokers' billing details only);
• email delivery providers (such as Resend): send the emails described above;
• Cloudflare: a bot check on sign-up and sign-in pages, when switched on;
• error monitoring, when used: technical error reports with personal details removed.

Inside a broker's account, team members the broker invites can see that broker's client records. We may also disclose information when required or authorised by law, for example to a court or regulator.

LoanTracker's database, including all client records, is stored in Australia. Some of our service providers are based overseas or use systems outside Australia, mainly in the United States and the European Union. This covers website delivery, payment processing, email delivery, bot checks and error reports. When this happens, we take reasonable steps, including contractual terms, so that those providers handle the information in line with the APPs.

• two-factor sign-in is required for every account;
• each broker's records are separated at the database level, so one broker cannot see another's;
• information is encrypted in transit and at rest;
• sensitive actions such as exports, invitations and password changes are limited and logged;
• daily backups are kept for a limited time so records can be recovered.

No system is completely secure, so please keep your password and authenticator safe and tell us straight away if you think your account has been misused.

We keep information while your account is active. A deleted client stays in “Recently deleted” for 30 days so it can be restored, and is then permanently removed. If you close your account, it is removed 30 days later unless you log back in to cancel. Copies in backups are overwritten within about a week after that. Demo and callback requests are kept in our support inbox for up to 12 months, then deleted. We keep billing records for as long as tax law requires. Before closing your account, you can export your loan book from Settings.

You can see and update most of your information yourself in Settings, and export your loan book at any time. To ask for access to, or correction of, other information we hold about you, email help@loantracker.au. We will respond within 30 days. If we can't give access or make a correction, we will explain why.

If we suspect a data breach, we act quickly to contain it and assess it. Where a breach is likely to cause serious harm, we will notify affected brokers and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also help brokers notify their clients where needed.

Email help@loantracker.au with any privacy question or complaint. We will acknowledge it within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can contact the OAIC at oaic.gov.au or on 1300 363 992.

We may update this policy as LoanTracker or the law changes. The date at the top shows the latest version. We will email account owners about significant changes before they take effect.