Privacy policy

Effective 13 October 2026

1. Information we collect

   Information you provide.

   • Account information: your name, email address, and password (stored as a hash) or Google sign-in identifier; optionally your legal name, phone number, postal address, and whether you act individually or for an entity, with the entity’s name and tax identifier.
   • Loan information: the terms of each loan you are party to, the name and email address of the other party, the schedule, every payment recorded with its method, date, reference and any evidence you attach, every ledger entry, the documents generated or uploaded for the loan, memos and notes, and the history of actions taken on it.
   • Signature records: when you sign a document, the name you typed, the date and time, your IP address, your browser’s user agent string, a cryptographic hash of the document, and the consent text you were shown.
   • Identity verification: if you verify your identity, your legal name, date of birth, the type and last four characters of a government identifier (we do not store the full number), and the images of identity documents you upload.
   • Financing requests: if you post a request for financing, the amount, purpose and other details you provide.
   • Communications: messages you send us, including support requests and dispute notices.

   Payment and bank information. Subscription payments and bank debits are processed by Stripe. Stripe collects your card or bank account details directly, including through Stripe Financial Connections if you link a bank account that way. We receive and store only a token that references the payment method, the bank name and last four digits of the account, the verification status, and the status, amount and date of each transaction. We never receive or store full card or account numbers. If you are a lender collecting bank debits, Stripe collects the identity, business and payout information required to open your connected account, and we receive the account identifier and its status.

   Information from the other party. When a user invites you to a loan or names you as a party, they give us your name and email address so we can send the invitation and show them the loan. We also receive the terms they entered that describe the loan with you.

   Information collected automatically. When you use the Service we collect your IP address and approximate location derived from it, browser and device type, operating system, referring page, the pages you view and actions you take, and timestamps, through server logs and our hosting providers. We use a strictly necessary session cookie to keep you signed in. We do not use advertising cookies or third-party tracking pixels on the Service.

2. How we use information

   We use information for the following purposes, each of which is necessary to provide the Service you asked for, to meet a legal obligation, or to pursue our legitimate interest in running the Service securely:

   • to provide the Service: create and store loans, generate documents, compute schedules and balances, record and confirm payments, and show each party their loans;
   • to send transactional messages: invitations, signature requests, payment reminders, confirmations, failed-debit notices, and notices about a loan or your account;
   • to process subscription payments and bank debits through Stripe and to reconcile them to the ledger;
   • to create and preserve signature records so that signed documents can be relied on and their integrity verified;
   • to verify identity, prevent fraud and abuse, enforce our Terms, and protect the rights, property and safety of NoteHouse, our users and others;
   • to secure the Service, detect and investigate incidents, and maintain audit records;
   • to respond to your requests and provide support;
   • to comply with law, respond to lawful requests, and establish, exercise or defend legal claims;
   • to understand how the Service is used in aggregate and to improve it; and
   • to send you information about the Service, from which you may opt out.

   We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use automated decision-making that produces legal or similarly significant effects about you; decisions about a loan are made by its parties.

3. How we share information

   With the other party to your loan. The other party sees your name, email address, verification status (not the underlying documents), the loan terms, schedule, ledger, payments and evidence, documents, activity history, and the signature records attached to documents you both signed. This sharing is the purpose of the Service.

   With service providers that process information on our behalf under contracts that restrict their use of it: Google Cloud and Firebase (database, authentication, file storage, scheduled jobs), Vercel (application hosting and logs), Stripe (payments, bank debits, connected accounts, identity information for payouts), and Resend (email delivery). These providers process information in the United States.

   With Stripe as an independent controller. When you pay, authorize a debit or open a connected account, Stripe collects and uses your information under its own privacy policy as well as on our behalf.

   For legal reasons. When we believe disclosure is required by law, subpoena, court order or governmental request; to enforce our Terms; to detect or prevent fraud, security or technical issues; or to protect the rights, property or safety of NoteHouse, our users or the public. Where permitted, we will tell affected users about a legal request before responding.

   In a business transfer. If NoteHouse is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of its assets, information may be transferred as part of that transaction, subject to this policy.

   With your direction or consent, for example when you download a document and give it to your accountant, or ask us to share information with someone.

   Aggregated or de-identified information that cannot reasonably be used to identify you may be shared for any purpose.

4. Retention

   Loan records (terms, schedule, ledger, payments, evidence, documents, signature records and activity history) are kept for as long as the loan is open and for at least seven years after it is paid, cancelled or otherwise closed, because both parties may need them for tax, legal and accounting purposes and because the ledger is designed not to be altered. We may keep them longer if required by law or needed for a dispute.

   Account information is kept while you have an account. When you close your account, we delete or de-identify account information that is not part of a loan record within 90 days, except what we must keep for legal, security or accounting reasons.

   Identity verification images are kept while verification is pending and for up to one year after it is decided, then deleted, unless law requires longer. The verification result, your legal name, date of birth and the last four characters of the identifier are kept with your account.

   Server and security logs are kept for up to 18 months. Support communications are kept for up to three years.

5. Security

   We use administrative, technical and physical safeguards designed to protect information against unauthorized access, loss, misuse and alteration. Writes to our database are made only by server code after verifying your session and your role on the loan; database rules deny all direct client writes. Data is encrypted in transit (TLS) and at rest by our hosting providers. Passwords are hashed. The ledger is hash-chained so that alterations can be detected, and documents are hashed at signing. Access to production systems is limited to personnel who need it. Our security page describes these controls in more detail.

   No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by law. Report security concerns to security@notehouse.io.

6. Your choices

   You can view and update your account information in settings and download the documents for any loan you are a party to. You can turn off payment reminders and activity emails in settings; messages that are necessary to the Service, such as signature requests, debit authorizations and notices about your account, continue while you have an account. You can close your account from settings. You can turn off automatic payments and revoke a bank debit authorization from the loan’s payment page.

   Our Service does not respond to browser “Do Not Track” signals because there is no common standard for them. We treat the Global Privacy Control signal as a request to opt out of sale or sharing, which we do not engage in regardless.

7. Your privacy rights

   Depending on where you live, you may have the right to know what personal information we have about you and how it is used and shared; to access and receive a portable copy of it; to correct inaccurate information; to delete it; to opt out of sale, sharing, targeted advertising and profiling (which we do not do); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

   How to exercise them. Email hello@notehouse.io with “Privacy request” in the subject line, or use the tools in your account settings. We will verify your identity, typically by confirming control of the email address on your account, before acting on a request, and we respond within the time the applicable law allows (generally 45 days, extendable once). An authorized agent may submit a request on your behalf with your written permission; we may still ask you to verify your identity. If we decline a request, we will say why, and you may appeal by replying to our response; we will reply to an appeal within 45 days.

   Limits. Information that is part of another person’s loan record, such as the terms, ledger, documents and signature records of a loan you are party to, is also that person’s record. We may decline to delete or alter it to the extent necessary to preserve the integrity of the record, to comply with law, or to establish, exercise or defend legal claims, and we will tell you if we do.

   California residents. Under the California Consumer Privacy Act, as amended, we disclose that in the preceding twelve months we have collected the categories of personal information described in Section 1 (identifiers; personal information described in Cal. Civ. Code §1798.80(e), including financial information; characteristics of protected classifications only to the extent contained in identity documents; commercial information; internet and network activity; geolocation derived from IP address; professional information where provided; and sensitive personal information consisting of account credentials, government identifiers and financial account information), from the sources described in Section 1, for the purposes described in Section 2, and have disclosed them for business purposes to the categories of recipients described in Section 3. We have not sold or shared personal information. We use sensitive personal information only for the purposes permitted by §7027(m) of the CCPA regulations. Retention periods are described in Section 4.

   Residents of other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) may exercise the rights those laws provide using the method above.

   Financial privacy. NoteHouse is not a financial institution subject to the Gramm-Leach-Bliley Act. Stripe, and the banks involved in any payment, are subject to their own financial privacy obligations.

8. Children

   The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

9. Users outside the United States

   The Service is operated from the United States and intended for loans between parties in the United States. If you use it from elsewhere, your information will be transferred to, stored and processed in the United States, where privacy laws may differ from those of your country, and by using the Service you consent to that transfer. We do not target the Service to residents of the European Economic Area, the United Kingdom or Switzerland; if we process the personal data of such residents, we do so as a controller on the legal bases of contract performance, legal obligation and legitimate interests, and such residents may exercise their rights under applicable law by contacting us.

10. Changes to this policy

    We may update this policy. If a change materially reduces your rights or changes how we use personal information we already hold, we will notify you by email or by a notice in the Service before it takes effect. The effective date at the top of this page shows the current version. Your continued use after a change takes effect means you accept it.

11. Contact

    VisitProof LLC, doing business as NoteHouse
    Privacy requests and general inquiries: hello@notehouse.io
    Security reports: security@notehouse.io