What we collect, where it lives, and how it leaves.
Plain answers. The legal version is the privacy policy; this page is the practical one.
The free readiness check
Runs entirely in your browser. It asks for ranges and choices, never figures or documents, and does not ask for an email. If you share the result link, the link holds your fifteen answers as a short code and nothing else. First-party analytics record the categorical answers (industry, purpose, amount range, stage) with a random browser id, so we can see whether the check is useful. No name, no email, no free text.
Checkout
Payment is processed by Stripe on Stripe's pages. LenderReady never receives your card number. Stripe shares the email, name, and billing address you enter, the amount, and whether the payment succeeded. Stripe's own receipt is your record of payment.
The paid intake
After payment you receive a private link. It contains a random 256-bit token; the server stores only a hash of it and compares in constant time, so a copy of the database cannot be used to open anyone's intake. Anyone who has the link can see your intake, so do not forward it. Status emails never contain the link.
The intake asks for what a lender would ask for. It does not ask for, and please do not upload, account numbers, social insurance numbers, full tax returns, passwords, or online banking access.
Documents
Uploads go directly from your browser to a private storage bucket (Supabase, on AWS) using a one-shot signed URL that expires. The bucket is not public, has no anonymous access, enforces a 25 MB per-file limit and a file-type allowlist, and is encrypted at rest. Traffic is encrypted in transit. The reviewer opens your files through short-lived signed links that expire in fifteen minutes, and each opening is logged on your order.
Who can see it
The reviewer working on your file, and nobody else. No lender, broker, partner, or advertiser. Documents are never used to train anything. Analytics never receive file names, figures, or free text; the analytics endpoint drops any property it does not expect.
How long it is kept
Intake answers and documents are kept for 180 days after the order so that questions can be answered and the diagnostic re-issued if needed, then deleted. Ask sooner and they are deleted sooner. The order record (email, amount, dates, status) is kept as an accounting record.
To have your data deleted
Email hello@lenderready.ca from the address used at checkout, quoting the order reference on your status page. Deletion is confirmed by reply.
Cookies and third-party tags
Essential cookies keep sign-in and checkout working. Google Ads and Meta Pixel tags load only after you choose "Accept all" in the cookie banner; "Essential only" loads neither. The first-party analytics described above use a random id in your browser's storage, not a cookie, and send nothing to any third party.
Incidents
If we become aware of unauthorized access to your documents we will tell you by email, say what was affected, and say what we did about it.