Legal

Privacy Policy

Last updated: October 11, 2026

Aloan Inc. (“Aloan”, “we”, “us”) makes software that banks and credit unions use to collect loan documents, spread financial statements, check credit policy and draft credit memos. This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

It covers:

aloan.ai and any other Aloan website that links to this policy (the “Sites”);
the Aloan platform at app.aloan.ai, including the loan application and document portal that lenders offer to their borrowers (the “Platform”);
email, phone, chat and text messages between you and us.

Scope

Two roles

We handle personal information in two different capacities, and your rights depend on which one applies.

On our own behalf

When you visit the Sites, ask for a demo, download a guide, chat with us, contact us about a job, or sign in to the Platform as an employee of a lender, we decide what we collect and why. This policy applies in full.

On behalf of a lender

When a bank or credit union uses the Platform to process a loan, the lender decides what information to collect from borrowers and guarantors and what to do with it. We process that information only under our agreement with the lender and on its instructions. If you applied for a loan through a lender that uses Aloan, the lender’s own privacy notice governs. Contact the lender with questions or requests about your information, and we will help the lender respond.

Collection

Information we collect

Information you give us

Demo and contact requests. Your name, work email, company, phone number, how you heard about us, and anything you write in the message box.
Demo bookings. The name, email, company and notes you enter when you book a time, plus the advertisement or campaign that brought you to the Sites, if any.
Downloads. Your name, work email, company and phone number when you download a playbook or guide.
Investor updates. The email address you enter to open the investor updates page.
Chat and correspondence. What you send us by live chat, email, phone or text, and the contact details you use to send it.
Platform accounts. Your name, work email, role and employer when you sign in to the Platform as a lender employee, and the record of what you do there.

Information we collect automatically on the Sites

Device and browser type, operating system, IP address, and the approximate location that IP address implies.
The pages you view, how long you stay, and how you arrived (a search engine, a link, an advertisement).
The advertising click identifiers and campaign parameters in the link you arrived on. We keep them in your browser for 30 days so that a demo booked later in the visit is credited to the right campaign.
Cookies and similar tools, described under Cookies and tracking below.

Information processed on the Platform for lenders

Lenders and their borrowers upload what a commercial loan file holds: business and personal tax returns, financial statements, bank statements, rent rolls, leases, personal financial statements of guarantors, entity ownership details, loan application answers, and the contact details used to send application updates. Where a lender orders a credit report through the Platform, this includes the identifiers the credit bureau requires. We process all of it on the lender’s behalf, as described above.

Use

How we use information

On our own behalf

To answer your request, schedule and run a demo, and set up a demo environment for you.
To provide, secure and support the Platform for lender employees.
To send product news and marketing email. Every message carries an unsubscribe link.
To understand how the Sites are used and improve them.
To measure whether our advertising works.
To detect abuse, protect our systems, enforce our agreements and meet our legal obligations.

On behalf of lenders

We use borrower and guarantor information only to deliver the Platform to the lender: to classify and extract documents, spread financial statements, test the lender’s credit policy, draft credit memos for the lender’s analysts, send the application updates the lender asks us to send, and monitor loans after closing. We do not use it for marketing or sell it, and no AI model is trained on it.

AI processing

How AI is used

The Platform uses commercial AI services from Google Cloud (Gemini) and Amazon Web Services (Bedrock) to read documents, extract figures, answer analyst questions and draft memos. All of this processing happens in the United States. Our contracts with these providers prohibit using any input or output to train or improve their models, and each provider keeps data only as long as its published terms state.

The AI produces drafts for the lender’s analysts to review. The lender’s own staff make every credit decision. Our AI and LLM Data Isolation Policy, available on our trust center, names the providers, the retention settings and the controls in detail.

Cookies and tracking

The Sites use these tools:

HubSpot, our customer relationship system. It sets a cookie that ties a later form fill or chat to your first visit, and it runs the live chat.
PostHog, for analytics on page views and clicks.
Google Tag Manager, which loads Google Ads conversion measurement and the LinkedIn Insight Tag.
Meta Pixel, for conversion measurement on Facebook and Instagram advertising.

These tools set cookies and may receive your IP address, browser details and the pages you view. Google, LinkedIn and Meta may combine that with information they already hold about you, under their own privacy policies.

You can block or delete cookies in your browser settings; the live chat and the demo scheduler may stop working if you do. You can also adjust advertising settings in your Google, LinkedIn and Meta accounts. The Sites do not respond to browser “Do Not Track” signals.

Sharing

Who we share information with

Service providers

Companies that host and run the Sites and the Platform (Cloudflare, Render, Amazon Web Services), our customer relationship system and email (HubSpot), demo scheduling (Cal.com), analytics (PostHog), advertising measurement (Google, Meta, LinkedIn), transactional email and text messages (SendGrid, Twilio), sign-in (WorkOS), e-signature (DocuSeal), error monitoring (Sentry) and AI processing (Google Cloud, Amazon Web Services). Each is bound by contract to use information only to provide its service to us. The current list of providers that process lender data, with what each one handles, is on our trust center.

Lenders

Borrower and guarantor information goes to the lender it was submitted to, and to no other lender.

Legal requirements

When the law requires it, to respond to a subpoena or court order, or to protect the rights and safety of Aloan, our customers or others.

Business transfers

If Aloan is acquired or merges with another company, personal information may transfer to the new owner, who will be bound by this policy.

We do not sell personal information, and we do not share it with third parties for their own marketing.

Security

How we protect information

Aloan holds a SOC 2 Type 2 report and has an independent penetration test performed every year. Data is encrypted at rest with AES-256 and in transit with TLS. Access follows least privilege with unique accounts and multi-factor authentication, and administrative actions are logged. More detail is on our security page.

No system is perfectly secure. If an incident affects your information, we will notify the affected customers as our agreements and the law require.

Location

Where information is stored

All storage, processing and backups take place in the United States. Aloan does not offer its services in the European Union or the United Kingdom. If you reach the Sites from outside the United States, your information is transferred to and stored in the United States.

Retention

How long we keep information

Website and marketing information for as long as we have a business reason to keep it, such as while we are in contact with you or your company. We delete it on request.
Platform data for the term of the lender’s agreement. At termination the lender chooses return or destruction, completed within 60 days with written certification. Deletion requests during the term are completed within 30 days.
Security logs for six months. Database backups roll off on a seven-day cycle.
Business records such as invoices and contracts for seven years, where the law requires it.

Your choices

Your choices and rights

Marketing email. Use the unsubscribe link in any message, or email us.
Text messages. Reply STOP to any text message from us.
Access, correction and deletion. Email privacy@aloan.ai. We will verify that the request comes from you and respond within 30 days. We will not treat you differently for making a request.
Borrowers and guarantors. Send requests about a loan application to your lender. We will help the lender respond.

Depending on where you live, state privacy law may give you additional rights. We honor requests to access, correct and delete the personal information we hold on our own behalf whether or not a law requires it.

Children

The Sites and the Platform are built for businesses and the adults who work with them. We do not knowingly collect personal information from anyone under 18.

Changes

Changes to this policy

When we change this policy we update the date at the top of the page. Where a change affects how we process lender data, we tell the affected lenders in writing before it takes effect, as our agreements require.

Contact

Contact us

Aloan Inc.
455 Market St Ste 1940, PMB 799037
San Francisco, CA 94105-2448
privacy@aloan.ai