Data and privacy note for partners

For employers and investing apps considering LoanRepo's small page. Plain language, based on how the product works today. Draft of 12 October 2026.

1. What the small page does with what a person types

There are two small pages. In the first, for people who have a home loan, the person types five numbers from their loan statement: balance, rate, EMI, original tenure and months paid. In the second, for people about to buy, they type the loan amount, tenure and the rate quoted, and optionally their monthly take-home income. In both, the calculation runs in their browser. These numbers are not saved and are not sent to LoanRepo.

2. What LoanRepo records

When a check finishes, one event is recorded: widget_check_completed. On the buyer page, if the person also types an income into the "If your income changes too" table, one more event is recorded, widget_grid_used, once. Each event carries:

Neither event carries any loan figure, income or result. Later steps (opening the full diagnosis, saving a report) carry the same partner tag and anonymous code. Our hosting and database providers may also keep ordinary server logs, which can include network addresses and browser details. We do not use them to identify individuals.

3. What a partner receives

A count of anonymous browsers at each step: checked, opened the full diagnosis, saved a report. Any count below 10 is shown as "<10". The report has no names, emails, loan figures or results, and the partner cannot query our database.

A sample is at demo-hr-report.html.

4. The optional hand-off to an investing app

If an investing app turns on the hand-off, a button appears after the result: "Add this to my liabilities" on the first page, "Add this to my plans" on the second and on the part-pay-or-invest page. Nothing is sent unless the person taps it. If they do, the loan figures and the result go only to the page that embeds LoanRepo, and the app stores them under its own consent and privacy terms. LoanRepo keeps nothing from this step beyond a count that the button was tapped.

On the part-pay-or-invest page the app can also send figures into the page by message, so the user need not retype them. Those figures stay in the browser, are not placed in the web address, and are accepted only from the page that embeds LoanRepo.

5. What we do not do

6. Enquiries sent through the partners page

If you send an enquiry through the form on the partners page, we store the details you type (platform type, organisation, your name, role and work email, and any optional answers) in LoanRepo's own database, and we email them to the LoanRepo mailbox. We use them only to reply to you. We do not add them to a mailing list, and we do not share them. The form does not send any email to the address you enter. To limit spam we keep a one-way hash of the network address for a short check; we do not store the address itself. To have an enquiry deleted, write to hello@loanrepo.in.

7. Roles and agreements

Not yet settled. Who acts as data fiduciary and who as processor under India's DPDP Rules 2025, in each mode, is a question we have put to counsel. Until that is answered, treat this note as a description of the product, not as a legal position or a certification.

A pilot agreement and data-processing terms will be shared before any launch.

8. Items to agree or confirm

ItemStatus
How long anonymous events are keptTo be agreed. Proposal: 12 months.
Where the database is hostedTo be confirmed in writing before launch.
Roles under DPDP, and consent wording for the partner's own screensWith counsel.
Security review of the embed and hand-offOffered before launch.

Questions: hello@loanrepo.in. This note is education about the product, not legal advice. See also the embedding guide.