Privacy Policy

This Privacy Policy explains how Bespoke Solutions Inc. ("we", "us") handles personal information in connection with Lending OS. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Two kinds of information, two roles

• Account information about the people who use Lending OS — advisors at our customer firms. We decide how this is used, and this policy describes it.
• Customer Data — the files and details advisory firms upload or collect about their clients (for example, borrowers' financial statements, personal tax returns, net worth statements, and contact details for borrowers, accountants, lawyers, and lenders). For this information, the advisory firm is responsible for it under privacy law, and we process it on the firm's behalf as its service provider, only to deliver the service. If you're a borrower or other individual whose information an advisor collected through Lending OS, please contact that advisory firm first; we'll help them respond.

2. What we collect

• Account details: name, email address, firm, role, and a hashed password (we never store your password itself), plus two-factor authentication settings.
• Customer Data that users, clients, and their advisors upload or enter, as described above.
• Usage and security records: sign-in events, an activity (audit) log of actions taken in the service, IP addresses (used for rate limiting and security), and basic device and browser information.
• Billing details: handled by Stripe; card numbers are entered on Stripe's pages and never reach our servers.
• Communications: messages you send us through the Help page or by email, and email addresses of people you invite or send requests to.

3. How we use it

• to provide the service — storing and organizing documents, running calculations, AI document reading, and sending the emails you trigger;
• to secure the service — authentication, two-factor checks, rate limiting, bot protection, fraud prevention, and audit logging;
• to bill customers and manage subscriptions;
• to support you and to diagnose and fix problems;
• to tell account holders about important changes to the service, these policies, or their account.

We don't sell personal information, we don't use Customer Data for advertising, and we don't use Customer Data to train AI models. We don't use advertising or third-party tracking cookies.

4. AI processing

When you upload a document or use an AI feature, the relevant content is sent to our AI provider, Anthropic, to be read and processed. Under Anthropic's commercial terms, this content is not used to train its models and is retained only for a limited period for trust and safety purposes before being deleted. Results are stored in your firm's workspace, where you can review and correct them.

5. Where information is stored

Lending OS's database, uploaded files, and application servers are located in Canada(Montréal). Some service providers listed below process limited information outside Canada — notably AI document processing and email delivery in the United States. When information is processed outside Canada it may be subject to the laws of that country, including lawful access by its authorities. We use contractual and technical safeguards to protect information wherever it's processed.

6. Service providers (subprocessors)

We'll update this list before adding a provider that processes Customer Data.

7. How information is shared

• Within your firm and with people you choose. Deal information is visible to the people your firm gives access to, and to clients, advisors, and lenders you invite through client portal links or lender data rooms. You control what each recipient can see and can revoke access at any time.
• With service providers listed above, only as needed to run the service.
• When required by law or to protect the rights, safety, or security of our users, the public, or us.
• In a business transfer, such as a merger or sale, subject to this policy.

Each firm's data is isolated: other firms using Lending OS cannot see your deals, documents, or lenders.

8. Security

We protect information with encryption in transit and at rest, firm-level data isolation, role-based access controls, two-factor authentication, hashed passwords and session tokens, rate limiting and bot protection, expiring client portal links with emailed one-time codes, audit logging, and daily database backups. No system is perfectly secure; if a breach of security safeguards creates a real risk of significant harm, we'll notify affected customers and individuals and report it to the Privacy Commissioner of Canada as the law requires.

9. Cookies

We use only essential cookies: a sign-in session cookie, short-lived cookies used during two-factor and Google/Microsoft sign-in, an optional "trusted device" cookie if you choose to skip two-factor codes on a device, and a short-lived verification cookie on client portal links. Cloudflare's bot check may set its own essential cookies. We don't use advertising or analytics tracking cookies.

10. Retention

• Account and deal information is kept while the account is active.
• When a deal or account is deleted, its records and uploaded files are deleted. Activity (audit) logs are kept after deletion because they're needed for security and compliance; billing records are kept as tax law requires.
• Database backups are kept for 7 days and then overwritten.
• Sign-in sessions expire after 30 days; client portal links expire after 90 days.

11. Your rights and choices

You can access and correct your account information in Settings, export your data at any time from your account settings, and delete your account. You may also ask us for access to or correction of the personal information we hold about you, ask how it's been used or disclosed, or withdraw consent (which may mean we can no longer provide the service). Write to privacy@lenderos.ca; we'll respond within 30 days. If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

12. Children

Lending OS is a business service and isn't intended for anyone under 18.

13. Changes

We'll post updates here and change the effective date above. For material changes we'll notify account owners by email or in the app before they take effect.

14. Contact

Our privacy contact can be reached at privacy@lenderos.ca. See also our Terms of Service.