Privacy Policy

Last updated: 04/30/2026

Introduction

This Privacy Policy explains how Heirloom Equity LLC ("NoteLedger", "we", "our", or "us") collects, uses, and shares information when you visit our website, sign up for an account, or use the NoteLedger application. By using NoteLedger you agree to the practices described in this policy.

Information we collect

Information you provide. When you sign up we collect your name, email address, optional company name, optional phone number, and optional company mailing address. When you contact us through our contact form we collect the information you submit. Within the application you may enter information about mortgage notes, payments, borrowers, entities, and related portfolio data; this is your customer data and you control its content.

Information we receive from integrations. If you connect Google or Microsoft 365 you authorize NoteLedger to access the data covered by the OAuth scopes you grant — typically email metadata and contact records used to populate your inbox and contacts. If you connect a loan servicer (Allied, Madison, FCI), we receive note, payment, and borrower records you have authorized that servicer to share.

Information collected automatically. Our servers log standard request metadata (IP address, user-agent string, timestamp, URL) for security, abuse prevention, and operational monitoring. The marketing site does not use analytics, advertising, or third-party tracking cookies.

Payment information. Card details are collected by Stripe directly; NoteLedger does not see or store your full card number. We receive a Stripe customer identifier and the last four digits of your card.

How we use your information

We use the information described above to provide and maintain the service, authenticate you, process payments and manage your subscription, communicate with you about your account and the service, secure the platform and prevent fraud, and comply with legal obligations.

How we share your information

NoteLedger uses third-party service providers ("subprocessors") to operate the platform. These providers receive only the information necessary to perform their function and are contractually required to protect it.

• Auth0 — user authentication and identity management
• Stripe — payment processing and subscription billing
• MongoDB Atlas — managed database hosting
• Google and Microsoft — only when you connect those accounts; we act on your authorization to read data within the scopes you grant
• Loan servicers — only the servicer you choose to connect and only the records that servicer has authorized for sharing

We may also disclose information when required by law (subpoena, court order, regulatory request), to enforce our terms, to protect our rights or those of a third party, or in connection with a corporate transaction (merger, acquisition, asset sale) where the recipient agrees to honor this policy.

We do not sell your personal information.

Data retention

We retain your information while your account is active and for a reasonable period afterward to satisfy legal, tax, accounting, and dispute-resolution obligations. Backups containing your data are retained for up to 30 days. You may request deletion of your account and associated personal data at any time by contacting us at privacy@heirloomequity.com.

Security

We protect your data with encryption in transit (HTTPS / TLS) and encryption at rest in our hosted database. Access to production systems is limited to authorized personnel and protected by multi-factor authentication. No system is perfectly secure; in the event of a breach affecting your personal information we will notify you and any required regulators in accordance with applicable law.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email privacy@heirloomequity.com from the address associated with your account. We respond to verified requests within 30 days.

Children's privacy

NoteLedger is not directed to children under 18 and we do not knowingly collect information from anyone under 18. If you believe we have inadvertently collected such information, contact us at privacy@heirloomequity.com and we will delete it.

International users

NoteLedger is operated from the United States and your information is processed and stored in the United States. If you access the service from another jurisdiction, you consent to that transfer.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes we will post a notice on this page and may also notify you by email at the address associated with your account.

Contact

Questions or requests about this policy can be sent to privacy@heirloomequity.com or by mail to:

Heirloom Equity LLC 411 S Dunton Ave Arlington Heights, IL 60005