Privacy Policy

Effective October 18, 2026. Last updated October 21, 2026.

Updated October 18, 2026: we explain how we may use de-identified and aggregated information, name our AI provider, state how long we keep each kind of information, and add our financial privacy notice. Updated October 21, 2026: we narrowed what we do with de-identified information drawn from your financial account information.

This Privacy Policy explains how LOAM Financial LLC ("LOAM," "we," "us") collects, uses, shares, and protects personal information in connection with the LOAM service: our website at loamfinancial.com and the LOAM application (together, the "Service").

LOAM analyzes your own financial transaction history and returns a monthly savings-opportunity report. That means we handle unusually sensitive information, and this policy is written to say plainly what we do with it.

Please note: LOAM has not yet opened to the public. This policy describes the practices that apply to the Service as we operate it, and applies to information collected through this website today and through the application when it becomes available.

1. Information we collect

Information you give us

Account information. Your email address, which is how you sign in, with a one-time code we email you. We do not offer sign-in through Google or any other identity provider.
Self-identified information. During onboarding we ask you to describe yourself: age range, gender, race or ethnicity, ZIP code, income range, housing status, household size, employment status, and education. Every one of these questions can be answered "prefer not to say." These answers are self-reported by you; we never infer them from your financial data. Several of these are sensitive personal information under state law. We use them only in combined, de-identified totals, as described in section 3, and never to make decisions about you individually.
Your input on the report. When you mark a recurring charge as keep, maybe, or cancel, or answer a question the report asks you, we store your answer so future reports reflect it.
Support correspondence. Messages you send us and our replies.

Financial account information

With your permission, and through Plaid (see the next section), we receive information about the financial accounts you choose to connect. Depending on the account and the institution, this includes: account names, types, and masked account numbers; current and available balances; transaction history (dates, amounts, descriptions, merchant names, and categories, going back up to 24 months; and information about credit and loan accounts such as interest charged, statement balances, and fees.

Payment information

Subscription payments are processed by Stripe. Your card details are collected by and stored with Stripe. LOAM never receives or stores your full card number. We receive from Stripe a customer and subscription identifier and limited details such as the card brand, last four digits, expiration, and the status of your subscription.

Information collected automatically

Technical and log information. IP address, browser and device type, pages requested, timestamps, and error information. We use this to operate the Service, to keep it available, and to detect and limit abuse such as automated login attempts.
Cookies. We use cookies that are strictly necessary to sign you in and keep you signed in, and to protect forms against cross-site request forgery. We do not use advertising cookies and we do not run third-party advertising or analytics trackers on this website.
Email delivery information. Our email provider tells us whether a message we sent was delivered, bounced, or was marked as spam, so we can tell when we have failed to reach you. We do not use open or click tracking in our emails.

Information from partner organizations

If an organization sponsors your access to LOAM (see section 6), that organization may give us your email address, an internal reference identifier, and (if you provided them to that organization) answers to the self-identification questions above. Any answers a sponsor supplies are shown to you for review before they are saved to your LOAM account. You can change or clear any of them, and nothing is saved to your account until you confirm it. If you never register, we delete any answers the organization sent within 90 days and keep only the invitation record (your email address and the organization's reference for you) so that the organization can see its invitation was not taken up; we delete that record within three years.

2. Bank connections and Plaid

LOAM uses Plaid Inc. ("Plaid") to connect to your financial institutions. Plaid is the service that many banking and personal-finance apps use for this purpose.

Your bank credentials go to Plaid and your financial institution, never to LOAM. You enter them inside Plaid's own interface, or you are handed off to your bank's website to authorize the connection there. LOAM does not see, receive, or store your banking username or password.
You choose which accounts to connect, and Plaid shows you what types of data are being requested and what they will be used for before you authorize the connection.
Plaid processes your information in accordance with the Plaid End User Privacy Policy. By connecting an account, you agree that Plaid may collect, use, and share your information as described in that policy. We encourage you to read it.
Plaid maintains a portal at my.plaid.com where you can see which apps you have connected through Plaid and disconnect them.
You can disconnect a bank from LOAM at any time. When you do, we instruct Plaid to remove the connection, which stops any further data from reaching us.

3. How we use information

We use the information described above to:

Produce your report: identify recurring charges and subscriptions, total the credit card interest and overdraft or insufficient-funds fees you paid, detect cash sitting idle in low-interest accounts, flag price increases and newly appearing charges, and show what changed since your last report.
Create and secure your account, sign you in, and keep your session valid.
Send you service messages: sign-in codes, a notice that a report is ready, and billing notices such as an upcoming renewal or a failed payment. Report emails contain a link to sign in; we deliberately do not put your financial details in email.
Take payment for your subscription and manage renewals and cancellations.
Operate, secure, and improve the Service: monitoring, troubleshooting, fraud and abuse prevention, and rate limiting.
Comply with law and enforce our Terms and Conditions.

The self-identified information described in section 1 is used only in combined, de-identified totals: to understand who LOAM serves, to show a sponsoring organization and its funders in totals that a program reaches the people it is meant for, and to create the de-identified statistics and insights described next. It does not feed your report, is never sent to the AI model, is never shown to a sponsoring organization about you individually, and is never used to target you with anything.

De-identified and aggregated information. We may create de-identified or aggregated information from any information we hold, including your financial account information, your self-identified information, and how you use the Service, by removing or combining details so that it no longer identifies you or your household. We use this information to operate, evaluate, and improve the Service and to understand who it serves. Information drawn from your financial account information is shared outside LOAM only as combined totals that describe no individual account or person, with sponsoring organizations and their funders to evaluate their programs; we do not sell or license information derived from your financial account information. De-identified or aggregated information drawn from your self-identified answers and your use of the Service may be shared with, licensed to, or sold to sponsoring organizations, funders, researchers, and other organizations. We take reasonable measures to ensure it cannot be linked back to you, we publicly commit to maintain and use it only in de-identified form and never to attempt to re-identify it, and we require anyone who receives it from us to make the same commitments. De-identified information is not personal information, and the rights in sections 10 and 11 do not apply to it. Our agreements with the companies that supply financial data (section 2) may further limit these uses, and we follow them.

We do not use your financial data for advertising, we do not build advertising profiles, and we do not sell leads based on your transactions.

4. Automated analysis and AI

Your report is produced with the help of a large language model (Google's Gemini) running inside LOAM's own Google Cloud environment. Some of your transaction information (descriptions, amounts, dates, and merchant names) is sent to that model in order to recognize recurring charges and write the report's explanations.

Your data is not used to train the model. Our agreement with our AI provider prohibits using our customers' data to train or improve its models.
Google's safeguards. If Google's automated safety systems flag a request as possible abuse, Google may keep that request for up to 90 days and authorized Google staff may review it. LOAM is seeking Google's approval to turn this off for our account; until it is granted, this remains possible. Google does not guarantee where this processing happens geographically.
Transaction descriptions can be revealing: a payment to a clinic or a place of worship, for example. We send them to the model because the report needs them, and for no other purpose.
Every dollar figure you see is computed by our own software, not written by the model, and each finding is checked against the underlying transactions before the report is shown to you.
Your self-identified information (age, gender, race or ethnicity, income, and the rest) is never included in what we send to the model.
The report is informational. It is not a decision about credit, insurance, employment, housing, or any other benefit, and LOAM is not a consumer reporting agency.

We share personal information only in these circumstances:

Service providers who process information on our behalf, under contract, and only for the purposes we specify. As of the effective date of this policy these are:
- Plaid: financial account connectivity and transaction data.
- Google Cloud: hosting, storage, and the AI model (Gemini) that helps generate your report.
- Stripe: subscription payments.
- Postmark: delivery of the emails we send you.
- Cloudflare: hosting of this public website; it sees visitors' IP addresses and holds no account data.
An organization that sponsors your access, on the limited terms described in section 6.
Legal and safety: when we believe in good faith that disclosure is required by law, legal process, or a governmental request, or is necessary to protect the rights, property, or safety of LOAM, our users, or the public.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or give you notice and a choice before your information becomes subject to a materially different one.
De-identified or aggregated information, as described in section 3; it does not identify you.
With your consent, for anything else.

6. Sponsors and partner organizations

LOAM can be offered to you through an organization (for example a housing counseling agency, a lender, or a financial-education program) that pays for your first months of access. If you came to LOAM that way, here is exactly what that organization can see:

Always: your email address, any internal reference number they assigned you, and your progress through onboarding: invited, registered, accounts connected, first report delivered, or continued as a paying subscriber. They can also see whether our emails to you are bouncing and whether a bank connection has broken, so they can help you.
Only if you check the box giving permission: for each report delivered to you, the month, the type of report, and the single headline estimated-savings figure.
Never, regardless of consent: your report itself, individual transactions, merchant names, account balances, any dollar figure other than that one headline number, and your self-identified information.

Giving that permission is optional and you can withdraw it at any time in your account settings. Withdrawing it stops the organization from seeing report summaries going forward. Every time an administrator at that organization views your summary, we record it in our audit log.

A sponsoring organization pays LOAM for your initial access. What it sees about you is limited to the above; it sees it because you joined LOAM through its program and, for report summaries, because you gave permission; and it may use it only to administer its program. We do not consider this a sale or sharing of your personal information.

7. We do not sell your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and comparable state laws. We have not done so in the preceding twelve months. Sharing de-identified or aggregated information (section 3), which does not identify you, and the limited disclosures to a sponsoring organization described in section 6 are not sales of personal information. LOAM is paid by subscription and by the organizations that sponsor access, not by advertisers. If we ever license de-identified information (section 3), it will not identify you, and it is not a sale of your personal information.

8. How we protect information

We use administrative, technical, and physical safeguards designed to protect your information, including:

Encryption of data in transit (TLS) and at rest.
Separate, additional encryption of bank connection credentials using managed hardware-backed keys, so that they are never stored in readable form and are decrypted only in memory at the moment they are used.
Access controls limiting internal access to what operating the Service requires, with access recorded.
We design our systems so that bank connection credentials and the contents of your financial data stay out of our logs and error reports, and we verify this in our security reviews.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

9. How long we keep information

While your account is open, we keep your account information, transaction history, reports, and the choices you made about recurring charges, because month-over-month comparison is the point of the product: a report is only meaningful against the months before it.

If you close your account, we disable sign-in, cancel your subscription, and remove your bank connections so no further data reaches us. We then keep your information for up to three years after closure, so that you can come back with your history, and then delete it, except the records we must keep for tax, accounting, audit, legal, and security purposes, which we keep for the periods in the table below.

You can ask us to delete your information sooner; see section 10. Information we delete may remain in our encrypted backups for up to 30 days, until those backups expire. If we ever restore a backup, we delete that information again.

What we keep, why, and for how long
Category	Examples	Where it comes from	Why we use it	Who else receives it	How long we keep it
Account identifiers	Email address, account and sign-in records, a sponsor's reference number for you	You; a sponsoring organization, if one invited you	Sign you in, secure your account, send service messages	Our service providers (section 5); a sponsoring organization, as described in section 6	While your account is open, then up to three years after closure
Self-identified information	Age range, gender, race or ethnicity, ZIP code, income range, housing status, household size, employment status, education	You; answers a sponsoring organization relays, which you review before they are saved	Combined, de-identified totals only (section 3)	Google Cloud, as our host. Never shown to a sponsoring organization about you individually, and never sent to the AI model	While your account is open, then up to three years after closure; you can clear it at any time. Answers relayed by a sponsoring organization that you never confirm: deleted within 90 days
Financial account information	Accounts, balances, transactions, interest and fees on credit and loan accounts	Your financial institutions, through Plaid, at your direction	Produce your report	Plaid; Google Cloud, as our host and AI provider (section 4)	While your account is open, then up to three years after closure
Reports and your input	Your monthly reports; your keep, maybe, or cancel choices and answers to the report's questions	We produce the reports; you give the input	Show you your report and what changed since the last one	Google Cloud, as our host. A sponsoring organization sees the month, the kind of report, and one headline figure, only with your permission (section 6)	While your account is open, then up to three years after closure
Payment information	Card brand, last four digits, expiration, subscription status, billing records	Stripe; you give your card details to Stripe directly	Take payment and manage your subscription	Stripe	Billing records: seven years, for tax and accounting. Your card itself is kept only at Stripe, never by LOAM
Technical and log information	IP address, browser and device type, pages requested, timestamps, error information, email delivery status	Collected automatically when you use the Service or we email you	Operate the Service, keep it available, and detect and limit abuse	Google Cloud, as our host; Cloudflare, which hosts this website; Postmark, for email delivery	Application logs: 90 days. Security audit logs of access to our systems, which hold identifiers rather than your financial data: 400 days
Enrollment information from a sponsoring organization	Your email address, its reference number for you, your progress through onboarding	The organization that sponsors your access	Invite you, and show the organization your progress (section 6)	That organization	As account identifiers, above
Consent records	What you agreed to, which version of the wording, and when	You, when you agree or withdraw	Show that we asked and that you agreed	No one	The life of your account plus three years, and at least three years after a consent ends
Audit records	Who viewed or changed what, and when; for example, each time a sponsoring organization's administrator views your report summary	Recorded by the Service	Security and accountability	No one	For the life of the Service, as a security record; they are never edited and hold no financial details

10. Your choices and rights

Disconnect a bank at any time, from within LOAM or through my.plaid.com.
Decline the self-identification questions: every one of them offers "prefer not to say."
Withdraw sponsor visibility: if an organization sponsors you, you control whether they see report summaries.
Access, correct, or delete your personal information, and receive a copy of it in a portable format. Write to support@loamfinancial.com.
Cancel your subscription at any time; see the Terms and Conditions.
Emails. The emails LOAM sends are transactional (sign-in codes, report notices, and billing notices) and are part of the Service rather than marketing. Closing your account stops them.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before acting on a request, and we may decline part of a request where the law permits us to; for example, where we must keep a record for legal or accounting reasons, or where honoring it would compromise another person's privacy or the security of the Service. We will tell you when and why.

We respond to access, correction, deletion, and portability requests within 45 days; if we need longer we may extend once by another 45 days and will tell you. We verify a request by sending a one-time code to the email address on your account, or, if you no longer have access to it, by asking for information only the account holder would know.

11. U.S. state privacy rights

If you live in California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you have the rights described in section 10: to know, access, correct, delete, obtain a portable copy, opt out of sale or targeted advertising (we do neither), and limit the use of sensitive personal information. To exercise them, write to support@loamfinancial.com. You may use an authorized agent, and if we deny a request you may appeal by replying to our response; we will answer an appeal within the time your state's law allows.

Sensitive personal information. Financial account information and the self-identified information described in section 1 are sensitive under some state laws. We use them only to provide and secure the Service and for the de-identified, combined-total uses described in section 3. We do not use self-identified information to infer characteristics about you, we do not sell sensitive personal information, and we do not use it for advertising.

Financial privacy notice (Gramm-Leach-Bliley Act). Because LOAM provides a financial service, we treat the nonpublic personal information we obtain about you in connection with it (your financial account information and the fact that you use LOAM) as protected by the federal Gramm-Leach-Bliley Act and its implementing rules, and this Privacy Policy is our privacy notice under that law. We collect that information from you and, at your direction, from your financial institutions through Plaid. We disclose it only to service providers that help us operate the Service (section 5), at your direction or with your consent (for example, to a sponsoring organization as described in section 6), and as the law permits or requires. We do not share it with affiliates (we have none) or with nonaffiliated third parties for their own marketing, so there is nothing for you to opt out of. We maintain a written information security program with physical, electronic, and procedural safeguards (section 8). Former customers receive the same protections.

12. Children

LOAM is intended for adults. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, write to support@loamfinancial.com and we will delete it.

13. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date above. If a change materially affects how we use information we already hold about you, we will give you notice (by email or in the application) before it takes effect, and where the law requires consent, we will ask for it rather than assume it.

14. Contact us

LOAM Financial LLC, an Arizona limited liability company.
Email: support@loamfinancial.com

For privacy requests, please put "Privacy Request" in the subject line so we can route it promptly.

Accessibility. We design LOAM to work with assistive technology and aim to meet WCAG 2.2 Level AA. If any part of the Service or this policy is hard for you to use, write to support@loamfinancial.com and we will help, including by providing information in another format.