LOANPREP PRIVACY POLICY

Your Privacy Matters

LoanPrep ("the App", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we handle information when you use our iOS application.

Key Principles

• Your loan assessment inputs and related financial information are intended to remain on your device
• We do not operate an account system or our own cloud database for your loan assessment inputs
• Transparent about advertising and data collection
• Controls for locally stored app content and applicable advertising choices
• Privacy practices are applied subject to applicable law

Information We Collect

LoanPrep is designed to operate locally on your device. We collect and process only the information necessary to provide our services:

Assessment Information (Stored Locally)

• Selected app region, loan amount and loan purpose
• Monthly income range and employment status
• Credit history category
• Whether you report having valid identification and the type of bank account you select
• Age range, which is stored for display and is not used in the current eligibility calculation
• Asset-ownership categories you select
• For assessments created through an earlier assessment flow, employment duration, existing debts, and collateral type or value, if provided

App Usage Data (Stored Locally)

• Points balance and transaction history
• Daily check-in streaks
• Rewarded video watch history
• Checklist items and progress
• Assessment results and history
• Reports you choose to save, including a custom report name and notes you enter
• Purchase and points-redemption records used to calculate remaining report credits and entitlement status. A local record is automatically removed after all report credits represented by that record have been used
• App preferences and state, including appearance, currency, selected region, reminder settings and times, onboarding state, your Usage Analytics choice, and a manually selected legal-document language
• A limited queue of analytics events awaiting retry if Firebase is not yet available. Nothing is added to this queue while Usage Analytics is off, and the queue is removed by Delete All Data

Advertising Frequency and Timing Data (Local)

So that we can limit how often advertisements appear and reduce the risk of showing them at inappropriate moments, the App uses the following local information:

• Persistent on-device counters and dates, including the number of full-screen advertisements shown for applicable daily limits, the time the most recent one was shown, installation date, recent active days and app-open counts
• A simple activity tier that your device derives from those counters — for example, whether you are a new, occasional or frequent user of the App. It is recalculated on your device and is used only to decide how many full-screen advertisements may be shown and how far apart they must be
• Temporary in-memory session signals, including the current-session advertisement count, number of relevant screen transitions, time spent on an eligible screen and recent rapid back-navigation timing. These signals reset when the applicable session or process resets
• The timestamp of the most recent observed screen tap, held temporarily in memory and used to abort a pending full-screen advertisement when a tap has just occurred. The App does not record what you tapped, where you tapped or the content of the interaction

These App-managed advertising-frequency and timing signals, together with the activity tier derived from them, remain local. They are not transmitted off your device, are not uploaded to our own servers, and are not used to select or personalize the advertisements you see. This local pacing is separate from advertising interaction and measurement data processed by Google or an advertising provider after an ad request or impression.

Advertising Consent Information

Where an advertising consent form is required, your choices are managed by Google's User Messaging Platform and stored or otherwise processed by Google and on your device in accordance with Google's consent framework and privacy documentation.

Purchase Information

• Product purchased (single report or package)
• Number of reports included and used
• Apple transaction ID and product ID
• Purchase date

Advertising Data (Collected by Third Parties)

• Advertising identifier (IDFA) — only with your consent
• Device and app information (device type, OS version, app version)
• Ad interaction data (impressions, clicks, video completions, ad format and placement)
• Ad performance and revenue measurement data (the ad network that served an ad and the estimated revenue of an impression)
• Coarse location (country/region level)

Where required by law, the App does not release an advertising request until Google's User Messaging Platform reports that an ad request may be made. That status can reflect consent, a choice to receive limited or non-personalized advertising, or a determination that a consent form is not required. The data used for a particular request depends on your choices, device settings, applicable law, Google's configuration and the participating advertising provider.

Analytics Data (Collected by Firebase)

We use Google Firebase Analytics to understand app usage and measure purchases and advertising performance. Depending on SDK behavior, device settings and our event configuration, Firebase may collect or receive:

• Device and app information (model, OS version, screen size, app version, app-instance and other permitted device identifiers)
• App usage data (screens viewed, session duration, app opens, feature interactions)
• Purchase events (transaction amount, currency, product ID, Apple transaction ID and quantity — no payment card information)
• In-app events (points earned or spent, points balance, rewarded video completions and daily rewarded-video count). A points redemption may include an app-generated transaction reference used to prevent duplicate event reporting; it is not an Apple payment transaction ID
• Advertising performance events (ad impressions, ad format, ad placement, the ad network that served the ad, and the estimated revenue of an impression)
• Approximate location (country/region level based on IP address)
• Technical and app-lifecycle information made available by the Firebase Analytics SDK

Firebase Analytics collection is switched off when the App is installed. The App keeps collection off until Google's User Messaging Platform consent flow has completed, and in regions where a consent form is required it additionally waits until Google reports that requests may be made. The resulting choice is remembered for later launches. You can turn Firebase Analytics collection off at any time via Profile → Data Management → Usage Analytics; while it is off, the App neither sends analytics events nor stores them on your device for later retry. UMP controls advertising consent and whether the App releases advertising requests; ATT controls access to the IDFA for tracking.

Notification Information (Stored Locally)

If you grant notification permission, the App uses Apple's local notification system to schedule optional daily check-in and weekly checklist reminders on your device. We do not register the App for remote push notifications or send a push-notification device token to our servers.

System Permissions We Do Not Request

LoanPrep's own feature code does not request access to your contacts, photo library, camera, microphone, precise location, health data or Bluetooth, and does not perform local-network discovery or scanning. The only permissions the App may request are notification permission for local reminders and App Tracking Transparency permission for advertising, as described in this Policy. The App declares no other permission purpose strings. Any network behaviour of a third-party SDK is subject to that SDK's version, configuration and provider documentation.

How We Use Your Information

Your loan assessment inputs and core assessment processing remain local to your device. Other technical, purchase, analytics and advertising data may be processed by Apple or Google as described in this Policy. We use information to:

Provide Core Features

• Generate loan preparation assessment reports using automated analysis
• Create preparation checklists based on your inputs
• Track your progress and activities
• Manage points and daily check-in features
• Process rewarded video completions for points
• Store your preferences and settings

Fulfill Purchases

• Track available report credits
• Maintain the local purchase or redemption records currently needed to calculate unused report credits; records with no remaining credits are removed during local cleanup
• Verify entitlements for paid features

Display Advertisements

• Show banner advertisements, including collapsible banner formats, within the App
• Show native advertisements that are styled to match the surrounding content and are always labelled as advertising
• Display rewarded video advertisements (optional and user-initiated)
• Display interstitial (full-screen) advertisements at natural break points, such as when you leave a checklist detail page or close a history panel
• Show app open advertisements on launch or when returning to the App

Control How Often Advertisements Appear

• Limit the number of full-screen advertisements shown per session and per day
• Adjust those limits according to a simple activity tier that your device derives from how long the App has been installed and how often you have opened it recently, so that newer or occasional users see fewer full-screen advertisements
• Keep advertisements away from sensitive moments, such as while a purchase is being completed or while your assessment report is being generated and first delivered
• Avoid displaying a full-screen advertisement immediately after you tap the screen, to reduce accidental clicks
• Note: this processing happens entirely on your device. The activity tier and the counters behind it are not transmitted off your device, are not used to select or target the advertisements you see, and are not used to build an advertising or marketing profile of you

Analyze App Usage (via Firebase Analytics)

• Understand app opens, sessions and app-lifecycle or usage trends made available by Firebase Analytics
• Understand which features users find helpful
• Investigate product issues reflected in the analytics events described in this Policy
• Improve user experience based on aggregated usage patterns
• Measure business metrics (user retention, feature adoption)
• Note: This analysis primarily uses aggregated and pseudonymous data and is not associated by us with your name or contact information
• The current App does not integrate Firebase Crashlytics or Firebase Performance Monitoring and does not intentionally send crash reports, stack traces or custom performance traces through those products
• Note: this analysis only takes place while Usage Analytics is on. It is off until the advertising consent flow has completed and can be switched off at any time in Profile → Data Management

Data Storage & Security

Local Storage

Your loan assessment inputs, assessment results, checklists and related financial information are stored within the App's local iOS sandbox using local persistence mechanisms such as UserDefaults and local files. We do not intentionally transmit these financial inputs to our advertising or analytics providers. Technical, usage, purchase, advertising and diagnostic data may be transmitted as separately described in this Policy.

User-Initiated PDF Export and Sharing

If you choose to export an assessment report, the App creates a PDF in the device's temporary storage and opens the iOS share sheet. The PDF may contain information from your assessment report. It is sent to an app, person or service only when you select a sharing destination. Your selected destination processes the PDF under its own privacy practices; review the destination before sharing sensitive information.

iCloud Backup

If you have iCloud Backup enabled, your iOS device may automatically backup LoanPrep data as part of your device backup. You can manage this in your iOS Settings → [Your Name] → iCloud → Manage Storage.

Security Measures

• We use iOS platform security features
• Data is protected by your device security (passcode, Face ID, Touch ID)
• We do not operate our own cloud database for your loan assessment inputs; Apple and Google process the limited categories described in this Policy through their services
• We review and update the App's security and privacy practices as appropriate

Data Sharing & Transfers

Data may be disclosed or transferred only in the circumstances described below, when you direct a transfer, or when disclosure is required by applicable law.

Sharing You Initiate

When you select a destination in the iOS share sheet, the App provides the exported assessment-report PDF to that destination at your direction. The destination may be another app, a person or a service and handles the file under its own privacy practices. We do not choose the destination for you.

Google AdMob (Advertising Partner)

We use Google AdMob to display banner, collapsible banner, native, rewarded video, interstitial and app open advertisements. AdMob may collect:

• Advertising identifier (IDFA) — with your consent
• Device and app information, and other identifiers or signals that Google is permitted to use under your consent choices, device settings, applicable law and Google's policies, to select, deliver and measure ads
• Ad interaction data (views, clicks, video completions, ad format and placement)
• Ad performance and revenue measurement data (the ad network that served an ad and the estimated revenue of an impression)
• Coarse location data (country/region)

Where required by law, the App releases an AdMob request only after Google's User Messaging Platform reports that an advertising request may be made. This does not necessarily mean that you accepted every advertising purpose: UMP may permit limited or non-personalized advertising, or may determine that a consent form is not required.

See Google's Privacy Policy: policies.google.com/privacy

Google Firebase Analytics (App Performance & Analytics)

We use Google Firebase Analytics, a service provided by Google LLC, to analyze how users interact with our app and improve user experience. Firebase collects and processes the following data:

Data Collected by Firebase

• Technical data: Device model, operating system version, app version, app-instance and other permitted identifiers
• Usage data: Screens viewed, features used, session duration, app opens
• Event data: In-app purchases completed, transaction amount, currency, product ID, Apple transaction ID, points earned or spent, points balance, app-generated points-redemption transaction references and rewarded videos completed
• Advertising measurement data: Ad impressions, ad format, ad placement, ad network, and the estimated revenue of an impression
• Approximate location: Country or region based on IP address (not precise GPS)

How Firebase Data is Used

• Understand which features are most popular
• Investigate product issues reflected in app-usage and lifecycle events
• Improve app behavior and user experience
• Measure the effectiveness of app features
• Create usage reports and measure purchase, conversion and advertising events

Data Retention

Firebase Analytics retention is governed by our current Google service settings and Google's applicable retention controls. Retention periods may differ for event-level data, aggregated reports, advertising data, exported data and data processed by connected Google services. Contact us for information about the settings currently applied to data under our control.

Legal Basis (GDPR)

For EU/EEA users, consent obtained through Google User Messaging Platform applies to advertising storage, access and measurement where required. Firebase Analytics collection does not begin until that consent flow has completed and, where a consent form is required, until Google reports that requests may be made. Other technical processing is handled under the legal bases described in the "Legal Basis (GDPR)" section below, subject to applicable law. Where Profile → Ad Privacy Options is available in the App, you may use it to review or withdraw applicable advertising consent choices; withdrawing consent there also stops Firebase Analytics collection. You may additionally switch off Profile → Data Management → Usage Analytics at any time and in any region.

For more information

• Firebase Privacy Policy: firebase.google.com/support/privacy
• Google Privacy Policy: policies.google.com/privacy
• Google's Privacy & Terms: policies.google.com/technologies/partner-sites

Apple In-App Purchases

When you purchase reports through the App Store, Apple processes the payment and provides us with limited transaction information (transaction ID, product ID) necessary to verify your purchase.

SKAdNetwork

We participate in Apple's SKAdNetwork, a privacy-preserving ad attribution framework designed to provide advertisers with limited installation and conversion attribution while reducing access to directly identifying information. The current App does not integrate AdAttributionKit.

Required Disclosures

We may preserve or disclose information that is under our control if reasonably necessary to comply with a binding legal process or applicable legal obligation. Because the App does not operate an account system or our own database for your assessment inputs, we may not possess locally stored content on your device. Apple, Google, a sharing destination or another provider responds to requests concerning data it controls under its own procedures.

International Transfers

Data processed by Apple, Google and their service providers may be transferred to or processed in countries other than the country where you live. Those providers describe their locations, transfer mechanisms and safeguards in their applicable privacy documentation.

Your Privacy Rights

You have controls for specified locally stored app content and applicable advertising choices. Depending on your location, you may also have legal rights including:

Access & Control

• Access: View assessment, checklist, points and purchase-history content made available in the App's Profile and History sections
• Delete All Data: Remove the locally stored user profile, points history, assessment history, checklists, saved-report archives, the pending analytics-event queue and the on-device advertising-segment counters via Profile → Data Management → Delete All Data
• Saved reports: Delete individual saved-report archives from the applicable History screen, or remove all of them at once with Delete All Data
• Object to analytics: Switch off Profile → Data Management → Usage Analytics to stop Firebase Analytics collection on your device
• Requests: Contact us to ask about access, deletion or other rights that may apply to data under our control
• Correct: Change editable settings, reminder choices, region and checklist content directly in the App. Generated assessments and saved-report names or notes do not have a general edit control; where an individual delete control is available, you may delete the item and create a replacement, or use the applicable broader deletion control described above

The in-app Delete All Data control covers the categories listed above. It does not delete local purchase and report-entitlement records that still represent unused report credits, the advertising-frequency counters used to limit how often full-screen advertisements appear, app preferences such as appearance, region, currency and reminder settings, advertising consent records held by Google's consent framework, temporary files that may still be managed by iOS, data already processed by Apple or Google, or transaction records retained by those providers. Entitlement records and frequency counters are kept deliberately, so that deleting your data can neither remove content you have paid for nor reset the limits that protect you from excessive advertising. Deleting the App removes data in its local app container from the device through the normal iOS deletion process, but does not delete copies you previously shared, device backups, or provider-held records. You can change applicable advertising consent choices via Profile → Ad Privacy Options where that option is available.

California Residents (CCPA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we don't sell your data)
• Right to non-discrimination

European Users (GDPR)

• Right to access your personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

Opting Out of Analytics and Advertising

Advertising and analytics use different controls and should not be treated as a single opt-out:

• Where Google reports that privacy options are required, Profile → Ad Privacy Options is shown and can be used to review or change the advertising choices offered by Google. The entry may not appear in other regions or before Google has determined its status
• If you decline App Tracking Transparency, the App will not access the IDFA for tracking. You may still receive contextual, limited or other advertisements selected using information permitted by your consent choices, device settings, applicable law and Google's advertising policies
• Your personal financial data is never sent to Firebase or to any advertising partner
• Profile → Data Management → Usage Analytics switches Firebase Analytics collection on or off on your device. While it is off, the App sends no analytics events and stores none for later retry. Collection also stays off until the advertising consent flow has completed, and is stopped if you withdraw consent through Ad Privacy Options
• You may still contact us with questions, objections or requests regarding analytics processing; the available rights and controls depend on applicable law and provider capabilities

Children's Privacy

LoanPrep is intended for adults aged 18 or older and is not directed to children or minors. The App does not operate an account system and does not independently verify a user's age. The optional assessment age-range choices begin at 18 and are not used in the eligibility calculation.

Our Commitment

• We do not knowingly collect personal information from children
• We do not market to children
• The app is designed for adult users preparing for loans
• Our advertising and consent configuration is intended for a general audience. We do not intentionally enable child-directed ad treatment, because the App is not intended for or directed to children

Parental Notice

If you are a parent or guardian and believe a minor has used the App, remove applicable local content using the individual controls or Delete All Data control described in this Policy, delete the App if appropriate, and contact us at yumiao.dev@gmail.com regarding any information that may be under our control. Provider-held information is subject to the applicable provider's request procedures.

Advertising & Tracking

LoanPrep includes advertising features powered by Google AdMob.

Types of Advertisements

• Banner Ads: Displayed in designated areas of a screen. Some banners may first appear in an expanded (collapsible) form that you can collapse back to a standard banner.
• Native Ads: Advertisements styled to match the surrounding content. They are always labelled as advertising and are clearly distinguishable from our own content.
• Rewarded Video Ads: Entirely optional videos that you choose to watch in exchange for in-app points.
• Interstitial Ads: Full-screen advertisements shown only at natural break points — for example when you leave a checklist detail page, close a history panel, or exit a previously saved report. They are never shown while the App is starting up, while a purchase is in progress, while content is loading, or while your assessment report is being generated and first delivered to you.
• App Open Ads: May appear when the App is launched or when you return to it from the background. They are never shown on your first launch after installing the App.

Consent for Advertising (EU/EEA, UK, Switzerland and other applicable regions)

Where required by law, we use Google's User Messaging Platform (UMP) to determine whether a consent form must be presented and whether advertising may be requested. Advertising requests are not released unless UMP indicates that they may be made. UMP's permission to request ads does not by itself mean that you accepted all advertising purposes; it may also permit limited or non-personalized advertising or indicate that a consent form is not required. The advertising SDK may be initialized before an advertising request is made, but requests remain subject to UMP's current request status.

• When a form is presented, you may make the choices it offers; declining optional advertising purposes does not prevent you from using the App
• Profile → Ad Privacy Options appears when Google reports that a privacy-options entry is required. When shown, you can use it to review or change the choices Google makes available
• This consent is separate from, and in addition to, Apple's App Tracking Transparency prompt described below

How We Limit Advertising

To keep advertising from becoming intrusive, the App applies limits that are calculated entirely on your device:

• Daily and per-session limits on the number of full-screen advertisements
• A minimum interval between two full-screen advertisements, which widens the more advertisements you have already seen in a session
• No full-screen advertisement immediately after you tap the screen, to reduce accidental clicks
• No advertising during payment, during report generation, or on core report delivery screens

App Tracking Transparency (iOS 14+)

The App requests permission before accessing the IDFA or tracking your activity across apps and websites owned by other companies. Your choice affects whether the App may use the IDFA for tracking and personalized advertising.

• Allow Tracking: The IDFA may be used for tracking and personalized advertising, subject to your other consent choices and applicable law
• Ask App Not to Track: The App will not access the IDFA for tracking. You may still receive contextual, limited or other advertisements selected using information permitted by your consent choices, device settings, applicable law and Google's advertising policies

Change setting: iOS Settings → Privacy & Security → Tracking → LoanPrep

Rewarded Video Ads

• Entirely optional and user-initiated — they are never shown automatically
• You earn in-app points for each video you watch to completion
• The reward amount, the daily viewing limit and the cooldown between videos are shown in the App and may be adjusted from time to time
• Points have no cash value and cannot be exchanged for money

App Store Privacy Labels

The categories below are a conservative summary of data that may be transmitted off the device by Apple, Google or their advertising partners in connection with the App. Whether provider-processed data is classified as linked, not linked or used for tracking depends on Apple's definitions, provider practices, identifiers available in a particular context and our current App Store Connect and provider settings; source code alone cannot guarantee every classification. Information that remains only in the App's local storage is described separately in the "Information We Collect" and "Data Storage & Security" sections. Consult the current App Store listing for the official privacy label.

Data Used to Track You

The following data may be used to track you across apps and websites owned by other companies, but only if you allow tracking through Apple's App Tracking Transparency prompt and, where applicable, consent through the advertising consent form:

• Identifiers (Advertising ID)
• Usage Data (Advertising interaction data such as impressions and clicks)
• Product Interaction (Ad views and ad engagement)
• Coarse Location (Country/region level)

Data That May Be Linked to You

• Purchases (Product IDs, Transaction IDs, Purchase history)

Data Generally Processed Without Direct Contact Details

• Usage Data (feature usage, screens viewed and app interactions processed by Firebase Analytics or advertising providers)
• Identifiers (app-instance and other permitted identifiers processed by the applicable provider)
• Product Interaction (In-app purchase events, feature usage patterns)
• Coarse Location (Country/region level, derived from IP address)
• Technical and app-lifecycle information made available by Firebase Analytics. The current App does not integrate Firebase Crashlytics or Firebase Performance Monitoring

Third-Party Advertising

Google AdMob may collect device identifiers, approximate location, ad interaction data, and ad performance and revenue measurement data across the banner, native, rewarded video, interstitial and app open formats used in the App, as described in Google's privacy policy. AdMob may also work with other advertising networks through mediation; those networks are subject to Google's partner requirements.

Legal Basis (GDPR)

For users in the European Economic Area, United Kingdom and Switzerland, the applicable legal basis depends on the specific processing activity, the information involved and applicable law. More than one basis may apply to different activities:

Consent

• For storing or accessing information on your device for advertising and measurement purposes, including for non-personalized advertising (obtained through the Google User Messaging Platform consent form)
• For advertising tracking (via App Tracking Transparency)
• For analytics and advertising performance measurement where consent is required by applicable law
• For receiving notifications
• You may withdraw applicable advertising consent via Profile → Ad Privacy Options where available, switch off Profile → Data Management → Usage Analytics, change device permissions in iOS Settings, or delete locally stored app content using the App's data controls

Contract Performance

• To fulfill in-app purchases you make
• To provide assessment reports you paid for
• To provide core App functions you request where processing is objectively necessary to perform our agreement with you

Legitimate Interests

• Operating and improving the app
• Processing limited technical and pseudonymous analytics data to understand app usage and lifecycle trends, where consent is not required by applicable law and where you have not switched Usage Analytics off
• Limiting how often advertisements are shown, using counters and an activity tier that are calculated and stored on your device only and are not used to select or target advertising
• Providing customer support

Legal Obligations

• To comply with applicable legal obligations or binding legal process concerning information under our control

Where processing relies on legitimate interests, you may have the right to object. Consent can be withdrawn only for processing based on consent, and withdrawal does not affect processing already carried out lawfully. A request may be subject to identity verification, legal exceptions, provider capabilities and the scope of information actually under our control.

Regional Privacy Notices

Depending on your location, additional privacy rights and protections may apply:

For California Residents (CCPA/CPRA)

In addition to the rights described above, California residents have:

• The right to know what personal information is collected, used, shared, or sold
• The right to request disclosure of the categories and specific pieces of personal information collected
• The right to request deletion of personal information
• The right to opt-out of the sale or sharing of personal information
• The right to non-discrimination for exercising privacy rights
• We do not sell personal information for monetary consideration. Google advertising services may process or make available advertising data in ways that can constitute "sharing" or targeted advertising under some privacy laws; applicable choices are provided through consent tools, device settings or by contacting us

To exercise these rights, use the in-app Delete All Data feature or contact us at yumiao.dev@gmail.com.

For European Users (GDPR)

Depending on the processing activity, we may rely on consent, contract performance, legitimate interests or legal obligations as described in the "Legal Basis (GDPR)" section. Subject to applicable conditions and exceptions, you may have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate personal data
• Erase your personal data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

For UK Users (UK GDPR)

You have the same rights as European users under UK GDPR. You may lodge complaints with the Information Commissioner's Office (ICO) at ico.org.uk.

For Brazilian Users (LGPD)

Under the Lei Geral de Proteção de Dados, you have rights similar to GDPR including access, correction, deletion, and data portability.

For Chilean Users (Ley 19.628)

Under Chile's Law on Protection of Private Life (Ley 19.628), you have the right to:

• Access: Request information about your personal data we hold
• Rectification: Correct inaccurate or incomplete data
• Cancellation: Request deletion of your personal data
• Opposition: Object to the processing of your data

To exercise these rights, use the in-app Delete All Data feature or contact us at yumiao.dev@gmail.com.

For Mexican Users (LFPDPPP)

Under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), you have ARCO rights:

• Acceso (Access): Know what personal data we hold about you
• Rectificación (Rectification): Correct inaccurate or incomplete data
• Cancelación (Cancellation): Request deletion of your personal data
• Oposición (Opposition): Object to the processing of your data

To exercise your ARCO rights, use the applicable in-app control or contact us at yumiao.dev@gmail.com. After verifying the request and determining its scope, we will respond within the timelines required by applicable Mexican law, including any legally permitted extension.

For Malaysian Users (PDPA)

Under Malaysia's Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010), you have the right to:

• Access: Request access to your personal data held by us
• Correction: Request correction of inaccurate, incomplete, misleading or out-of-date personal data
• Withdrawal: Withdraw consent for the processing of your personal data
• Limit Processing: Limit the processing of your personal data

To exercise your rights under PDPA, use the applicable in-app control or contact us at yumiao.dev@gmail.com. After verifying the request and determining its scope, we will respond within the timelines required by applicable Malaysian law, including any legally permitted extension.

For Korean Users (PIPA)

Under Korea's Personal Information Protection Act (개인정보보호법), you have the right to:

• Access: Request access to your personal data we hold
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data
• Suspension: Request suspension of processing of your personal data

To exercise these rights, use the in-app Delete All Data feature or contact us at yumiao.dev@gmail.com. You may also report personal information infringement to the Personal Information Protection Commission (www.pipc.go.kr) or KISA's Personal Information Infringement Report Center (privacy.go.kr / KISA 118).

For Japanese Users (APPI)

Under Japan's Act on the Protection of Personal Information (個人情報の保護に関する法律), you have the following rights as a data subject (本人):

• Disclosure (開示): Request disclosure of personal data we hold about you
• Correction (訂正・追加・削除): Request correction, addition, or deletion of inaccurate personal data
• Cease Use / Erasure (利用停止・消去): Request that we cease using or erase your personal data
• Cease Third-Party Provision (第三者提供の停止): Request that we stop providing your data to third parties
• Notification of Purpose (利用目的の通知): Request notification of the purposes for which your data is being used
• Withdrawal of Consent (同意の撤回): Withdraw your consent at any time
• Information about Cross-Border Transfers (越境移転に関する情報提供): Request information about transfers of your data outside Japan

To exercise these rights, use the in-app Delete All Data feature or contact us at yumiao.dev@gmail.com. We will respond promptly in accordance with APPI requirements.

For complaints regarding personal data protection in Japan, you may contact:

• Personal Information Protection Commission (個人情報保護委員会, PPC): www.ppc.go.jp
• PPC Complaint Hotline: +81-3-6457-9849 (weekdays 9:30–17:30 JST)
• National Consumer Affairs Center of Japan (国民生活センター): www.kokusen.go.jp / Consumer Hotline 188

For Users in Other Jurisdictions

Your local privacy laws may grant you additional rights. We are committed to complying with applicable data protection laws in your jurisdiction. Contact us if you have questions about your specific rights.

Third-Party Links

LoanPrep opens destinations outside the App only in the following situations:

• Legal documents: the Privacy Policy link in Profile opens this page in your browser. The Terms of Service are displayed inside the App and do not open a browser
• iOS Settings: when you choose to review notification or tracking permissions, the App opens the relevant iOS Settings screen
• Advertising: tapping an advertisement may open the advertiser's website, the App Store, or another destination chosen by the advertiser. The App does not control which destination an advertisement opens
• Sharing: when you export an assessment report, the destination you pick in the iOS share sheet is opened or receives the file at your direction

The App does not contain a directory of lenders, financial institutions or third-party educational websites, and we do not place promotional links to loan providers inside our own content.

Changes to This Policy

We may update this Privacy Policy periodically to reflect:

• Changes in app features
• Legal or regulatory requirements
• Best practices in privacy protection

How We Notify You

• We will update the effective date displayed on this page
• Where appropriate, material changes may also be communicated through the App or its App Store listing
• Where applicable law requires consent for a new processing purpose, we will request it separately

Your Options

If you disagree with changes, you may stop using the app and delete your data.