Privacy Policy
Version 2026-10-04-draft · Effective October 4, 2026
This policy explains how TOP COLLECTION LLC, an Illinois limited liability company (operating the Loderan brand) ("we") collects and uses personal information when you use Loderan (the "Service"). We are the data controller for account data. The Service is currently offered in the United States; this policy includes information required by U.S. state privacy laws (including California). The rights described below are offered to every user. If we expand to other regions (for example the EU or the UK), we will update this policy first.
1. Information we collect
- Account: email address, optional display name, password (stored only as an Argon2id hash), optional two-factor authentication settings (encrypted).
- Age confirmation: that you are at least 18. We do not collect your date of birth.
- Content you enter: product names, costs, prices, fees and other calculation data.
- Security and usage data: a keyed hash of your IP address (we do not store the raw IP), browser/device string for active sessions, sign-in events, and limited product-usage events without IP addresses.
- Billing: when you subscribe, Stripe processes your payment details. We receive only identifiers, plan, status and invoice amounts — never your full card number or security code.
- Communications: messages you send to support.
We do not collect biometric identifiers or biometric information (as defined by the Illinois Biometric Information Privacy Act), precise location, government ID numbers or sensitive personal information.
2. How and why we use it (legal bases)
- Provide, maintain and secure the Service and your account — performance of a contract.
- Process subscriptions and payments — contract and legal obligation (tax and accounting).
- Prevent fraud, abuse and security incidents; keep audit logs — legitimate interests and legal obligation.
- Understand feature usage in aggregate to improve the product — legitimate interests (you can opt out in Settings).
- Send product updates — consent (off by default; withdraw anytime).
We do not use your data for automated decisions that produce legal or similarly significant effects on you.
3. Sharing
We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose it only to service providers that process it on our behalf under contract, when required by law, to protect rights and safety, or in a business transfer (with notice to you).
Current and planned service providers:
- Stripe, Inc. — Payment processing and billing (United States)
- Railway Corporation — Application hosting and managed PostgreSQL database (United States)
- Resend, Inc. — Transactional email (account verification and security notices) (United States)
4. International transfers
We are based in Illinois, United States, and your information may be processed in the United States and other countries. When we transfer personal data from the EU/EEA, UK or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
5. Retention
- Account data: while your account is active. Deleted accounts are erased after a 30-day grace period.
- Calculations: until you delete them or your account.
- Security logs: up to 12 months. Audit logs: up to 24 months (identifiers removed after account deletion).
- Usage analytics: up to about 13 months. Unverified accounts: removed after 30 days.
- Billing records: as long as required by tax and accounting laws.
6. Your rights
Depending on where you live, you may have the right to:
- access and receive a copy of your data (portability);
- correct inaccurate data;
- delete your data;
- object to or restrict certain processing, and withdraw consent at any time;
- opt out of the sale or sharing of personal information (we do neither);
- not be discriminated against for exercising your rights;
- appeal a decision we make about your request (U.S. state laws);
- lodge a complaint with your data protection authority.
You can export your data and delete your account directly in Settings. For other requests email privacy@loderan.com. We will verify your identity (usually by confirming control of your account email) and respond within the time required by law (generally 30–45 days). Residents of Mexico may exercise ARCO rights and residents of Brazil LGPD rights through the same channel.
7. Children
The Service is not directed to children. You must be at least 18 to use it. If we learn that we collected data from a child, we will delete it. Contact privacy@loderan.com.
8. Security
We use measures such as encryption in transit (HTTPS), password hashing, encryption of sensitive secrets at rest, access controls, isolation of each workspace's data, rate limiting, audit logging and regular testing. No method is 100% secure. If a breach affects your personal information, we will notify you and authorities as required by applicable law, including the Illinois Personal Information Protection Act.
9. Cookies
We use only strictly necessary cookies to keep you signed in. See the Cookie Policy.
10. Changes
We will post updates here and notify you of material changes by email or in the app before they take effect.
11. Contact
TOP COLLECTION LLC, an Illinois limited liability company (operating the Loderan brand) · mailing address pending · Privacy: privacy@loderan.com · Security: security@loderan.com