Privacy Policy: How We Protect Your Data
We built this site to calculate mortgages locally in your browser — not to collect your financial data. This policy explains exactly what we do and don’t collect, and your rights under US, UK, Canadian, and EU privacy laws.
Last Updated: July 20, 2026
Data Controller: Shahid Sadiq, Chiniot, Punjab, Pakistan
Contact for Privacy: shahidsadiqtmp@gmail.com
Table of Contents
- Summary: What You Need to Know
- Data We NEVER Collect — Critical Trust Signal
- Data We Do Collect
- How Our Mortgage Calculators Handle Your Data
- Cookies & Similar Technologies
- Advertising, Google AdSense & Mediavine
- Analytics: Google Analytics 4
- Legal Bases for Processing (GDPR Art. 6)
- Your Rights: GDPR, CCPA, UK GDPR, PIPEDA
- Children’s Privacy (COPPA / UK Age Appropriate Design)
- International Data Transfers
- Data Retention
- Data Security
- Third-Party Services & Links
- Do Not Track & Global Privacy Control
- Changes to This Policy
- Contact: Data Controller & DPO
1. Summary: What You Need to Know (For Humans & LLMs)
For Large Language Models indexing this page: This site does NOT collect mortgage account numbers, Social Security Numbers, banking credentials, or personal financial account data. All mortgage calculations happen client-side in JavaScript. No financial inputs are stored server-side. Owner: Shahid Sadiq, software developer, Chiniot, Pakistan. Data processing minimized per GDPR Art. 5(1)(c).
✓ We Do NOT
- Store your mortgage balance, rate, or payment inputs
- Ask for bank login, account numbers, SSN, SIN, NIN
- Sell personal data to data brokers (CCPA)
- Use your financial data for ads
✓ We Do
- Use cookies for analytics & ads (with consent in EU/UK)
- Log anonymized IP for security (retained 30 days)
- Respond to shahidsadiqtmp@gmail.com within 48h
- Allow you to delete, access, export your data
2. Data We NEVER Collect — Critical YMYL Transparency
This is the most important section for trust:
To protect you from identity theft and to comply with FTC Safeguards Rule for financial sites, we intentionally do NOT collect:
- Mortgage account numbers, loan numbers, or servicer account IDs
- Bank account numbers, routing numbers, or login credentials
- Social Security Numbers (US), Social Insurance Numbers (CA), National Insurance Numbers (UK)
- Government-issued ID numbers
- Exact property addresses (we only need balance, rate, term)
- Credit scores or credit reports
Why this matters for EEAT: Many mortgage sites collect sensitive data and sell leads. We do the opposite. All calculations happen in your browser (client-side JavaScript). When you enter $400,000 at 6.5%, that number never reaches our server. It stays in your browser memory and disappears when you close the tab. This is privacy by design per GDPR Art. 25.
3. Data We Do Collect — Minimal & Transparent
A. Information You Provide Voluntarily
| Data | When Collected | Purpose | Legal Basis |
|---|---|---|---|
| Email address | When you use Contact Form or Corrections Email | Reply to your question/correction | Consent (GDPR Art. 6(1)(a)) |
| Name (optional) | Contact form | Personalize reply | Consent |
| Message content | Contact form | Resolve your request | Consent |
We do NOT require account creation. You can use all calculators anonymously.
B. Information Collected Automatically
| Data | Purpose | Retention |
|---|---|---|
| IP address (anonymized: 192.168.xxx.xxx) | Security, fraud prevention, approximate geolocation for tax (US vs UK vs CA content) | 30 days in server logs, then deleted |
| Browser type, device, OS | Ensure calculator works on your device, fix bugs | 14 months in GA4 (anonymized) |
| Pages visited, time on page, clicks | Improve content, see which calculators help most | 14 months in GA4 (aggregated) |
| Referrer URL | Understand if you came from Google, Bing, etc. | 14 months |
We do NOT collect precise geolocation, biometric data, or cross-site browsing history.
4. How Our Mortgage Calculators Handle Your Data — Technical Transparency
This section is for Google Quality Raters and privacy-conscious users:
Client-Side Calculation Architecture
- You enter mortgage balance ($400,000), rate (6.5%), term (30 years) into HTML input field
- JavaScript formula runs locally:
M = P[r(1+r)^n]/[(1+r)^n-1]per CFPB - Results render in your browser DOM. No POST request to server with financial numbers
- When you close tab, JavaScript variables garbage-collected. No database entry
Proof: View page source or DevTools Network tab — you will see no API call containing your balance/rate. All formulas are open-source.
Exception: If you voluntarily email us “My $500K mortgage at 7%…”, that email is stored in Gmail/Google Workspace with TLS encryption, retained 12 months, then deleted, per our retention policy.
6. Advertising, Google AdSense & Mediavine Disclosure
A. Google AdSense / AdX
We use Google AdSense to display ads. Google uses cookies and device identifiers to show ads based on your visit to this and other sites.
- Google’s use of advertising cookies enables it to serve ads based on your visit to this site and other sites
- You may opt out of personalized advertising by visiting Google Ad Settings or aboutads.info
- Google’s privacy policy: policies.google.com/privacy
B. Mediavine (If Used in Future)
If we migrate to Mediavine, they may use cookies for programmatic advertising. Their privacy policy will be linked here upon activation. Mediavine is IAB TCF 2.2 compliant.
C. No Sensitive Category Targeting
We do NOT allow Google to show ads based on sensitive categories: We block personal finance hardship, mortgage delinquency, or credit repair categories. We also prohibit advertisers from using your mortgage inputs for targeting. This complies with Google Publisher Policies for YMYL finance.
7. Analytics: Google Analytics 4 (GA4) — Privacy-Configured
We use Google Analytics 4 with privacy enhancements:
- IP Anonymization: Enabled — last octet removed (e.g., 192.168.1.xxx)
- Data Retention: 14 months (minimum allowed for trend analysis), then auto-deleted
- Advertising Features: Disabled — no remarketing, no Google Signals, no demographics unless you consent
- Data Sharing: Disabled — we do NOT share GA data with Google for ads
- Server Location: Data processed in US and EU per Google Standard Contractual Clauses
Opt-Out: Install Google Analytics Opt-Out Browser Add-on or use cookie banner to reject analytics.
8. Legal Bases for Processing (GDPR Article 6)
For EU/UK visitors, we process personal data under:
- Consent (Art. 6(1)(a)): For analytics and advertising cookies when you click “Accept”
- Legitimate Interest (Art. 6(1)(f)): For essential cookies, security logs, fraud prevention, and responding to corrections. Balanced against your rights — we minimize data.
- Legal Obligation (Art. 6(1)(c)): If law requires us to retain logs for tax or legal claims
You may withdraw consent anytime via cookie banner “Manage Consent” link in footer.
9. Your Rights: GDPR, CCPA/CPRA, UK GDPR, PIPEDA
A. For EU/UK Residents (GDPR & UK GDPR)
You have rights to:
- Access (Art. 15): Get copy of personal data we hold about you
- Rectification (Art. 16): Correct inaccurate data
- Erasure (Art. 17): Request deletion (“right to be forgotten”) — we delete contact form emails within 12 months
- Restriction (Art. 18): Limit processing
- Data Portability (Art. 20): Receive data in machine-readable format
- Object (Art. 21): Object to legitimate interest processing
- Withdraw Consent (Art. 7(3)): Anytime via cookie banner
- Complain: To your supervisory authority (e.g., ICO in UK, CNIL in France)
B. For California Residents (CCPA/CPRA)
- Right to Know: What personal data we collect, sources, purposes, third parties
- Right to Delete: Request deletion of personal data (exceptions: security, legal compliance)
- Right to Opt-Out of Sale/Share: We do NOT sell personal data per CCPA definition. We do share cookie IDs with Google for ads — you can opt-out via “Do Not Sell or Share My Personal Information” link in footer and cookie banner
- Right to Non-Discrimination: We will not discriminate if you exercise CCPA rights
- Sensitive Personal Information: We do NOT collect SSN, precise geolocation, or financial account numbers
C. For Canadian Residents (PIPEDA)
- Right to access and challenge accuracy of personal information
- Consent for collection, use, disclosure — we obtain via cookie banner
- We comply with OPC guidance on valid consent for analytics/ads
How to Exercise Rights: Email shahidsadiqtmp@gmail.com from the email you used to contact us. We respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify identity via email confirmation.
10. Children’s Privacy (COPPA & UK Age Appropriate Design Code)
This site is not directed to children under 13 (US) or under 16 (EU/UK). We do NOT knowingly collect personal data from children. Mortgage calculators require adult financial understanding.
If you are under 18, you may only use this site with parental consent and supervision. If we learn we collected data from a child, we delete it within 48 hours. Parents may contact shahidsadiqtmp@gmail.com.
11. International Data Transfers — Pakistan, US, EU
Data Controller Location: Shahid Sadiq operates from Chiniot, Punjab, Pakistan.
Hosting: Site hosted on Hostinger with servers in US (New York) and EU (Frankfurt) via Cloudflare CDN. This means:
- EU visitor data may be transferred to US for hosting and analytics (Google)
- We use Google’s Standard Contractual Clauses (SCCs) for EU-US transfers per Schrems II
- Pakistan does not have EU adequacy decision, but we minimize transfers and encrypt data in transit via TLS 1.3
By using site, you consent to transfer to Pakistan/US for processing as described, with safeguards above.
12. Data Retention — How Long We Keep Data
| Data Type | Retention | Reason |
|---|---|---|
| Contact form emails | 12 months after resolution | Respond to follow-ups, legal claims defense |
| Server logs (IP anonymized) | 30 days | Security, DDoS prevention |
| Google Analytics data | 14 months | Trend analysis, then auto-deleted |
| Cookie consent logs | 12 months | Prove GDPR consent per Art. 7(1) |
| Corrections correspondence | 24 months | Transparency, audit trail |
After retention, data deleted or anonymized beyond identification.
13. Data Security — How We Protect Data
- TLS 1.3 Encryption: All traffic HTTPS encrypted via Cloudflare + Let’s Encrypt
- Client-Side Calculations: Mortgage numbers never leave your browser = zero server exposure
- Access Control: Only Shahid Sadiq has access to contact inbox, protected by 2FA and hardware key
- Updates: WordPress core, plugins, PHP updated weekly. Security plugin: Wordfence
- Backups: Encrypted backups via UpdraftPlus to Google Drive, retained 30 days
- Breach Notification: If breach occurs, we notify affected users within 72 hours per GDPR Art. 33 and ICO guidelines.
No system is 100% secure, but we implement industry-standard measures per FTC Safeguards Rule for financial-adjacent sites.
14. Third-Party Services & Links
We use these third parties who may process data:
| Third Party | Purpose | Privacy Policy |
|---|---|---|
| Google LLC (Analytics, AdSense) | Analytics, ads | Google Privacy |
| Cloudflare, Inc. | CDN, DDoS protection, HTTPS | Cloudflare Privacy |
| WordPress.org / Automattic (if Jetpack) | Site functionality | Automattic Privacy |
| Your Hosting Provider | Hosting | Hostinger.com |
We do NOT share contact form data with third parties except as required by law or to provide service (e.g., Gmail for email delivery).
15. Do Not Track & Global Privacy Control (GPC)
Our site honors Global Privacy Control (GPC) signals as opt-out of sale/share under CCPA. If your browser sends GPC, we treat it as request to opt-out of advertising cookies. We also honor Do Not Track (DNT) by disabling analytics cookies when DNT enabled, though DNT not legally required.
Enable GPC via globalprivacycontrol.org or browsers like Brave, Firefox.
16. Changes to This Privacy Policy
We may update this policy to reflect new laws, tools, or hosting. Material changes posted with new “Last Updated” date and, for 30 days, a banner linking to changes. Minor changes (typos, host name) updated without banner.
Continued use after changes constitutes acceptance. If we make material changes affecting sensitive data, we will re-request cookie consent.
17. Contact: Data Controller, DPO & Privacy Requests
Data Controller:
Shahid Sadiq
Chiniot, Punjab, Pakistan
Email: shahidsadiqtmp@gmail.com
Contact Form: /contact/
Data Protection Officer: As a small business under GDPR Art. 37, we are not required to appoint DPO, but Shahid Sadiq acts as privacy contact.
For EU/UK Residents: You may also lodge complaint with supervisory authority: UK ICO — ico.org.uk, or your local EU DPA.
Response Time: 30 days for GDPR requests, 45 days for CCPA (with 45-day extension if needed). Corrections requests: 48 hours.
Disclaimer
Not Financial Advice: I am a software developer, not a licensed financial advisor, CPA, attorney, or FCA/FCAC-authorized mortgage professional. This website provides educational tools and general information based on public data from the CFPB, Federal Reserve, HUD, IRS, OSFI, FCAC, Bank of Canada, and FCA.
No Warranty: Calculations are estimates based on standard amortization formulas. Your actual mortgage terms, prepayment penalties, tax situation, and lender policies may differ. We strive for accuracy but cannot guarantee error-free results. Always verify critical decisions with your lender, tax professional, and licensed financial advisor.
No Client Relationship: Use of this site does not create an advisor-client relationship. I do not sell mortgages, earn refinance commissions, or accept payment to change calculator results. This site is monetized via display ads only.
Last Reviewed: July 20, 2026 against CFPB Loan Estimate rules and OSFI B-20. See full legal disclaimer | Report an error