Legal
Privacy policy
· Applies to loamnotes.com and every page on it
The short version: the loan calculator processes everything on your own device and sends none of it anywhere. The parts of this site that do involve your data are the contact form, ordinary server logs, and advertising, and all three are described below in full.
1. Who is responsible for your data
Rate Shock operates Rate Shock at loamnotes.com and is the controller of the personal data described in this policy. We are based in Ho Chi Minh City, Vietnam.
| All enquiries, including data access and deletion | support@regulad.com |
|---|
Advertising on this site is delivered by Google and its advertising partners. For the data they process to select and measure advertising, those companies act as independent controllers or as joint controllers with us, depending on the jurisdiction. Their own policies are linked in section 5.
2. What the loan inspector does with your figures
Nothing leaves your device. The property price, the amount borrowed, your income, your living costs and every other field are held in the memory of your browser tab, computed there, and discarded when you close the tab. They are not transmitted to us, not written to any database, not logged, and not used for advertising. We never see them, which means we cannot disclose them, lose them or be compelled to hand them over.
The one exception is entirely under your control. When you press the button to copy a share link, your inputs are encoded into the link itself so that whoever opens it sees the same scenario. That link is placed on your clipboard and goes nowhere until you send it. Because it contains the income you entered, treat it as you would any other private document.
If you export the repayment schedule to CSV, the file is generated in your browser and saved directly to your device.
3. What we do collect
3.1 The contact form
When you write to us we receive whatever you put in the message, along with the name and email address you supply. We use it to reply to you, to reproduce and fix calculation bugs, and to decide what to write about next. We do not use it for marketing, we do not add you to any list, and we do not share it with third parties other than the email provider that delivers the message to us.
- Legal basis, GDPR: Article 6(1)(b) and 6(1)(f), our legitimate interest in answering people who write to us.
- Legal basis, Vietnam PDPL: your consent, given by sending the message, together with the necessity of processing to respond to your request.
- Retention: twenty-four months from the last message in the thread, then deleted. Messages that led to a change in the calculator are kept in anonymised form as part of the change record.
The form applies a rate limit per IP address to block automated submissions. The addresses used for that are held in memory only and are not written to disk.
3.2 Server logs
Our hosting provider records the ordinary technical information that every web server records: the IP address making the request, the time, the page requested, the referring page, and the user agent string. It is used to keep the site available, investigate faults and detect abuse.
- Legal basis, GDPR: Article 6(1)(f), our legitimate interest in operating a secure and functioning service.
- Retention: no more than thirty days, then deleted by the provider.
3.3 Your privacy choices
The decision you make in the consent banner is stored in your browser’s local storage under the key rs.consent.v1. It records which categories you allowed and when. It stays on your device, is never transmitted to us, and exists only so we do not have to ask you again on every page. Clearing your browser storage removes it and the banner returns.
4. What we do not do
- We do not sell personal data, and we never have.
- We do not operate a newsletter, a mailing list or any marketing automation.
- We do not run affiliate links, referral tracking or lead generation for banks or brokers. Nothing you do on this site is passed to a lender.
- We do not build profiles of visitors ourselves.
- We do not require an account, and there is nothing to sign up for.
5. Advertising, and the data involved
This site is funded by advertising served through Google Ad Manager. How the money works and what we will not let advertisers do is set out separately in the advertising disclosure. This section covers the data.
Google and its advertising partners use cookies, device identifiers and similar technologies to serve ads, to limit how often you see the same advertisement, to detect invalid traffic and fraud, and to measure whether an advertisement worked. Depending on your consent choice, that processing may also be used to select advertising based on your interests and on your activity across other sites and apps.
The data these companies may process includes your IP address, approximate location derived from it, browser and device characteristics, the pages you view on this site, and identifiers stored on your device. We do not receive any of it in identifiable form; we see aggregate reporting only.
5.1 Your choice controls this
Advertising cookies and identifiers are denied by default on every visit until you decide otherwise. We signal your decision to Google using Google Consent Mode, and we also set Google’s own non-personalised and restricted data processing flags, so a refusal is transmitted twice by two independent mechanisms.
- If you allow advertising: personalised ads may be served and identifiers may be stored on your device.
- If you refuse: advertising still appears, but it is selected from the content of the page rather than from anything about you, and no advertising identifier is written.
You can change your decision whenever you like: .
5.2 Visitors in the EEA, the UK and Switzerland
For visitors in those territories, consent is collected through a consent management platform certified by Google and integrated with the IAB Transparency and Consent Framework, as Google requires for personalised advertising. It presents the full list of advertising vendors and the purposes each one relies on, and lets you accept or refuse them individually.
5.3 The relevant policies and controls
- How Google uses information from sites that use its services
- Google privacy policy
- My Ad Center: turn off ad personalisation across Google
- Digital Advertising Alliance opt-out (US), Your Online Choices (EU), Network Advertising Initiative
A full inventory of the cookies involved is in the cookie policy.
6. Processors we rely on
| Who | What for | What they receive |
|---|---|---|
| Our hosting provider | Serving the site | IP address, request metadata, user agent |
| Google Ireland Ltd / Google LLC | Advertising through Google Ad Manager | IP address, device and browser data, pages viewed, advertising identifiers where you have consented |
| Resend | Delivering contact form messages to our inbox | The name, email address and message you submit |
| Google Fonts | Serving the two typefaces the site uses | IP address, as part of the font request |
7. International transfers
The providers above operate globally and your data may be processed outside Vietnam and outside the EEA, including in the United States. Where the GDPR applies, those transfers rely on the European Commission’s standard contractual clauses or, for transfers to the United States, on the EU-US Data Privacy Framework where the recipient is certified. Where Vietnam’s Personal Data Protection Law applies, we maintain the transfer impact records that law requires.
8. Your rights
The rights below apply whoever you are. We do not distinguish between visitors by territory, because operating two standards would mean tracking which one applies to you, which is itself a form of profiling we would rather not do.
- Know and access. Ask what we hold about you and receive a copy.
- Rectify. Have inaccurate data corrected.
- Delete. Have your data erased, subject to any legal obligation to keep it.
- Restrict and object. Object to processing based on legitimate interests, and to any processing for direct marketing, which we do not do in any case.
- Withdraw consent. At any time, without affecting what was lawful before you withdrew it. For advertising, use .
- Portability. Receive your data in a structured, machine-readable format.
- Not be subject to automated decision-making. We make no automated decisions about you with legal or similarly significant effects.
- Opt out of sale or sharing. For residents of California and other US states with equivalent laws: we do not sell personal information. If you refuse advertising cookies in the banner, we also instruct Google to apply restricted data processing, which is the mechanism those laws use to limit the sharing of personal information for cross-context behavioural advertising.
- Complain. To your data protection authority. In Vietnam that is the Ministry of Public Security’s Department of Cybersecurity and High-Tech Crime Prevention; in the EEA and UK, your national supervisory authority.
Write to support@regulad.com. We answer within thirty days. We may ask you for enough information to locate your records, and nothing more; for most visitors, the only thing we hold is a contact form message, and we will simply need the address you sent it from.
9. Children
This site is written for adults considering a mortgage and is not directed at children. We do not knowingly collect personal data from anyone under sixteen, and the site is not treated as child-directed content for advertising purposes. If you believe a child has sent us personal data, write to support@regulad.com and we will delete it.
10. Security
The site is served over HTTPS only, with HSTS. It sets a content security policy that allowlists the handful of origins permitted to load scripts, along with nosniff, frame-options, referrer-policy and permissions-policy headers, and it carries no third-party script other than the advertising tag and the font stylesheet. The strongest measure here, though, is architectural rather than technical: the sensitive data on this site, your income and your loan, is never collected in the first place.
11. Changes
When this policy changes materially we will update the date at the top, and if the change affects how your data is used for advertising we will ask for your consent again rather than assuming the old answer still stands. This policy was last revised on 18 September 2026.
12. Contact
Rate Shock, Ho Chi Minh City, Vietnam. Everything, privacy requests included, goes to support@regulad.com or through the contact page.