This policy explains what DebtStak.ai (“we”,”us”) collects when you use the service, where it goes, and the choices you have. DebtStak is a Canadian commercial real estate deal-screening assistant. If anything here is inconsistent with your deal, the CANADIAN DATA RESIDENCE commitment below controls.
northamerica-northeast1); CIM OCR runs on Google Document AI in a Canadian region; your uploaded PDFs, extracted text, and account data sit in Google Cloud SQL and Google Cloud Storage in Toronto (northamerica-northeast2). The only data that leaves Canada is the OCR of public market reports (used to build our knowledge base, never your deals) and the public names of parties named in a deal (sent only to a live web search during sponsor diligence — never the deal document itself).
memory.md): the lending box you build during onboarding — lender type, asset class, geography, deal parameters (LTV/DSCR/loan size), risk appetite, reference deals. This personalizes every answer.We use Google Cloud services, all in Canadian regions, to host and process your data:
| Provider | Purpose | Region | Sees lender/deal data? |
|---|---|---|---|
| Google Cloud Run | Hosts the application | Toronto | Yes (in-memory) |
| Google Cloud SQL (Postgres + pgvector) | Stores accounts, profiles, deals, chunks, screens | Toronto | Yes (at rest) |
| Google Cloud Storage | Stores the uploaded CIM PDFs | Toronto | Yes (at rest) |
| Google Vertex AI (Gemini 2.5 Pro/Flash) | Reasoning — extraction, screen, chat, audit/referee | Montréal | Yes (in transit, processed, not stored by the provider) |
Google Vertex AI (gemini-embedding-001) | Vectorizes chunks and queries | Montréal | Yes (text in transit) |
| Google Document AI (Form Parser) | Converts your CIM PDF to markdown | Canada | Yes (the PDF, in transit) |
| Google Search (grounded) | Live sponsor adverse-media check | Canada | No — only the public entity name; never the CIM |
| Mistral OCR (🇺🇸 US) | OCR of public market reports only | US | No — public reports only, never lender data |
We do not allow our providers to train on your data. The Google Vertex AI and Document AI terms we operate under do not use customer content to train their models. Mistral is used only for public corpus reports.
We keep your data for as long as your account exists. Deleting a deal removes its PDF, extracted content, chunks, and screens. Deleting your account removes everything associated with you. Email hello@debtstak.ai to request deletion at any time.
You can ask to see, correct, export, or delete the data we hold about you by emailing hello@debtstak.ai from your registered address. We'll respond within a reasonable window (typically a few business days).
We don't use tracking cookies. The app stores your login token in your browser's localStorage so you stay signed in. No third-party analytics or advertising trackers are loaded.
If we materially change this policy we'll update the effective date above and notify active users in-app or by email.