LEAF

Privacy Policy

Last updated October 27, 2026

1. Who we are and who this policy covers

Local Enterprise Assistance Fund, Inc. (“LEAF”, “we”, “us”) is a nonprofit Community Development Financial Institution that provides financing to businesses. This policy explains what personal information we collect through our lending platform and its public pages, how we use and share it, and the choices you have.

It applies to the owners, officers, guarantors and employees of businesses that apply for or receive financing from LEAF. It also applies to users of the platform, buyers and other contacts named in the documents those businesses provide, and visitors to the platform’s public pages. Signed loan documents, and any privacy notice the law requires us to give you, may add to this policy.

2. Information we collect

Contact and account details
Examples: Name, title, email, phone, login details, two-step login settings
Where it comes from: You, or the business that invites you
Identity details
Examples: Home address, citizenship and age range. When we verify your identity: date of birth, Social Security number and government ID
Where it comes from: You, and our identity verification provider
Ownership and personal financial details
Examples: Ownership share, personal income, personal credit history, demographic details you choose to give
Where it comes from: You, credit bureaus
Business financial information
Examples: Financial statements, tax returns, invoices, purchase orders, contracts, remittances
Where it comes from: You, your accounting systems
Bank account information
Examples: Account and routing numbers, balances, transactions, account-holder name
Where it comes from: You, or your bank through Plaid
Verification results
Examples: Business registry records, past government-backed loans, sanctions screening
Where it comes from: Public and government sources, verification providers
Signatures and agreements
Examples: Signed forms and their signing records
Where it comes from: You, through our e-signature provider
Usage and device data
Examples: IP address, browser, pages visited, the actions you take on the platform
Where it comes from: Collected automatically

We collect demographic information (such as race, ethnicity or gender) only if you choose to give it. We use it to report on our community lending mission, never to make credit decisions.

3. How we use information

  • To evaluate applications, set up, fund, service and collect on financing
  • To verify identities and bank accounts, and to prevent fraud, money laundering and payments to the wrong account
  • To communicate with you about your application, your account and your facility
  • To meet our legal, regulatory, audit and funder reporting duties, including reporting on our community development impact in aggregate or de-identified form
  • To secure, operate and improve the platform

We do not use your information for advertising, and we do not sell it.

4. How we share information

We share personal information only as described below. We do not sell personal information.

Service providers (cloud hosting, database, document storage, email delivery, e-signature, identity and business verification)
Why: To run the platform for us, under contracts that limit their use of your information
Plaid Inc.
Why: To connect your bank account when you choose to link one (see below)
Capital providers and co-lenders that fund or participate in your facility
Why: To evaluate, fund and monitor that facility, under confidentiality terms
Our partner bank and payment processors
Why: To send and receive payments
Your business’s buyers or account debtors
Why: To confirm invoices and redirect payments, as your financing agreement allows
Regulators, auditors, funders (such as the CDFI Fund), and legal authorities
Why: When the law requires it, for audits and grant compliance, or to protect rights and prevent fraud. Reports to funders are aggregated or de-identified where possible
A successor organization
Why: If LEAF merges or transfers loans, subject to this policy

Plaid. When you link a bank account, Plaid Inc. collects information from your bank and shares it with LEAF. Plaid’s handling of that information is governed by the Plaid End User Privacy Policy.

5. How we protect information

We use administrative, technical and physical safeguards suited to the sensitivity of financial information. These include:

  • encryption of data in transit and at rest, with extra encryption for the most sensitive personal details;
  • two-step login for LEAF staff;
  • access limited by role, so each business sees only its own data;
  • logged access to bank and income details; and
  • security reviews of the vendors we use.

No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

6. How long we keep information

We keep loan application and servicing records for as long as the financing is active. After it ends, we keep them for 7 years, or longer if the law, a funder or a dispute requires it. For applications that are declined or withdrawn, we keep records for 25 months. When we no longer need information, we delete it or remove details that identify you.

7. Your choices and rights

  • See and correct: you can ask for a copy of the personal information we hold about you, or ask us to correct it.
  • Delete: you can ask us to delete your information. We will do so unless the law or an active financing agreement requires us to keep it.
  • Bank connections: you can disconnect a linked bank account at any time by contacting us at mpires@leaffund.org.
  • Optional information: you can decline to give demographic information. Doing so has no effect on your application.
  • Email: you can opt out of non-essential messages. Service and legal notices about your account will still be sent.

To make a request, contact mpires@leaffund.org. We will verify your identity before acting, and we will respond within 30 days. Residents of some states may have additional rights under their state’s law.

8. Cookies, children, changes and contact

  • Cookies: the platform uses only essential cookies, to keep you signed in and secure. It does not use advertising, analytics or cross-site tracking cookies.
  • Children: our services are for businesses. We do not knowingly collect information from anyone under 18.
  • Changes: we will post updates here with a new date. Material changes will be announced through the platform or by email.
  • Contact: Local Enterprise Assistance Fund, Inc., 386 Western Avenue, Boston, MA 02135, mpires@leaffund.org, 617-232-1551.