Last updated 4 November 2026
Privacy Policy
FolioPact is a Cyclotron Technologies Pvt Ltd product for private-lending record-keeping. Cyclotron Technologies operates FolioPact and is the data fiduciary for personal data processed through the service. This policy explains what information the service processes, why, and the choices you have. It is written for people who create an account, and for the borrowers and other people whose details an account holder chooses to store.
What FolioPact does
FolioPact helps a lender, family office or adviser keep a dated record of agreements, advances, receipts and balances. It is a workspace for those records. It does not lend money, and it is not a bank or a non-banking financial company.
Information we process
What is stored depends on whether you are using the public demo or an account.
Account and sign-in
Accounts use Supabase Auth. When you create an account we process your email address and password. The password is handled by the authentication service; FolioPact does not copy it into the loan ledger. We also process email confirmation and password-recovery links, and the authenticator (TOTP) factor you enrol. During setup the app shows you a QR code and a manual key so you can add FolioPact to your authenticator app. Those secrets are part of sign-in, not part of a borrower record.
Your session is kept in this browser’s local storage so you can stay signed in. Inside the FolioPact editor preview, the session may instead be held by the preview. While you follow a password-recovery link, the browser stores a short marker that a recovery is in progress. That marker is removed after the password is updated.
Creating an account also creates a profile for display preferences: an optional display name, a locale (the default is en-IN), a time zone (the default is Asia/Kolkata) and a date format. Preferences are readable and editable by that account after sign-in. They are not a role or a permission.
Workspace and ledger records
A private workspace can store the organisation name, membership (who belongs, and whether they are an owner, operator, viewer or adviser), and lender-entity names. After sign-in, an owner can save bank or cash account labels: a nickname, the bank name, a currency, whether the account is active, and a masked identifier only. The product rejects a full account number in that field. It accepts a mask of four asterisks plus at most four final characters, or a blank mask. Changes to those labels are written to an audit history with the actor and the before-and-after values.
The ledger is designed to hold, once live posting is available, borrower details (name, and where you enter them, email, phone and notes), loan terms (reference, currency, rates, dates, repayment structure and any clause reference you record), cash movements (advances, receipts, refunds, charges, waivers, rate changes and dated corrections), allocation of a receipt across principal, interest, capitalised interest and charges, and an append-only audit of who did what. Payment details the product understands include the method (such as bank transfer, UPI, cheque or cash), references and value dates. Collateral notes in the demo can include a description, an owner, an identifier, a valuation and a document reference.
Live financial posting is limited to explicitly enabled pilot workspaces. Features described as unavailable remain unavailable unless access has been enabled for your workspace. Workspace reads are limited to the signed-in member’s organisation, and private reads require a validated session, with an authenticator check for accounts that have enrolled a factor.
Imports, exports and documents
Spreadsheet and CSV import, including Tally-style cash layouts and opening balances, is read in your browser so you can preview the rows. In the demo, nothing from that file is uploaded, and the rows stay in memory until you refresh the page. Exports you download (CSV, Excel or a JSON backup) stay on your device.
The demo file picker keeps a document’s name, type and size in memory. It does not keep the file itself. The private document store is designed for a filename, type, size and a private storage path, with upload restricted until that store is opened. Do not rely on FolioPact today as a place to store scans of identity documents.
The public demo
The demo is a fictional portfolio held in your browser. It is separate from accounts. Refreshing the page clears it. Please do not type real people’s details into the demo.
Why we use this information
- To create and protect your account, including email confirmation and an authenticator.
- To show the workspace, preferences and masked account labels you save.
- To calculate and display ledgers, schedules and exports from the records you enter.
- To keep an audit trail of account-label changes and, when posting is enabled, of ledger activity.
- To operate, secure and fix the service.
Where you store a borrower’s or another person’s details, you are responsible for having a lawful basis to do so, including any consent or notice the law requires, and for the accuracy of what you enter. We process those details so we can provide the record-keeping service you ask for.
Cookies, local storage and scripts
FolioPact does not set an advertising cookie from the application. Sign-in uses local storage, as described above, and password recovery uses a short-lived session-storage marker. Optional Google Analytics runs only on public pages after your consent, in an isolated frame. Calculator inputs, private routes and borrower records are not sent to analytics. You can decline or withdraw consent with Cookie preferences.
The published site is served through Cloudflare. The publishing platform adds scripts at /__l5e/events.js and /~flock.js. Those scripts can send technical and usage events, such as the page you open and error diagnostics, to the platform that publishes FolioPact. If a page fails in the browser, the application may forward a short error description and the page path to that platform when the script is present. Those reports are not designed to include borrower names, amounts or document contents. The host may also use cookies or similar storage that are needed to deliver and protect the site.
Who we share information with
We do not sell personal data. We use these providers to run FolioPact:
- Supabase, for authentication and for the database that stores accounts, preferences, workspace rows and audit history.
- Cloudflare, to serve the website.
- The publishing platform that injects the scripts named above, for hosting the published site and for the technical events those scripts collect.
These providers may process data on servers outside India. People you invite into a workspace, when that feature is available, see only the access you give them. A download or an export leaves our systems and is then your copy. We may also disclose information if the law requires it.
How long we keep it
We have not set a single fixed retention period. Account, preference, workspace and audit records are kept while the account is open and for as long as needed to provide the service, preserve an accurate history, and meet a legal obligation. Ledger entries are designed to be corrected by adding a dated entry, rather than by silent edits. Demo data in the browser is discarded when you refresh or close the page, unless you have downloaded a copy. Backups, where they exist, can persist for a further limited time before they expire. You can ask us to close an account using the contact details below. There is no self-serve delete control in the product today. Signing out ends the session in that browser; it does not delete the account.
Your rights
The Digital Personal Data Protection Act, 2023 may apply to digital personal data processed in connection with FolioPact. In general terms, that Act gives a person the right to obtain a summary of the personal data being processed, to ask for correction or erasure, to withdraw consent where processing is based on consent, to nominate someone to exercise rights if they die or become unable to do so, and to raise a grievance. Some of those rights depend on the facts, and some records may be kept where the law requires it or where erasure would make the remaining history inaccurate.
To ask for access, correction, erasure or closure, or to raise a grievance, email support@foliopact.com and include enough detail for us to find the account. For a grievance, put “Grievance” in the subject. We may need to confirm that you are the account holder before we act. If you entered someone else’s details, ask them to contact us through you, or include what we need to identify the record without collecting more data than necessary.
Security
Accounts require email confirmation. Two-factor authentication is optional; once enabled, an authenticator check is required for private access. Database access for workspace records is restricted by organisation membership. You are responsible for keeping your password and authenticator secret. No online service can promise perfect security.
Children
FolioPact is not directed at children. Do not create an account if you are under 18, and do not store a child’s personal data in a workspace.
Changes
If this policy changes, we will post the new version on this page and change the “Last updated” date. Continued use of FolioPact after that date means you have had a chance to read the update.
Contact
- Operator and data fiduciary
- Cyclotron Technologies Pvt Ltd
- Service
- FolioPact
- Website
- foliopact.com
- support@foliopact.com