Privacy Policy

This policy applies to visitors, clients, and prospects using our online and offline services, including brokers and lenders participating in our pilot program.

Identity and Contact: name, business email, phone number, and residential or business address;

Professional Information: brokerage name, licence number, and province of registration;

Borrower Data (processed on your behalf): when you submit mortgage files through the platform, MortgageFlow processes borrower documents and data including income, financial documents, and supporting records solely as a processor on behalf of your brokerage. You remain responsible for obtaining the borrower's consent before submitting files;

Technical Data: IP address, browsing data, and cookies;

Sensitive Data: may be processed only with explicit consent when necessary.

We use your information to:

Provide and operate the MortgageFlow platform, including document classification, completeness checks, and underwriting assistance (execution of a contract);

Communicate with you about platform updates, onboarding, and support (legitimate interest / consent);

Improve platform performance and develop new features (legitimate interest, where anonymized);

Comply with our legal and regulatory obligations under PIPEDA and Quebec's Law 25 (legal compliance).

When processing is based on your consent, you may withdraw it at any time by contacting the responsible party below. The withdrawal will not affect the lawfulness of processing based on consent performed before such withdrawal.

Your information may be shared with:

Financial institutions and lenders in the context of processing broker-submitted mortgage files;

Our service providers (hosting, form management, analytics tools), bound by contract and required to preserve confidentiality;

Regulatory or judicial authorities when required by law.

Borrower data is processed on behalf of your brokerage. You remain responsible for obtaining the borrower's consent before submitting files through the platform.

If international data transfers are performed, we will implement appropriate safeguards to ensure an adequate level of protection.

We use cookies and analytics tools to improve the user experience and measure the effectiveness of our site. You can manage your preferences through your browser settings or the cookie banner.

We retain your information only for as long as necessary for the purposes for which it was collected or as required by regulation. Data is encrypted in transit and at rest. Upon written request following the conclusion of a pilot or service period, borrower data will be deleted or returned in accordance with our contractual obligations.

We apply reasonable technical and organizational measures to protect your information against unauthorized access, disclosure, alteration or destruction. This includes encryption in transit and at rest, access controls, and regular security assessments.

In accordance with PIPEDA and Quebec's Law 25, you have the right to:

Request access to your personal information;

Request correction of inaccurate or incomplete information;

Request deletion, to the extent permitted by law;

Object to processing or request limitation of processing;

Request portability of your data where applicable.

To exercise your rights, please contact the responsible party below. We will respond within the deadlines set by regulation.

We do not use automated decisions producing significant legal effects without human intervention. If we use such processes in the future, we will inform you and, where applicable, request your consent.

Our services are not intended for minors; we do not knowingly collect personal information from children without the required parental consent.

In the event of a data breach likely to result in a risk of serious harm, we will inform the affected persons and the competent authorities in accordance with legal obligations under PIPEDA and Law 25.

We may update this policy; the "Last updated" date will be revised and changes will be published on our site.