TheBrokerMate Privacy Policy

1. Who we are and what this policy covers

TheBrokerMate (thebrokermate.com) is operated by MEERKATS DEV INC., Vancouver, British Columbia, Canada (“BrokerMate”, “we”, “us”). This policy explains how we collect, use, share and protect personal information about:

• Brokers: mortgage professionals and their staff who subscribe to BrokerMate (“customers”);
• Borrowers: people a broker invites to submit documents through BrokerMate;
• Visitors: people who visit thebrokermate.com.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, British Columbia’s and Alberta’s Personal Information Protection Act and Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25).

2. Our role

• For broker account, billing and website information, we decide how it is used and are responsible for it.
• For borrower information, the broker you are working with decides why it is collected and is responsible for it. We process it on the broker’s behalf and under their instructions, only to provide the BrokerMate service to them. If you are a borrower, your broker’s own privacy policy also applies to you.

3. Information we collect

Brokers: name, business email and phone, brokerage name, profile photo and branding, account and sign-in information, billing details (handled by our payment processor; we don’t store full card numbers), support messages, and credentials you give us to connect services such as Finmo.

Signing in with Google (brokers only): if you choose “Continue with Google”, Google tells us the email address on your Google account and confirms that it is verified. We use it only to find your BrokerMate account and sign you in. We don’t receive your Google password, contacts, files, calendar or any other Google information, and we don’t store anything from Google beyond a record that you signed in. We don’t sell this information, share it with anyone, or use it for advertising. BrokerMate’s use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements. Borrowers are never asked to sign in with Google.

Linking Google Drive (brokers only, optional): a broker can link their own Google Drive so that a copy of each client’s documents is also saved there. Google then lets BrokerMate create a folder in that Drive and add files to it. BrokerMate can see and change only the folder and files it created itself; it cannot see, read or change anything else in the broker’s Drive. We use this access only to save those copies and to check how much free space the Drive has. Google also tells us the email address of the Google account that was linked, which we show to the broker in their settings and use if we need to help them with a failed copy. We keep the permission (an access key from Google) encrypted, use it for nothing else, and delete it when the broker unlinks Drive. We don’t sell this information, share it with anyone, or use it for advertising, and the same Google API Services User Data Policy, including its Limited Use requirements, applies.

Borrowers: the information and documents you choose to submit to your broker through BrokerMate. This includes your name, email and (if you give it) phone number, what the mortgage is for, your income sources, any notes you add, and your documents. Depending on what your broker asks for, documents can include identity documents, employment and income documents (such as pay stubs, T4s, notices of assessment and employment letters), bank and account statements, property documents, and details about your debts and assets. Some of these documents can contain your Social Insurance Number or date of birth; only submit what your broker has asked for. Your broker can also add notes about your application in BrokerMate.

Visitors: when you visit thebrokermate.com, our hosting provider (Cloudflare) processes basic technical information such as your IP address, browser type, the pages you request and the time, to deliver the site and protect it from abuse. The website also uses Google Analytics to measure how it is used: the pages you visit and how long you stay, roughly where you are (your city and region, worked out from your IP address), the kind of device and browser you use, the site that sent you to us, and how far you get through the sign-up form. It does not receive anything you type into a form. Section 15 says how to turn it off. If you contact us through the website’s form, we collect what you send: your name, work email, brokerage, the plan you’re asking about and your message.

4. How we use information

We use personal information only to:

• provide the service: collect documents for your broker, read them to recognize each document and sort it into your broker’s checklist, notify your broker, and send information to systems your broker connects (such as Finmo) when your broker chooses to;
• when your broker has switched it on, read back from Finmo, after your broker pulls your credit there, your credit score and the debts on your credit report, together with the deal’s price, down payment and income as Finmo holds them, so your broker can see which lenders’ limits your application fits. We keep these as figures only (no creditor or account number) and never store the credit report itself;
• keep your broker’s client list: your name, the status of your application, how many documents have arrived and your broker’s notes, so your broker can follow your file. We also use it to recognise you if you send documents to the same broker again, so that you aren’t counted as a new client on your broker’s bill;
• run broker accounts, billing and support;
• keep the service secure, prevent fraud and abuse, and fix problems;
• meet our legal obligations.

We use personal information for a new purpose only with consent, unless the law allows otherwise.

5. What we never do

• We never sell personal information.
• We never use borrower information for advertising or marketing.
• We never use borrower information to train AI models, and under Google Cloud’s terms, Google, which provides the AI that reads documents, doesn’t use it to train its models either.
• We don’t put sensitive information (such as SIN, income or account numbers) in web addresses, and we work to keep it out of logs.
• We don’t access a borrower’s documents except to provide, support or secure the service for the broker, or when the law requires it.

6. Consent

Brokers are responsible for obtaining borrowers’ consent, and giving any notice the law requires, before asking them to submit information through BrokerMate. By submitting documents, a borrower agrees that their broker, and BrokerMate on the broker’s behalf, may use them for the purposes in section 4. You can withdraw consent at any time by contacting your broker (or us, and we’ll pass it on), subject to legal and contractual limits; this may mean your broker can’t continue processing your application through BrokerMate.

7. Automated document processing

BrokerMate uses automated tools, including artificial intelligence provided by Google Cloud (Vertex AI), to read submitted documents as they are uploaded, recognize what kind of document each one is and whose it is, and sort it into your broker’s checklist. These tools can make mistakes, and you can move a file to the right item before you submit. BrokerMate does not make decisions about you. Your broker reviews your documents, and any decision about a mortgage is made by your broker and lender, not by BrokerMate. You can ask your broker what information was used and have it corrected.

8. Who we share information with

We share personal information only with:

• Service providers (sub-processors) that help us run BrokerMate, under agreements that limit their use of the information to providing services to us and require them to protect it:

• Systems your broker chooses to connect, such as Finmo, when your broker sends a file there (and, when your broker has switched it on, when we read your credit score and the debts on your credit report back from Finmo after your broker pulls your credit), and your broker’s own Google Drive, if they have linked it. Those services have their own privacy policies.
• Google, when a broker chooses to sign in with Google. Google learns that the broker is signing in to BrokerMate, as it does for any site that offers Google sign-in. We send Google no borrower information.
• Authorities or others when the law requires it, for example under a court order, or to protect someone’s safety.
• A buyer or successor if BrokerMate is sold or merged, under the same protections as this policy.

9. Where information is stored

Submitted documents, the BrokerMate database and the AI that reads documents all run in Canada: documents are kept in Google Cloud Storage in Montréal, documents are read by Google Cloud’s Vertex AI in Montréal, the app runs on Google Cloud in Montréal, and the database is in Canada (Central).

Some information is processed outside Canada:

• Email: our email provider, Resend, is in the United States. Emails we send (sign-in links, and notices to a broker that documents have arrived, which include client names and contact details) pass through it.
• Backup document reader: when the Canadian reader is temporarily unavailable, a document may be read by Anthropic’s Claude in the United States instead, so the broker isn’t kept waiting. Anthropic does not use it to train its models.
• Billing: our payment processor, Stripe, is in the United States and handles brokers’ billing details. It receives no borrower information.
• Website analytics: Google Analytics processes information about visits to thebrokermate.com on Google’s servers outside Canada, including in the United States. It receives no borrower information.
• Network: Cloudflare sits in front of the website and the app. Its network is global, so traffic on its way to the app, including uploads, may pass through its servers outside Canada.

Your broker’s own Google Drive. By default, documents are kept only in BrokerMate’s storage in Canada. A broker can choose to also receive a copy of their clients’ documents in their own Google Drive. Google Drive stores files outside Canada. That copy belongs to the broker, who decides who can see it, how long it is kept and when it is deleted; BrokerMate does not control it and cannot delete it. If you are a borrower and want to know whether your broker uses Google Drive, ask your broker.

Information processed outside Canada is subject to the laws of that country, and authorities there may be able to access it under those laws. We choose providers that protect information to a standard comparable to Canadian law. The table in section 8 lists where each provider processes information.

10. How we protect information

We use administrative, technical and physical safeguards suited to how sensitive the information is. These include encryption in transit (HTTPS) between your browser and BrokerMate, and between our servers and our database; encryption of stored Finmo credentials, of client names and broker notes in our database, and of submissions we hold temporarily when delivery is delayed; keeping each broker’s data separate, with each broker’s documents in a folder of their own inside our document storage in Canada, which no other broker’s account can reach; broker passwords stored only as salted hashes, sign-in links that expire (after 20 minutes for everyday sign-in) and sessions that end 90 days after a broker’s last visit; masking of email addresses and similar identifiers in our logs; and a record of when submissions are received and documents are downloaded. No system is completely secure. Brokers are responsible for keeping their own logins and devices secure.

11. How long we keep information

• Borrower documents and the details submitted with them: we store them for the broker, in Google Cloud Storage in Montréal, in a folder that belongs to that broker alone. They are the broker’s records, held by us on the broker’s behalf; we keep them while the broker’s subscription is active, and after it ends they follow the timetable below.
• Your broker’s client list (your name, your application’s status, how many documents have arrived, your broker’s notes, and coded fingerprints of your email address and phone number): kept while your broker’s subscription is active and deleted with the broker’s other client data after it ends, on the timetable below, or sooner if you or your broker ask us to delete it. The fingerprints are used only to recognise you if you send documents to the same broker again; they can’t be turned back into your email address or phone number without a secret key that we keep separately.
• Copies in a broker’s own Google Drive, where the broker has linked it: kept for as long as the broker decides. Deleting documents from BrokerMate’s storage does not delete those copies; the broker has to delete them.
• If a submission can’t be delivered to storage right away, we hold an encrypted copy for up to 7 days and delete it once it is delivered or the 7 days are up.
• The AI’s reading of each document isn’t stored; only the checklist item each file ends up in is saved with the submission.
• When a broker’s subscription ends. The broker keeps full use of BrokerMate until the end of the period they have paid for. After that, their account is read-only for 30 days: signing in takes them to a page of their own, where they can restart the subscription or export their data — their whole account, every client folder together, as a single download. We email the broker when the subscription ends, 7 days before that export deadline and again 1 day before it.
• Deletion after that. Within 30 days after the export deadline, BrokerMate deletes that broker’s client data — the documents in their folder and the records of submissions and downloads that go with them — on those dates, rather than waiting for anyone to ask. A broker in the read-only period can ask us to delete their data sooner, and we then delete it right away. We keep something longer only where the law requires it.
• What we keep after that deletion: the closed account and its address, the broker’s billing and invoice references, the broker’s own profile and settings, our audit log, and one record of the deletion itself — its date, how many client folders and files were removed, and what triggered it. That record holds no client name, no document name and no document content. Deletion is final: a broker who subscribes again gets a working account, not their earlier files.
• Billing records: as long as tax law requires.
• Deleting data removes it from our live systems. We have no long-term backup retention period configured for it, and we don’t promise one.
• When a broker or borrower asks us to delete information and the law allows, we delete it from document storage and from the database.

Brokers should keep their own copies of anything they are legally required to retain (for example, under anti-money-laundering rules); BrokerMate is not a record-keeping system for those obligations. The export in the broker’s account is how they take those copies: while the subscription is running, a single client’s folder as a download, and once it has ended, the whole account as one download from the page above. They need to take them before the export deadline.

12. Your rights

Subject to the law, you can:

• ask whether we hold personal information about you and get a copy;
• ask us to correct information that’s inaccurate or incomplete;
• withdraw your consent (see section 6);
• ask us to delete information we no longer need;
• in Quebec, ask for your information in a structured, commonly used technology format.

We reply within 30 days. We may need to confirm your identity first, and we’ll explain any reason we can’t fully meet a request.

13. If you’re a borrower

Because your broker controls your information, we’ll usually pass your request to your broker and help them respond. You can also contact your broker directly.

14. Privacy incidents

If a privacy breach involving personal information we hold creates a real risk of significant harm, we will notify affected brokers without undue delay, notify the Office of the Privacy Commissioner of Canada and other regulators as the law requires, and help brokers notify affected borrowers. We keep a record of all privacy incidents.

15. Cookies and analytics

Our website uses Google Analytics to count visits and to see where visitors leave the sign-up form, so we can fix what is unclear. Google Analytics sets cookies in your browser (their names start with “_ga”) that last up to two years and let it recognize the same browser on a later visit. We don’t use advertising cookies, we haven’t turned on Google’s advertising features, and we never send Google what you type into a form. The website sets no other cookies, and its fonts are served from our own site.

Turn off Google Analytics on this browser

Ticking that box is remembered in this browser only, and Google Analytics stays off here until you untick it. Google also offers a browser add-on that turns Google Analytics off on every website.

The BrokerMate app sets two cookies. The first keeps brokers signed in for up to 90 days after their last visit. The second holds no personal information at all — only a yes — and lets our website show “Dashboard” instead of “Sign in” to a broker who is already signed in. It doesn’t set cookies on the borrower upload page; that page remembers your language choice in your browser’s storage, which you can clear in your browser settings. The app loads its fonts from Google Fonts, so Google receives your IP address and browser details when you open it.

16. Children

BrokerMate is not intended for anyone under the age of majority in their province, and we don’t knowingly collect their information.

17. Changes to this policy

We’ll post any changes here and update the “Last updated” date. If a change is significant, we’ll email brokers at least 30 days before it takes effect.

18. Contact us and complaints

Our Privacy Officer is responsible for how we handle personal information:
Arash Zare, President, MEERKATS DEV INC., Vancouver, British Columbia, Canada, info@thebrokermate.com.

If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), or the Commission d’accès à l’information du Québec (cai.gouv.qc.ca), depending on where you live.