Privacy Policy

1. Definitions

• "User" or "you" refers to the mortgage broker or professional who creates an account and uses the Service.
• "End-Client Data" refers to personal information contained within documents that Users upload to the Service, belonging to the User's clients (e.g., mortgage applicants).
• "Document Content" refers to the information extracted from uploaded documents.
• "Metadata" refers to information about documents (such as document type, classification, upload date, processing time) that does not include the actual document content.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Phone number
• Brokerage or Lender name
• Mortgage broker or mortgage brokerage license number

2.2 Team Member Information

If you add team members to your account, we collect their name, email address, and phone number.

2.3 Document Content and End-Client Data

When you upload documents to the Service, we process and store the documents and their contents. Documents may include sensitive financial and personal information such as:

• Tax documents (T1 Generals, T4s, etc.)
• Business financial statements
• Income and employment information
• Social Insurance Numbers (SINs)
• Names, addresses, and contact information
• Any other information contained within the uploaded documents

2.4 Document Metadata

We collect metadata about documents, including document type, classification results, upload date and time, file size, processing time, and analysis results.

2.5 Payment Information

We use Stripe to process payments. Stripe collects and processes your payment information (such as credit card details and billing address) directly. We do not store your full payment card information on our servers. Please refer to Stripe's Privacy Policy for more information on how they handle your payment data.

2.6 Technical Information

We collect technical information necessary to provide the Service, including IP address, browser type, device information, and session data.

3. How We Collect Information

We collect information:

• Directly from you when you create an account, add team members, or upload documents
• Automatically through technical means when you use the Service
• From third parties such as Stripe for payment confirmation

4. Purpose of Collection and Use

4.1 Providing the Service

• To create and manage your account
• To securely store, analyze, and classify your documents
• To extract and display document information
• To authenticate your identity using email and one-time passwords (OTP)

4.2 Billing and Payments

• To process payments and manage subscriptions
• To provide the 14-day free trial for new users

4.3 Customer Support

To respond to support requests, which may require accessing your account or document data to diagnose and resolve issues.

4.4 Service Improvement

We may use aggregated or anonymized data derived from your use of the Service to analyze trends, improve our document classification and analysis accuracy, and enhance overall Service quality. This data is used internally and is not shared with third parties.

4.5 Communications

• To send transactional emails (account verification, password resets, etc.)
• To send service-related updates and announcements
• To send marketing communications (with your consent)

4.6 Analytics and Insights

To generate aggregated, anonymized insights about document processing trends and Service usage.

4.7 Legal Compliance

To comply with applicable laws, regulations, and legal processes.

5. End-Client Data and Your Responsibilities

As a User, you are responsible for ensuring that you have obtained all necessary consents and authorizations from your clients before uploading their documents to the Service. This includes informing your clients that their documents and personal information will be processed by Caivus in accordance with this Privacy Policy.

You represent and warrant that you have the legal authority to upload and process End-Client Data through the Service, and that doing so does not violate any applicable laws, regulations, or agreements with your clients.

We process End-Client Data on your behalf as a service provider. The relationship between you and your clients regarding their personal information is governed by your own privacy policies and agreements with them.

6. Data Processing and Third-Party Service Providers

6.1 Document Processing Infrastructure

Documents are processed using AI infrastructure hosted securely within our own private cloud environment in Canada. Your Document Content is not shared with or accessible to external third parties. All document analysis and classification occurs within our secure, isolated infrastructure.

6.2 Third-Party Service Providers

We use the following third-party service providers to operate aspects of our Service:

• Amazon Web Services (AWS): Cloud infrastructure and data storage. All data is stored in Canada within our private, isolated environment.
• Supabase: Database services for account and application data.
• Stripe: Payment processing. Stripe directly collects and processes your payment information. We do not have access to your full payment card details.
• Resend: Email delivery services for transactional and marketing emails.

These service providers are contractually obligated to protect your information and may only use it to provide services to us. We require that they maintain security standards consistent with our own.

7. Data Storage and Security

7.1 Data Location

All data is stored on servers located in Canada.

7.2 Security Measures

We implement robust technical and organizational security measures to protect your information, including:

• Encryption of data at rest and in transit
• Access controls and authentication requirements
• Private, isolated cloud infrastructure for document processing
• Regular security assessments and monitoring
• SOC 2 compliance

While we take reasonable precautions to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

8. Data Retention

8.1 Account Information

We retain your account information for as long as your account is active or as needed to provide you with the Service.

8.2 Documents

Uploaded documents are retained indefinitely unless:

• You queue a document for deletion through the Service
• You delete your dashboard/account
• You request deletion by contacting us

8.3 Metadata Retention

Important: When you delete an individual document through the queue system, we permanently remove the Document Content (the actual information extracted from the document) but retain the Metadata (document type, classification, upload date, etc.) indefinitely for analytics and service improvement purposes.

If you delete your entire dashboard/account or request full data deletion by email, we will delete both the Document Content and Metadata associated with your account.

9. Cookies

We use functional cookies only. These cookies are essential for the operation of the Service and enable features such as authentication, session management, and security. We do not use tracking cookies or advertising cookies.

You can configure your browser to refuse cookies, but this may affect your ability to use the Service.

10. Your Rights Under PIPEDA

Under PIPEDA, you have the following rights:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request correction of inaccurate or incomplete information.
• Deletion: You may request deletion of your personal information. You can delete documents individually, delete your entire account, or contact us to request deletion.
• Withdrawal of Consent: You may withdraw your consent to our collection and use of your information at any time, subject to legal or contractual restrictions.

To exercise any of these rights, please contact our Privacy Officer using the contact information below. We will respond to your request within 30 days.

11. International Users

Our Service is designed for Canadian mortgage brokers and is governed by Canadian law. While we do not restrict access based on geographic location, users outside of Canada should be aware that:

• The Service is optimized for Canadian documents and regulations
• Your data will be stored and processed in Canada
• Canadian privacy laws (PIPEDA) and the laws of British Columbia govern this Privacy Policy

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Effective Date." For significant changes, we may also notify you by email. Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.

13. Questions, Concerns, and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact our Privacy Officer:

We will investigate all complaints and respond within a reasonable timeframe. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada: