How we protect personal information.

01Scope of This Policy

This Policy applies to personal information collected through our public website, our software-as-a-service platform, client consent portals, and our electronic communications. It does not apply to third-party websites, services, or applications that may be linked from or integrated with our platform.

Where this Policy conflicts with a signed agreement between Autowrite and a Broker (including the Data Processing Agreement), that agreement governs the processing of borrower data.

02Key Definitions

• Personal information - information about an identifiable individual, including financial information, but excluding the business contact information of an individual used solely to contact them in their professional capacity.
• De-identified information - information that no longer directly identifies an individual but could, in some circumstances, be used to re-identify them.
• Anonymized information - information irreversibly altered so that no individual can be identified, directly or indirectly.
• Controller / Processor - as defined in Section 3 and our Data Processing Agreement.

03Our Role: Controller and Processor

Our obligations depend on whose information we handle and why:

• Borrower information uploaded by a Broker. The Broker is the data controller and Autowrite acts solely as the data processor, processing that information only on the Broker’s documented instructions under our Data Processing Agreement.
• Information about website visitors, prospects, and account administrators. For this limited category, Autowrite acts as the controller and is directly responsible under this Policy.

04Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Identity data - name, date of birth, residential address, and government-issued identifiers.
• Financial data - income details, tax forms, pay stubs, bank statements, and related documentation.
• Property data - purchase agreements, leases, and property tax bills.
• Contact data - email address, telephone number, and brokerage details.
• Account & usage data - login credentials, role, audit-log activity, and platform usage.
• Technical data - IP address, device and browser information, and cookies (see our Cookie Policy).

Much of the financial information we process is sensitive, and we apply heightened safeguards to it accordingly.

05How We Use Personal Information

We use personal information only for the purposes for which it was collected, including:

• preparing and assembling mortgage application documentation on a Broker’s instructions;
• performing automated document intake, classification, and data extraction;
• supporting Broker-side compliance and audit workflows;
• providing, securing, maintaining, and improving the platform;
• delivering technical support and service-related communications;
• detecting, preventing, and investigating fraud, abuse, and security incidents; and
• meeting our legal, regulatory, and contractual obligations.

We do not sell personal information, and we do not use it for unrelated purposes or for advertising profiling.

06Consent

For borrower information, we rely on the informed consent obtained by the Broker before any information is uploaded to the platform. For our own business contacts, we rely on consent or legitimate business purposes permitted by law. We seek express consent for sensitive information and may rely on implied consent only where appropriate and permitted by law.

Consent may be withdrawn at any time by contacting the relevant Broker or Autowrite, subject to legal and contractual restrictions. Withdrawal may affect a Broker’s ability to proceed with a mortgage application.

07Cookies and Similar Technologies

We use cookies and similar technologies to enable core functionality, analyze usage, and remember preferences. Non-essential cookies are used only with your consent. Full details are set out in our Cookie Policy, and you can change your choices at any time through our cookie preferences centre.

08Disclosure of Personal Information

We disclose personal information only:

• to the Broker that engaged us, and to lenders, mortgage insurers, or other parties as directed by that Broker;
• to vetted sub-processors who support our services under contracts requiring equivalent protections;
• where required to comply with applicable law, legal process, or a binding governmental request; and
• to protect the rights, property, or safety of Autowrite, our customers, or others.

In the event of a corporate transaction such as a merger, acquisition, or sale of assets, personal information may be disclosed to the parties involved, subject to confidentiality protections and continued application of this Policy. Autowrite does not sell, rent, or trade personal information.

09Sub-Processors and Service Providers

We engage a limited number of sub-processors - such as our cloud infrastructure provider in Canada - to deliver the platform. Each sub-processor is bound by a written agreement (including a data processing agreement) requiring confidentiality and protections equivalent to those in this Policy. A current list of sub-processors is set out in Schedule C of our Data Processing Agreement and is available to Brokers on request; we provide notice of material changes.

10Data Storage, Location, and Residency

Personal information is stored on secure cloud infrastructure located in Canada (AWS Canada, ca-central-1). We do not transfer personal information outside of Canada except as described in Section 19, and only with appropriate safeguards and notice.

11Security Safeguards

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• AES-256 encryption at rest and TLS 1.2 or higher in transit;
• role-based access controls, mandatory multi-factor authentication, and least-privilege access;
• comprehensive audit logging of file views, downloads, and edits;
• regular vulnerability testing, patch management, and independent penetration testing; and
• confidentiality agreements and mandatory security training for all personnel.

No method of transmission or storage is perfectly secure. While we work hard to protect personal information, we cannot guarantee absolute security, and we disclaim liability for misuse of information by Brokers or third parties outside our control.

12Retention and Deletion

We retain personal information only as long as necessary to fulfil the purposes for which it was collected or as required by law. As a general guide, borrower documents are retained for the period directed by the Broker; account and billing records are retained for the life of the account and for up to seven (7) years afterward to meet tax and legal obligations; and security and audit logs are retained for twelve (12) months.

Upon a verified request from the relevant Broker or borrower, or upon termination of services, we will delete or return personal information - ordinarily within sixty (60) days - unless retention is required to meet a legal obligation, in which case we isolate and protect it until deletion is permitted.

13Your Privacy Rights

Subject to applicable law, individuals may:

• access the personal information we hold about them and request information about how it is used and disclosed;
• correct inaccurate or incomplete information;
• delete personal information where there is no lawful basis to retain it;
• withdraw consent to certain processing; and
• request portability - where required by law (including Quebec), receive computerized personal information they provided to us in a structured, commonly used technological format.

Borrower requests are generally directed to the Broker as data controller; we assist Brokers in fulfilling them. You may also file a complaint with the Office of the Privacy Commissioner of Canada (OPC), the Commission d’accès à l’information du Québec (CAI), or your applicable provincial privacy regulator.

14Quebec Residents (Law 25)

Where we act as a controller for individuals in Quebec, the following additional protections apply under Quebec’s private-sector privacy law as amended by Law 25:

• Privacy Officer. Our designated Privacy Officer (Section 24) is responsible for our compliance and for handling access, correction, and portability requests.
• Transfers outside Quebec. Before disclosing personal information outside Quebec, we conduct a privacy impact assessment and ensure the information receives equivalent protection.
• Automated decision-making. Where a decision is based exclusively on automated processing, the affected individual may, on request, be informed of that fact and of the principal factors involved, and may submit observations (see Section 15).
• Breach reporting. We report confidentiality incidents that present a risk of serious injury to the CAI and to affected individuals, and we keep an incident register.
• De-indexing and portability. Individuals may exercise applicable de-indexing and data-portability rights.

15Automated Processing and Artificial Intelligence

The platform uses automated processing and artificial intelligence to assist with document intake, classification, and data extraction. These tools support - and do not replace - the professional judgment of the Broker, and we do not make decisions that produce legal or similarly significant effects about an individual solely by automated means.

We do not use borrowers’ documents or personal information to train third-party AI models. Where we use external model providers, we operate under zero-data-retention terms. Where automated decision-making is used by a Broker through the platform, the Broker is responsible for any transparency obligations owed to the individual.

16Breach Notification

In the event of a breach of security safeguards involving personal information, we will notify the affected Broker without undue delay and, where feasible, within 72 hours of confirming the breach. We will cooperate with the Broker and regulators on assessment, notification, and remediation in accordance with PIPEDA, Quebec Law 25, and our Data Breach & Incident Response Policy.

17Electronic Communications (CASL)

By providing your email address or telephone number, you consent to receiving service-related electronic communications necessary to provide the platform. You may unsubscribe from non-essential communications or withdraw consent at any time; certain transactional and security messages may continue as permitted by law.

18Children’s Privacy

Our services are intended for licensed mortgage professionals and adult borrowers. We do not knowingly collect personal information directly from individuals under the age of 18. If we learn that we have done so without proper authorization, we will delete it.

19International Transfers

We do not transfer personal information outside of Canada in the ordinary course. If a transfer ever becomes necessary, we will conduct a privacy impact assessment where required, implement equivalent contractual and technical safeguards, provide notice where required, and remain accountable for the information.

20De-identification and Anonymization

We may de-identify or anonymize personal information for analytics, research, security, and service-improvement purposes. We do not attempt to re-identify anonymized information, and we apply technical and organizational measures to prevent re-identification of de-identified information.

21Accountability and Openness

We are accountable for personal information under our control. We maintain internal policies and practices (including our Information Security Policy and Data Breach & Incident Response Policy) to give effect to this Policy, train our personnel, and make information about our practices readily available. Our Privacy Officer oversees compliance and responds to inquiries and complaints.

22Third-Party Links

Our website and platform may link to third-party sites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy practices.

23Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date and version above reflect the most recent revision. We will communicate material changes through the website or by email, and continued use of the platform after changes take effect constitutes acceptance. Previous versions are available on request.

24Contact Us

Questions, requests, or complaints about this Policy or your personal information can be directed to our Privacy Officer:

• Automata Intelligence Inc. (operating as Autowrite)
• Attn: Privacy Officer
• 37 Leadership Drive, Brampton, Ontario L6Y 5T2, Canada
• Email: info@autowrite.ca

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.