Your Privacy Is
Our Priority

1. Information We Collect

Personal Information

When you register for LoanFlow or use our services, we collect: your full name, email address, phone number, business name, province of operation, and professional licensing information (where applicable).

Usage Data

We automatically collect information about how you interact with the platform, including pages visited, features used, time spent, browser type, IP address, and device identifiers.

Mortgage-Related Data

As part of our CRM functionality, we store client contact information, lead data, mortgage application details, consent records, and communication histories that you input into the platform. This data belongs to you — see Section 10 of our Terms of Service.

2. How We Use Your Information

• Service Delivery: To provide, maintain, and improve the LoanFlow CRM platform.
• Compliance: To maintain CASL consent records and PIPEDA compliance infrastructure on your behalf.
• Communications: To send you platform updates, billing notifications, and (with your consent) marketing communications.
• Support: To respond to your support requests and troubleshoot technical issues.
• Improvement: To analyze usage patterns and improve platform features.
• Security: To detect, prevent, and address fraudulent activity and security vulnerabilities.

3. Legal Basis for Processing

LoanFlow processes personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). Our primary legal bases are:

• Consent: You provide express consent to our collection practices when you register and accept this Privacy Policy.
• Contractual Necessity: Processing is required to fulfill our obligations under our Terms of Service.
• Legitimate Interests: We process certain data to improve our services and ensure platform security.

4. Data Storage & Security

LoanFlow is designed to host all data on servers physically located in Canada (AWS ca-central-1, Montreal) — planned for production launch. We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit
• Role-based access controls and multi-factor authentication
• Regular third-party security audits and penetration testing
• SOC 2 Type II compliant infrastructure

5. Sharing Your Information

We never sell your personal information. We may share information with trusted third-party service providers who assist us in operating our platform, subject to strict confidentiality agreements. These providers are prohibited from using your data for any purpose other than providing services to LoanFlow. We may disclose information when required by Canadian law or court order.

6. Your Rights Under PIPEDA

As a Canadian resident, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that inaccurate personal information be corrected.
• Withdrawal of Consent: Withdraw consent to our processing of your personal information (subject to legal and contractual restrictions).
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise these rights, contact our Privacy Officer at privacy@loanflowcrm.ca.

7. Cookies & Tracking

LoanFlow uses essential cookies necessary for platform functionality (authentication, session management). We also use analytics cookies to understand platform usage. You can configure your browser to decline cookies, however some platform features may not function correctly without them. We do not use third-party advertising cookies.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Following account closure, we retain data for 7 years to comply with Canadian financial recordkeeping requirements, after which it is securely deleted. You may request earlier deletion subject to these legal obligations.

9. Children's Privacy

LoanFlow is a professional B2B platform. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided personal information, we will delete it promptly.

10. Contact Our Privacy Officer