Data Processing Agreement
Between Mudrick Technologies Inc. ("Processor") and the subscribing brokerage ("Controller")
Published September 22, 2026 · Version 1.3
Version applicability: Version 1.3 applies to a new Controller when it accepts this version on or after September 22, 2026. For an existing Controller, a material amendment applies only after the Controller separately accepts it in writing or after RateGuard Pro gives the notice required by the then-current agreement and that notice period expires. Publication alone does not shorten or replace a required notice period.
1. Definitions
"Personal Information" means information about an identifiable individual as defined under PIPEDA, including client names, contact details, mortgage balances, rates, terms, maturity dates, lender names, and property types.
"Controller" means the mortgage brokerage that uploads, manages, and owns the client data processed through RateGuard Pro.
"Processor" means Mudrick Technologies Inc., which processes Personal Information on behalf of the Controller.
"Sub-processor" means a third-party service engaged by the Processor to assist in processing Personal Information.
2. Scope and Purpose of Processing
The Processor processes Personal Information solely to provide the following services to the Controller:
- Mortgage portfolio analysis, opportunity identification, and client prioritization
- Automated email communications sent on behalf of the Controller to the Controller's clients
- PDF report generation (renewal, refinance, economics) delivered to the Controller and their clients
- CRM data synchronization from the Controller's connected CRM (Finmo, Velocity, or CSV upload)
- Rate monitoring and penalty calculation services
The Processor does not process Personal Information for any purpose other than providing the subscribed services.
3. Categories of Personal Information
| Category | Examples | Source |
|---|---|---|
| Identity | Client full name, co-borrower name | CRM sync or CSV upload |
| Contact | Email address, phone number, mailing address | CRM sync or CSV upload |
| Mortgage details | Balance, rate, term, amortization, maturity date, lender, property type, LTV | CRM sync or CSV upload |
| Financial and qualification data | Income, debts, liabilities, and credit score where provided for an enabled qualification or discovery feature | Controller input, client-facing tool, CRM sync, or CSV upload |
| Interaction data | Email open/click events, portal actions taken by the Controller | Platform-generated |
Data not intended for the Service: The Service is not designed to collect social insurance numbers (SINs), banking credentials, income verification documents, or government-issued identification, and Controllers must not upload them. Credit scores may be processed only where provided for an enabled qualification or discovery feature.
4. Controller Obligations
The Controller is responsible for:
- Ensuring they have lawful authority to share client Personal Information with the Processor, including obtaining any required consent under applicable privacy legislation.
- Accuracy of the data uploaded to the platform.
- Complying with CASL requirements for commercial electronic messages sent through the platform, including maintaining consent records for their client communications.
- Notifying the Processor promptly if a client exercises their right to access, correct, or delete their Personal Information.
5. Processor Obligations
The Processor commits to:
- Purpose limitation: Processing Personal Information only for the purposes described in Section 2 and only on documented instructions from the Controller.
- Confidentiality: Ensuring that the platform administrator with access to Personal Information is bound by confidentiality obligations.
- Security: Implementing and maintaining the technical and organizational measures described at rateguardpro.ca/security, including encrypted managed infrastructure, HTTPS, tenant-scoped access controls, brute force protection, and administrative API action allowlists.
- No cross-tenant access: The Processor will not aggregate, combine, or cross-reference one Controller's data with another Controller's data for any purpose.
- No monetization: The Processor will not sell, license, rent, or share Personal Information with third parties for marketing, advertising, or analytics purposes.
- No solicitation or independent contact: The Processor will not use Personal Information to solicit or market to the Controller's clients, establish an independent commercial relationship with them, or bypass the Controller for a referral fee, commission, or other revenue. Client contact is limited to the Controller's instructions, Client-initiated support or privacy requests, and security or legal obligations.
- Least-privilege integrations: The Processor will request and use only the minimum third-party permissions and fields reasonably necessary to provide the subscribed service. The Processor will not request write access unless the Controller separately authorizes that access in writing.
- Sub-processor transparency: Maintaining a current sub-processor register at rateguardpro.ca/subprocessors and notifying the Controller of material changes.
- Assistance with rights requests: Assisting the Controller in responding to data subject access, correction, or deletion requests within 10 business days.
6. Data Residency and Cross-Border Processing
The primary database is hosted in AWS ca-central-1 (Montreal, Canada) via Supabase. Some processing occurs outside Canada: the platform's application and serverless functions run on Vercel infrastructure located in the United States, and certain sub-processors listed in Section 7 (including email delivery, payment processing, and AI features) are based in the United States. Personal Information processed outside Canada remains subject to this Agreement and to the data-protection terms in place with each sub-processor. The Processor does not sell Personal Information and does not combine one Controller's data with another Controller's data.
7. Sub-processors
The following sub-processors are engaged to deliver the service under written or online terms appropriate to the service used. Regions below reflect where each sub-processor primarily processes data and may vary by vendor configuration:
| Sub-processor | Purpose | Primary region |
|---|---|---|
| Supabase | Database, authentication, and file storage | Canada primary; supporting processing may occur outside Canada |
| Amazon Web Services (AWS) | Cloud infrastructure used by Supabase | Canada primary; supporting processing may occur outside Canada |
| Google Workspace, Gmail API, Google Apps Script, Google Sheets, and related operational services | Canada / United States / global infrastructure | |
| Microsoft | Microsoft identity and Microsoft Graph email services for connected Outlook accounts | Canada / United States / global infrastructure |
| Vercel | Application hosting, serverless functions, CDN, and deployment logs | United States / global edge network |
| Stripe | Subscription billing and payment processing | United States / global infrastructure |
| Resend | Transactional and broker-authorized email delivery | United States |
| Zoom | Registration and delivery for optional training sessions | United States / global infrastructure |
| OpenAI | AI assistant, transcription, and training features where enabled | United States |
| Anthropic | AI features, including rate-sheet and document parsing | United States |
| AssemblyAI | Optional audio transcription and speaker diarization where enabled | United States |
| Railway | Hosting for the Rate Scout rate-extraction service | United States |
A current public copy of this list is maintained at rateguardpro.ca/subprocessors. The Processor will provide at least 30 days' notice before engaging a new sub-processor that will handle Personal Information. The Controller may object in writing within 14 days of receiving the notice. A shorter notice period may be used only where reasonably necessary to address an urgent security issue, comply with law, or preserve service continuity. In that case, the Processor will provide notice as soon as reasonably practicable, explain the shortened period, and preserve the Controller's objection rights.
8. Breach Notification
In the event of a breach of security involving Personal Information under the Processor's control:
- The Processor will notify the affected Controller(s) without unreasonable delay, and in any case within 72 hours of becoming aware of a confirmed breach involving their Personal Information.
- The notification will include: the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the breach.
- The Processor will cooperate with the Controller in meeting the Controller's obligations under PIPEDA s.10.1 (notification to the Privacy Commissioner) and any applicable provincial legislation.
- The Processor maintains a breach register as required by PIPEDA s.10.3, retained for a minimum of 24 months.
9. Data Retention and Deletion
- During subscription: Personal Information is retained for the duration of the Controller's active subscription. The Controller may use supported export features or request an export of available data.
- Post-cancellation: Deletion is handled through the Processor's documented internal process and targeted for completion within 90 days after account termination, subject to legal retention, security, operational requirements, and the ordinary backup lifecycle. This is a target, not a guaranteed deletion deadline.
- On request: The Controller may request deletion at any time by contacting jeff@rateguardpro.ca. For a request made before termination, deletion is targeted for completion within 90 days after the request, subject to the same limitations. Deletion status can be confirmed on request.
- Integration credentials: Credentials and authorization tokens are revoked or deleted when the integration is disconnected. Any residual encrypted backup copies remain protected and expire through the ordinary backup lifecycle.
10. Data Portability
The Controller may use supported platform export features or request an export of available Personal Information in a standard, machine-readable format such as CSV. Some exports require operational assistance and are not available as an immediate self-service download.
11. Audit Rights
The Controller (or their designated third-party auditor) may, upon 30 days' written notice, request evidence of the Processor's compliance with this Agreement. Audits must be reasonable in scope, conducted during normal business hours, limited to once in any 12-month period, and paid for by the requesting Controller. After a confirmed security incident involving the Controller's Personal Information, the 30-day notice and annual-frequency limits do not apply, and the Processor will bear the reasonable audit costs directly related to that incident. If a regulator requires an audit, timing and costs will follow the regulator's direction. The reasonable-scope, business-hours, and confidentiality requirements continue to apply unless the incident or regulator reasonably requires otherwise.
- Confirmation of current security measures in place
- Sub-processor list with current DPA status
- Breach register excerpts relevant to the Controller (if any)
- Evidence of data deletion status upon request
On-site audits are not applicable as the Processor does not maintain physical infrastructure. Public or shareable provider assurance materials may be provided where available and permitted by the provider.
12. Liability and Indemnity
Liability arising under this Agreement is governed by the limitation-of-liability and indemnity provisions of the Principal Agreement. This Agreement does not create a separate indemnity, expand an existing indemnity, or waive an existing liability cap, except to the extent applicable law prohibits that limitation.
13. Term and Termination
This version applies to the Controller as described in the Version Applicability paragraph above and continues for the duration of the subscription. Upon termination, the data retention and deletion provisions in Section 9 apply. Sections 5 (Processor Obligations), 8 (Breach Notification), 9 (Data Retention), and 12 (Liability and Indemnity) survive termination.
14. Governing Law
This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including PIPEDA. For Controllers operating in Quebec, the provisions of Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) apply in addition to PIPEDA where they impose stricter requirements.
15. Contact
Mudrick Technologies Inc. - Privacy Officer
Jeff Mudrick
jeff@rateguardpro.ca
For questions about this Agreement, data access requests, or to report a security concern.