Privacy Policy

Last Updated: May 3, 2026

1. Scope and Application

This Privacy Policy applies to:

• Mortgage professionals who use our Service ("Users"), including account holders and their authorized team members
• Individuals whose personal information is uploaded to the Service by Users ("Clients")
• Visitors to our website and client-facing tools (e.g., Grade My Mortgage, client update links)
• Participants in our referral or partner program ("Partners")
• Anyone who contacts us or receives communications from us

2. Accountability

Mudrick Technologies Inc. has designated a Privacy Officer, Jeff Mudrick, who is accountable for our compliance with this Privacy Policy and applicable privacy laws.

Privacy Officer Contact:
Email: jeff@rateguardpro.ca

3. Information We Collect

3.1 Information from Users (Mortgage Professionals)

Account Information: Name, email address, phone number, brokerage name, licence number, brokerage licence number, provinces licensed, mailing address.

Authentication Information: Password (stored as a one-way hash), session tokens, password reset tokens.

Payment Information: Billing details processed by our payment processor, Stripe. We do not store full credit card numbers on our servers.

Profile and Branding: Profile photo, custom branding colours, logo, calendar links, email signature preferences, and communication tone preferences.

Usage Information: Login history and activity logs, features used and interactions with the Service, portal events, email open and click tracking, device information, browser type, IP address.

CRM Credentials: If you connect a third-party CRM (e.g., Finmo), we store encrypted API tokens to maintain the integration. These credentials are encrypted at rest and used solely to synchronize your data.

Connected Email Accounts (Google / Microsoft): If you optionally connect your own Google or Microsoft account to send individual emails from your own address, we store an encrypted authorization token to send on your behalf. For Google, we request only permission to send email (gmail.send); we do not read, browse, delete, or manage your mailbox, contacts, or calendar, and we never use this access for automated or bulk sending. Google user data obtained through this integration is handled in accordance with the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time, which revokes our access and deletes the stored token. See our Gmail Integration page for full details.

Uploaded Documents: Rate sheets and similar documents you upload. These may be processed by automated extraction tools, including optical character recognition (OCR) and AI services, to read rate and product information from the document.

3.2 Client Information (Uploaded by Users)

Users may upload information about their mortgage clients to the Service through CSV files, CRM integrations, or manual entry. This information may include:

• Client names and contact information (email, phone, mailing address)
• Co-borrower names and contact information
• Property addresses and estimated property values
• Mortgage details (amount, rate, term, lender, funding date, maturity date, amortization, payment frequency)
• Loan-to-value ratios and insurance status
• Payment amounts and prepayment privilege details
• Financial information (income, debts, if uploaded)

3.3 Information from Client-Facing Tools

When Clients interact with tools such as Grade My Mortgage or client update links, we may collect:

• Name, email address, and phone number (if voluntarily provided)
• Mortgage details entered by the Client (lender, rate, remaining term, property value)
• Device information and IP address

This information is shared with the referring User (broker) as part of the Service's lead generation and client engagement features.

3.4 Information from Partners

If you participate in our referral or partner program, we collect your name, email address, company name, and referral activity (referrals made, attribution source, referral status). We track referral attribution through unique partner URLs, coupon codes, and self-reported referral sources on our signup forms.

3.5 Information Collected Automatically

When you visit our website or use the Service, we automatically collect:

• IP address and approximate geographic location
• Browser type and version
• Operating system and device type
• Pages visited, features used, and time spent
• Referring website or source
• Cookies and similar tracking technologies (see Section 10)
• Security and abuse-prevention signals, such as login attempts, session events, request patterns, error logs, rate-limit events, and suspected automated activity

4. Purposes for Collection, Use, and Disclosure

4.1 User Information

We collect, use, and disclose User information for the following purposes:

• To create, manage, and authenticate your account
• To provide, maintain, and improve the Service
• To process payments and billing through Stripe
• To send you daily action summaries, system alerts, and operational communications
• To send promotional communications (with your consent, which you may withdraw at any time)
• To synchronize your data with connected CRM platforms
• To analyze usage patterns and improve the Service
• To detect, prevent, and address fraud, security issues, and technical problems
• To investigate and prevent unauthorized access, scraping, abuse, excessive automated activity, or violations of our Terms of Service
• To manage the referral and partner program, including tracking attribution
• To comply with legal obligations
• To enforce our Terms of Service

4.2 Client Information

We process Client information uploaded by Users solely to:

• Provide the Service to Users, including portfolio analysis, penalty estimation, opportunity identification, renewal tracking, and priority scoring
• Generate reports, PDFs, and communications on behalf of Users
• Run automated nightly analysis to identify new opportunities based on current market rates
• Store and display information within the Service
• Create aggregated, anonymized analytics (which do not identify individuals)

We do not use Client information for our own marketing purposes. We do not sell, rent, or trade Client information to any third party.

4.3 Automated Processing

The Service uses automated tools, algorithms, and third-party artificial intelligence (AI) services (see Section 6) to analyze mortgage data, estimate penalties, score opportunities, extract information from uploaded documents, and generate communications. No automated decisions with legal or significant effects are made about Clients without the User's (broker's) independent professional review.

5. Consent

5.1 User Consent

By creating an account and using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

5.2 Client Consent

Users are responsible for obtaining all necessary consents from their Clients before uploading Client information to the Service. By uploading Client information, Users represent and warrant that they have obtained appropriate consent for such upload and processing, including consent for automated analysis of their mortgage data.

5.3 Withdrawing Consent

You may withdraw your consent at any time by contacting us at jeff@rateguardpro.ca. However, withdrawing consent may affect our ability to provide the Service to you. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5.4 Commercial Electronic Messages (CASL)

Commercial electronic messages we send to Users, such as product updates and promotional emails, identify Mudrick Technologies Inc. as the sender, include our contact information, and provide a way to unsubscribe, consistent with Canada's Anti-Spam Legislation (CASL). For client communications that a User sends through the Service, the User is the sender and is responsible for obtaining the consents and meeting the CASL obligations that apply to those messages.

6. Disclosure to Service Providers

We may disclose personal information to third-party service providers who perform services on our behalf. Our current service providers include:

Our service providers are contractually obligated to protect personal information and use it only for the purposes for which it was disclosed. We conduct reasonable due diligence on our service providers' privacy and security practices.

6.1 Cross-Border Transfers

Some of our service providers operate in the United States, and certain application and AI processing occurs in the United States. When personal information is transferred outside Canada, it may be subject to the laws of the jurisdiction in which the service provider operates, including potential lawful access by courts, law enforcement, or government authorities in that country. We put contractual arrangements in place that require service providers to protect personal information and to use it only for the purposes for which it was provided.

7. Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law:

8. Safeguards

We implement appropriate technical and organizational measures to protect personal information:

• Encryption of data in transit (TLS/SSL) and at rest
• Passwords stored using one-way cryptographic hashing
• Tenant-scoped access controls designed so Users can only access their own data
• Secure session management with automatic expiration
• Authentication, authorization, and action allowlists for administrative and server-to-server endpoints
• CRM credentials encrypted at rest using industry-standard methods
• Regular security reviews and vulnerability assessments
• Access limited to authorized personnel on a need-to-know basis

8.1 Data Location

Our primary database is hosted through Supabase with infrastructure in North America. Web applications are served through Vercel's global edge network. While we prioritize Canadian and North American data residency where possible, some data may transit or be processed through servers in other jurisdictions as part of normal content delivery operations.

8.2 Incident Response

We maintain incident response procedures to detect, contain, and remediate security incidents. In the event of a security incident, we will take prompt action to mitigate harm and notify affected parties as required by law.

9. Team Member Access

When an account holder adds a team member, that team member gains access to the account's Client Data, opportunity analysis, and reporting features. Team members authenticate with their own credentials and their actions are logged separately.

Account holders are responsible for ensuring their team members understand and comply with applicable privacy obligations. Removing a team member immediately revokes their access to Client Data.

10. Cookies and Tracking Technologies

We also track portal events (e.g., feature usage, button clicks) server-side through our database to improve the Service, understand how features are used, maintain security, and enforce our Terms of Service. This tracking is tied to your User account, not to cookies.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service. Disabling other cookies will not affect core functionality.

Our public website uses Vercel Web Analytics and Vercel Speed Insights to understand aggregate usage and page performance. These tools are provided by Vercel (a sub-processor) and are designed to measure traffic and performance without cross-site tracking cookies.

11. Your Rights

11.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide the information in a commonly used electronic format.

11.2 Right to Correction

You have the right to request correction of inaccurate or incomplete personal information. You can update most information directly through the Service's settings.

11.3 Right to Deletion

You may request deletion of your personal information, subject to legal retention, backup, and security requirements. Upon account termination, Client Data is targeted for deletion within 90 days as described in Section 7.

11.4 Right to Data Portability

You may export your Client Data at any time through the Service's built-in export features.

11.5 How to Make a Request

Submit requests to jeff@rateguardpro.ca. We will verify your identity and respond within thirty (30) days. In complex cases, we may extend this period by an additional thirty (30) days with notice.

11.6 Client Requests

If you are a Client whose information was uploaded by a User, please contact the mortgage professional who holds your information directly. If you contact us, we will direct your request to the relevant User and assist them in responding.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly.

13. Complaints

If you have concerns about our privacy practices, please contact our Privacy Officer at jeff@rateguardpro.ca. We will investigate and respond to your complaint within thirty (30) days.

If you are not satisfied with our response, you may file a complaint with:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

13.1 Quebec Residents (Law 25)

Where Quebec's Act respecting the protection of personal information in the private sector (Law 25) applies, Quebec residents may have additional rights, which can include the right to be informed about automated processing and to request portability of their information. Quebec residents who are not satisfied with our response may also contact the Commission d'acces a l'information du Quebec.

14. Data Breach Notification

In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm to individuals, we will:

• Notify the Office of the Privacy Commissioner of Canada as soon as feasible
• Notify affected individuals as soon as feasible, including a description of the breach, the types of information involved, and steps individuals can take to protect themselves
• Notify any affected Users (brokers) whose Client Data may have been involved
• Maintain records of the breach for at least twenty-four (24) months

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on our website and, where appropriate, sending an email to the address associated with your account at least thirty (30) days before the changes take effect.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us:

Mudrick Technologies Inc.
Privacy Officer
Email: jeff@rateguardpro.ca
Website: https://rateguardpro.ca

This Privacy Policy was last updated on June 10, 2026.