How we protect personal information.

01Scope of This Policy

This Policy applies to personal information collected through our Website, our software-as-a-service platform (the “Platform”), client consent portals, and our electronic communications. It also applies to personal information we collect from you by email, phone, in person or when you otherwise interact with us. However, it does not apply to third-party websites, services, or applications that may be linked from or integrated with our Platform.

Where this Policy conflicts with a signed agreement between Autowrite and a Broker (including the Data Processing Agreement), that agreement governs the processing of borrower data.

02Key Definitions

• Personal information - any information that identifies, relates to, describes, is about, is capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual.
• De-identified information - information that no longer directly identifies an individual but could, in some circumstances, be used to re-identify them. Such information is still considered personal information.
• Anonymized information - information with respect to which it is reasonably foreseeable that it irreversibly no longer allows the person to be identified directly or indirectly. Such information is no longer considered personal information.
• Controller - the licensed mortgage brokerage or agent that determines the purposes and means of processing personal information.
• Processor - Automata, which processes personal information on the Controller’s behalf.

03Our Role: Controller and Processor

Our obligations depend on whose information we handle and why:

• Borrower personal information uploaded by a Broker. The Broker is the Controller and Autowrite acts solely as the Processor, processing that information only on the Broker’s documented instructions under our Data Processing Agreement. In circumstances where we process personal information on behalf of a Broker, this Policy does not apply. Instead, that processing is subject to that Broker’s privacy policies. If we are processing your information on behalf of a Broker, please contact that Broker if you have any questions about their policies or personal information handling practices.
• Information about Website visitors, prospects, and account administrators. For this limited category of personal information, Autowrite acts as the Controller and is directly responsible under this Policy.

04Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Identity data - name, date of birth, residential address, and government-issued identifiers.
• Financial data - income details, tax forms, pay stubs, bank statements, and related documentation.
• Property data - purchase agreements, leases, and property tax bills.
• Contact data - email address, telephone number, and brokerage details.
• Account & usage data - login credentials, role, audit-log activity, and platform usage.
• Technical data - IP address, device and browser information, and cookies (see our Cookie Policy).

Much of the financial information we process is sensitive, and we apply heightened safeguards to it accordingly.

05How We Collect Personal Information About You

We use different methods to collect your personal information, including through:

• Direct interactions: When you provide personal information to us, for example, by filling in forms or corresponding with us by phone, email, in person or otherwise.
• Automated technologies or interactions: As you navigate through our Website or use the Platform, we may automatically collect information, including technical information.
• Mortgage brokers and brokerages: We may collect personal information indirectly from mortgage brokers, mortgage agents, brokerages, and their authorized representatives who use our Platform to manage mortgage applications and related documentation on behalf of their clients. This may include personal, financial, employment, identification, and other information provided by borrowers to their mortgage professionals.
• Borrowers and co-applicants: We may collect personal information through secure document collection links, borrower portals, electronic forms, and other information collection tools made available by mortgage professionals using our Platform.
• Third-party platforms and integrations: We may receive personal information from third-party mortgage origination systems, customer relationship management platforms, document management systems, and other integrated services where authorized by the relevant user or organization.
• Documents and uploaded files: We may collect and process personal information contained in documents uploaded to our Platform by mortgage professionals, borrowers, or their authorized representatives. These documents may include identification documents, income verification, employment records, bank statements, tax documents, credit reports, mortgage applications, and other supporting financial documentation.
• Authorized third parties: We may receive personal information from other individuals or organizations authorized to provide information in connection with a mortgage application, including co-applicants, employers, accountants, financial advisors, and other professional representatives.
• Third-party service providers: We may collect limited personal information through service providers that support the operation of our Platform, including authentication providers, payment processors, electronic signature services, customer support systems, and analytics providers.

06How We Use Personal Information

We use personal information only for the purposes for which it was collected, including:

• preparing and assembling mortgage application documentation on a Broker’s instructions;
• performing automated document intake, classification, and data extraction;
• supporting Broker-side compliance and audit workflows;
• providing, securing, maintaining, and improving the Platform;
• delivering technical support and service-related communications;
• detecting, preventing, and investigating fraud, abuse, and security incidents;
• meeting our legal, regulatory, and contractual obligations;
• to enforce or apply our Terms of Use and other agreements with you, or to protect the rights, property or safety of Automata, our customer or others; and
• for any other purpose with your consent.

We do not sell personal information, and we do not use it for unrelated purposes or for advertising profiling.

07Consent

For borrower information, we rely on the informed consent obtained by the Broker before any information is uploaded to the Platform. For our own business contacts, we rely on consent or legitimate business purposes permitted by applicable law. We seek express consent for sensitive information and may rely on implied consent only where appropriate and permitted by applicable law.

Consent may be withdrawn at any time by contacting the relevant Broker or Autowrite, subject to legal and contractual restrictions. Withdrawal may affect a Broker’s ability to proceed with a mortgage application. Please note that withdrawing your consent will not affect the legality of our processing of your personal information prior to such withdrawal.

08Cookies and Similar Technologies

We use cookies and similar technologies to enable core functionality, analyze usage, and remember your preferences. Non-essential cookies are used only with your consent. Full details are set out in our Cookie Policy, and you can change your choices at any time through our cookie preferences centre.

09Disclosure of Personal Information

We may disclose personal information that we collect or you provide as described in this Policy, including:

• to the Broker that engaged us, and to lenders, mortgage insurers, or other parties as directed by that Broker;
• to contractors, service providers, and other third parties we use to support our business (such as analytics and search engine providers that assist us with Website improvement and optimization) and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this Policy;
• to comply with any court order, law, regulation, investigation, subpoena, order of a court, tribunal or other administrative or governmental authority, or legal process, including to respond to any government or regulatory request, in accordance with applicable law;
• to fulfill the purpose for which you provide it;
• for any other purpose disclosed by us when you provide the personal information;
• to enforce or apply our Terms of Use and other agreements with you; and
• to law enforcement or a government institution in order to investigate fraud or potential fraud, as well as any other violation of a law, regulation, or the terms and conditions of use of our Website or any agreement with you in connection with the products or services we provide you, and/or in order to protect the rights, property, or safety of Autowrite, our customers, or others.

In the event of a corporate transaction such as a merger, acquisition, or sale of assets, personal information may be disclosed to the parties involved, subject to confidentiality protections and continued application of this Policy. Autowrite does not sell, rent, or trade personal information.

10Sub-Processors and Service Providers

We engage a limited number of sub-processors - such as our cloud infrastructure provider in Canada - to deliver the Platform. Each sub-processor is bound by a written agreement (including a data processing agreement) requiring confidentiality and protections equivalent to those described in this Policy. A current list of sub-processors is available to Brokers on request; where required to do so by applicable law, we provide notice of material changes.

11Security Safeguards

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• AES-256 encryption at rest and TLS 1.2 or higher in transit;
• role-based access controls and least-privilege access;
• comprehensive audit logging of file views, downloads, and edits;
• regular vulnerability testing, patch management, and independent penetration testing; and
• confidentiality agreements and mandatory security training for all personnel.

No method of transmission or storage is perfectly secure. While we work hard to protect personal information, we cannot guarantee absolute security, and we disclaim liability for misuse of information by Brokers or third parties outside our control.

12Retention and Deletion

Except as otherwise permitted or required by applicable law or regulation, we retain personal information only as long as necessary to fulfil the purposes for which it was collected or as required by applicable law. As a general guide, borrower documents are retained for the period directed by the Broker; account and billing records are retained for the life of the account and for up to seven (7) years afterward to meet tax and legal obligations; and security and audit logs are retained for twelve (12) months.

Upon a verified request from the relevant Broker or borrower, or upon termination of services, we will delete or return personal information - ordinarily within sixty (60) days - unless a longer retention period is required to meet a legal obligation, in which case we isolate and protect it until deletion is permitted.

Under some circumstances we may anonymize your personal information so that it can no longer be associated with you.

13Your Privacy Rights Regarding Your Personal Information

Subject to certain exceptions, as permitted by applicable law, you may have the following rights with respect to your personal information:

• access the personal information we hold about you and request information about how it is used and disclosed;
• correct inaccurate or incomplete information;
• delete personal information where there is no lawful basis for us to retain it;
• withdraw consent to certain processing, where you have provided your consent to the collection, use, and transfer of your personal information; and
• request portability - where required by applicable law (including Quebec), receive computerized personal information you provided to us in a structured, commonly used technological format.

Borrower requests are generally directed to the Broker as Controller; we assist Brokers in fulfilling them. You may also file a complaint with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or your applicable provincial privacy regulator.

14Automated Processing and Artificial Intelligence

The Platform uses automated processing and artificial intelligence to assist with document intake, classification, and data extraction. These tools support - and do not replace - the professional judgment of the Broker, and we do not make decisions that produce legal or similarly significant effects about an individual solely by automated means.

We do not use borrowers’ documents or personal information to train third-party AI models. Where automated decision-making is used by a Broker through the Platform, the Broker is responsible for any transparency obligations owed to the individual.

15Electronic Communications

By providing your email address or telephone number, you consent to receiving service-related electronic communications necessary to provide the Platform. You may unsubscribe from non-essential communications or withdraw consent at any time; however, we may still send you certain transactional and security messages as permitted by applicable law.

16Children’s Privacy

Our Platform and services are intended for licensed mortgage professionals and adult borrowers. We do not knowingly collect personal information from individuals under the age of 18. If we learn that we have done so without proper authorization, we will delete it.

17Cross-Jurisdictional Transfers of Your Personal Information

While we do not transfer personal information outside of Canada in the ordinary course, we or our service providers may access, process or store your personal information outside of the jurisdiction where we are located and where you reside, including in the United States, where laws regarding the protection of personal information may be less stringent than the laws in your jurisdiction. As a result, when your personal information is used or stored in a jurisdiction other than where you are residing, it may be accessible to law enforcement, national security authorities, and the courts of such jurisdictions.

18De-identification and Anonymization

We may de-identify or anonymize personal information for analytics, research, security, and service-improvement purposes. We do not attempt to re-identify anonymized information, and we apply technical and organizational measures to prevent re-identification of de-identified information.

19Accountability and Openness

We are accountable for personal information under our control. We maintain internal policies and practices (including our Information Security Policy and Data Breach & Incident Response Policy) to give effect to this Policy, train our personnel, and make information about our practices readily available. Our Privacy Officer oversees compliance and responds to inquiries and complaints.

20Third-Party Links

Our Website and Platform may link to third-party sites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy practices to understand how such third parties process your personal information.

21Changes to This Policy

We may update this Policy from time to time. The “Last updated” date and version above reflect the most recent revision. Where required by applicable law, we will communicate material changes through the Website or by email. By continuing to interact with us or using our Website or Platform after the modified version of this Policy has been posted or you have been informed of such update, you agree to be bound by all such changes. If you do not agree to the changes in this Policy, it is your responsibility to stop interacting with us. Previous versions of this Policy are available on request.

22Contact Us

If you have any questions, comments, and requests regarding this Policy and our privacy practices, or to exercise your rights, please communicate with our Privacy Officer using the following contact information:

• Automata Intelligence Inc. (operating as Autowrite)
• Attn: Privacy Officer
• 37 Leadership Drive, Brampton, Ontario L6Y 5T2, Canada
• Email: info@autowrite.ca

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.