Acolyte-Ai

Privacy Policy

Effective September 30, 2026

This Privacy Policy explains how 1001716456 Ontario Inc. (o/a Acolyte-Ai), 124 Crompton Dr, Barrie, ON L4M 6N9 ("we", "us", "our") collects, uses, stores, and protects information in connection with our mortgage-brokerage software platform (the "Service"). We are committed to handling personal and financial information responsibly and in accordance with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who this policy covers

The Service is a business tool used by mortgage brokers and their invited partners (realtors, lawyers) and clients. It applies to:

Broker / partner users who create accounts to use the platform.
Client information that a broker enters or uploads to work on a mortgage application.

2. Information we collect

Account information — name, email, role, and profile details you provide when signing up.
Mortgage application data — information brokers enter or import about deals and clients (e.g. applicant details, income, property, mortgage terms) to provide brokerage services.
Documents — files a broker chooses to upload (e.g. income documents) for processing.
Payment information — subscription billing is handled by Stripe; we receive limited billing metadata (status, plan, customer/subscription identifiers) but never see or store your full card number.
Usage data — basic technical logs needed to operate and secure the Service.

3. How we use information

To provide, maintain, and improve the Service.
To perform mortgage-related calculations (e.g. qualification, income analysis, refinance opportunities) requested by the broker.
To process subscription payments and manage accounts.
To communicate with you about your account and support requests.
To protect the security and integrity of the Service and comply with legal obligations.

4. Artificial-intelligence processing

Some features use a third-party AI provider (Anthropic) to read documents and assist with calculations. When a broker uses these features:

Data is transmitted securely to the AI provider only to perform the requested task and return a result.
Your data is not used to train AI models.
The AI provider may retain inputs and outputs for a limited period for operational and abuse-prevention purposes and then deletes them; we do not use a "zero-retention" arrangement at this time.
While your data is stored in Canada, this AI processing currently takes place in the United States. Data is sent transiently only to perform the task; we are working toward a Canada-based, zero-retention AI arrangement.
We minimize sensitive data sent for AI processing and mask identifiers such as Social Insurance Numbers in AI outputs.

5. How information is stored and secured — hosted in Canada

Application data, uploaded documents, and user accounts are stored in our infrastructure provider (Supabase) in the AWS Canada Central region (Montréal, Québec), so your information resides in Canada. Data is protected with industry-standard encryption in transit and at rest, with access controls that restrict data to the broker who owns it and their explicitly invited participants. We apply row-level security so users can only access records they are authorized to see.

6. Payment processing

Subscription payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Card details are entered on Stripe's hosted checkout and are handled entirely by Stripe — they never pass through or reside on our servers. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.

7. Sharing of information

We do not sell personal information. We share information only with service providers that help us operate the Service (such as our hosting, AI, and payment providers described above), each bound to protect it, and only as needed to provide the Service — or where required by law.

7a. Our service providers (sub-processors)

We rely on the following trusted providers to operate the Service. Each is bound by contract to safeguard personal information and to process it only to provide the Service. We keep this list current; the latest version is also available on request.

Supabase — database, authentication, and file storage, hosted in Canada (AWS ca-central-1, Montréal).
Stripe — subscription payment processing (United States / Canada).
Brevo — transactional and notification email delivery (European Union).
Anthropic — AI processing for document analysis and the underwriting assistant, under an agreement that prohibits training on your data (United States; see Section 4).
Netlify — web-application hosting and content delivery (United States / global edge network).
Microsoft 365 — our business and support email (Canada).

8. Data retention

We retain account and application data for as long as an account is active or as needed to provide the Service, and thereafter only as required to meet legal, regulatory, or legitimate business obligations. Brokers may request deletion of data they control.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and may withdraw consent for certain processing. To make a request, contact us using the details below.

9a. Challenging our compliance & making a complaint

If you have a question or concern about how we handle your personal information, please contact our Privacy Officer first (see Section 11) — we will investigate and respond. If your concern is not resolved to your satisfaction, you have the right to file a complaint with the applicable privacy regulator:

Office of the Privacy Commissioner of Canada (OPC)
30 Victoria Street, Gatineau, QC K1A 1H3
Toll-free: 1-800-282-1376 · Website: www.priv.gc.ca

Information and Privacy Commissioner of Ontario (IPC)
2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
Toll-free: 1-800-387-0073 · Website: www.ipc.on.ca

If you reside in another province (for example, Québec, under Law 25), you may also contact your province's privacy regulator.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

11. Contact us

We have designated a Privacy Officer responsible for the protection of personal information and for handling privacy questions and requests (including under Québec's Law 25). Questions or requests about privacy can be sent to:

Privacy Officer: Michael Brooks, for 1001716456 Ontario Inc. (o/a Acolyte-Ai)
Email: support@acolyte-ai.ca
Support: Customer Support