Privacy Policy

Preamble

This Privacy Policy is issued by Vertus Stanley, a sole proprietor residing at 3105 Promenade du Quartier-Saint-Martin, Laval, Quebec H7T 0N7, doing business under the trade name Hypora, registered with the Quebec Enterprise Registrar under NEQ 2275462044 (collectively "Hypora", "we", "our" or "us").

This Policy explains how Hypora collects, uses, discloses, retains and protects personal information when you use our software and services. It applies to all users of the platform, including subscribing mortgage brokers and end-clients (borrowers) whose information transits our platform under a broker's control.

Hypora complies with the Quebec Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) as amended by Law 25, and with the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

By using our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described.

1.Privacy officer

Pursuant to section 3.1 of the Quebec privacy act, Hypora has designated a privacy officer.

You may contact the privacy officer with any question, concern or request relating to your personal information, including requests for access, rectification, withdrawal of consent, portability, or complaint.

2.Data processing roles

2.1 Broker information

When you register as a subscribing broker, Hypora acts as the controller of your personal information (name, email, license number, billing details, etc.).

2.2 End-client (borrower) information

When a broker uses Hypora to collect, organize and prepare their own client's files, the broker remains the controller of the personal information of those clients. Hypora acts as a service provider (processor) on behalf of the broker, within the meaning of section 18.3 of the Quebec privacy act.

The relationship between Hypora and each broker is governed by a Data Processing Agreement (DPA) forming part of the Terms of Service.

3.Information we collect

3.1 Broker information

When you create and manage your account, we collect:

• Identification: first name, last name, professional title, firm name.
• Contact: professional email address, phone number.
• Professional details: AMF, FSRA or other provincial regulator license number, province of practice, declared years of experience.
• Authentication: password (stored as a cryptographic hash), multi-factor authentication settings, session tokens.
• Billing: name, billing address, payment method (card data is stored directly by our provider Stripe and never retained by Hypora).
• Preferences: language (French or English), notification preferences.
• Usage data: pages visited, features used, files created, usage statistics.
• Technical logs: IP address, browser type, operating system, login timestamps.

3.2 End-client (borrower) information

When a broker invites you to upload documents for a mortgage application, the following information may transit Hypora:

• Identification: first name, last name, date of birth, preferred language.
• Contact: mailing address, email address, phone number.
• Government-issued ID: driver's license, passport, permanent resident card, provincial ID (collected for identity verification under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, PCMLTFA).
• Social Insurance Number (SIN): where required by the broker for specific purposes. We handle SIN with the heightened protections set out in the federal SIN directive.
• Financial data: income, employer, position, tenure, bank statements, paystubs, CRA notices of assessment (T1, T4, T4A, T5), Revenu Québec statements, personal balance sheets.
• Property: address, type, estimated value, purchase offer.
• Co-borrowers: same categories where applicable. We obtain co-borrower consent before any processing.
• Uploaded documents: any document submitted at the broker's request.
• Interaction metadata: upload timestamps, devices used, read receipts.

3.3 Automatically collected data

When you visit our site or use the application, we automatically collect technical information via cookies and similar technologies. Details are in our Cookies Policy.

4.Purposes of collection

4.1 For brokers

• Create, authenticate and manage your account.
• Provide access to platform features.
• Process billing, renewals and cancellations.
• Send transactional communications (confirmations, alerts, receipts).
• Send marketing communications only with your express consent.
• Provide support and respond to inquiries.
• Improve the platform through aggregate usage analytics.
• Detect, prevent and handle fraud and security incidents.
• Comply with legal and regulatory obligations.

4.2 For end-clients

• Enable the broker to collect the documents required for a mortgage application.
• Automatically extract certain non-sensitive information from documents using software tools, to speed up the broker's file preparation. Any extracted data remains under the broker's control and must be validated by the broker.
• Retain identity verification records for the broker's PCMLTFA obligations.
• Ensure the security and traceability of document exchanges between the client and their broker.

We do not collect information beyond what is necessary for these purposes, consistent with the collection-limitation principle (section 5 of the Quebec privacy act and PIPEDA Principle 4).

5.Consent

5.1 Express consent

Where required by law, your consent is obtained expressly, clearly and separately, without pre-ticked boxes or implied consent. You may withdraw consent at any time by emailing contact@hypora.ca.

5.2 End-client consent

When a broker invites you to upload documents, you consent to Hypora processing your information as the broker's service provider. You may withdraw this consent by contacting your broker, who will delete the records subject to their own legal retention obligations (notably under the PCMLTFA).

5.3 Marketing communications

Under Canada's Anti-Spam Legislation (CASL), we only send promotional communications to persons who have expressly consented. Every communication includes a clear, free unsubscribe mechanism.

6.Data location

• The primary database and file storage are hosted by Supabase in the ca-central-1 region (Montreal, Quebec).
• Application infrastructure is deployed by Vercel in the yul1 region (Montreal, Quebec).
• Encrypted backups are retained in Canada.

Certain processing activities may involve transfers outside Canada, described in section 7. In accordance with section 17 of the Quebec privacy act (as amended by Law 25), Hypora performs a privacy impact assessment before any transfer outside Quebec and ensures the recipient offers an adequate level of protection.

7.Sub-processors and recipients

Hypora uses the following sub-processors to operate the platform. Each is bound by contractual confidentiality and security obligations equivalent to those of Hypora.

Transfers outside Canada: processing by Anthropic, Stripe and Resend may involve transmission to the United States. Hypora has signed a data processing agreement with each, including contractual clauses providing a level of protection comparable to that required under Canadian law.

New sub-processor: we will notify you by email at least 30 days before adding a new sub-processor with access to personal information. You may object to the transfer if its terms do not suit you.

8.Retention

We retain your personal information only for as long as necessary for the purposes for which it was collected, or for the minimum period required by law.

After these periods, information is securely destroyed or irreversibly anonymized.

9.Your rights

Under Law 25 and PIPEDA, you have the following rights.

9.1 Right of access

You may confirm that we hold your information and obtain a copy in an intelligible format.

9.2 Right of rectification

You may request correction of inaccurate, incomplete or ambiguous information.

9.3 Right to de-indexing and cessation of dissemination

You may request the cessation of dissemination or de-indexing of your information where dissemination contravenes a law or court order, or causes serious harm to your privacy.

9.4 Right to portability

For information you have provided to us, you may request to receive it in a structured, commonly used technological format, or to have it transmitted directly to another organization.

9.5 Right to withdraw consent

You may withdraw consent at any time, subject to applicable legal retention obligations.

9.6 Automated decisions

Hypora does not make any automated decision producing legal effects on individuals. AI is used only as a data-entry aid for the broker, who remains the sole decision-maker.

9.7 How to exercise your rights

Send a written request to contact@hypora.ca specifying the nature of your request and attaching reasonable proof of identity. We will respond within 30 days.

9.8 Right to complain

If you are dissatisfied with our handling, you may file a complaint with:

• Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca — 418-528-7741.
• Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca — 1-800-282-1376.

10.Security

Hypora implements technical, physical and administrative safeguards to protect personal information against loss, unauthorized access, disclosure, alteration or destruction.

Technical measures

• AES-256 encryption at rest.
• TLS 1.3 encryption in transit.
• Strong authentication and multi-factor options.
• Tenant-level isolation via Row-Level Security.
• Continuous monitoring and audit logs.
• Encrypted, regularly tested backups.

Administrative measures

• Access limited to authorized personnel under the principle of least privilege.
• Ongoing privacy and security training.
• Documented incident response procedures.
• Periodic risk assessments.

Despite all precautions, no electronic transmission or storage is fully secure, and we cannot guarantee absolute security.

11.Privacy breach

Under section 3.5 of the Quebec privacy act, in the event of a breach presenting a risk of serious harm, Hypora will:

• notify the CAI diligently;
• notify affected individuals and any third party who may reduce the risk;
• maintain an incident register, available upon request to the CAI.

We commit to notifying our broker clients of a breach within 72 hours of discovery, so they can meet their own obligations.

12.Minors

Our services are intended for adult professionals and their adult clients. We do not knowingly collect minors' information. If you believe a minor has provided information, contact us for deletion.

13.Cookies and trackers

Our site uses cookies and similar technologies. Details (categories, purposes, duration, consent management) appear in our Cookies Policy.

14.Changes to this policy

We may amend this Policy to reflect changes in our practices, services or applicable law. Material changes will be communicated by email to active accounts at least 30 days before effective date, unless law requires a faster effective date.

15.Governing law

This Policy is governed by the laws in force in the Province of Quebec and the federal laws of Canada applicable therein. Any dispute will be brought before the courts of the judicial district of Montreal, subject to administrative remedies before the CAI or OPC.

16.Contact us