Privacy Policy

1. Who We Are & Scope of This Policy

This Privacy Policy explains how Treadstone Associates (“Treadstone,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information in connection with Engage, our platform for licensed mortgage brokers.

This policy is written with reference to Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and Canada’s anti-spam legislation (“CASL”). It applies to information collected through the Engage platform, including information about broker accounts and information about brokers’ clients that is synced into Engage from connected third-party systems.

Engage is a business-to-business tool used by licensed mortgage brokers. Brokers are our direct customers. Where this policy discusses “your clients” or “client data,” it refers to end clients of the broker using the Service, whose information the broker has connected to Engage.

2. Information We Collect

2.1 Broker account information

When you create and use an Engage account, we collect information such as your name, work email address, brokerage name, licensing details, login credentials, and account preferences (including your sending-mode preference under Section 7 of our Terms of Service).

2.2 Client contact and mortgage information

When you connect Newton Velocity, Finmo, Scarlett, or another supported Connector, Engage syncs relevant client and mortgage-related data from that system, which may include your clients’:

• names, email addresses, and phone numbers;
• mortgage details such as lender, rate, term, renewal or maturity dates, balance, and property information; and
• other information your Connector makes available that is relevant to identifying renewal or refinance opportunities.

We collect this information because you, as the broker, have connected it to Engage for the purposes described in this policy. We do not collect this information directly from your clients.

2.3 Usage and technical information

We also collect standard technical information generated through use of the Service, such as log data, device and browser information, and interaction data (for example, when a client opens or clicks a link in an Engage-generated email), which helps us operate, secure, and improve the Service.

3. How We Use Information

We use the information described above to:

• operate and provide the Service, including syncing and analyzing connected client data;
• generate client mortgage reports and identify renewal or refinance opportunities within a broker’s book;
• send marketing communications to a broker’s clients on the broker’s behalf, as described in Section 5;
• provide customer support to brokers;
• maintain the security, integrity, and reliability of the Service; and
• understand aggregate usage patterns to improve and develop Engage’s features.

At this time, Engage generates client communications using automated templates and does not send client personal information to any third-party artificial intelligence provider for processing. If we introduce AI-powered features that process client data with a third-party AI provider, we will update this policy and provide notice before doing so.

4. CASL & Marketing Emails

The client reports and outreach emails generated by Engage are marketing communications sent on the broker’s behalf. Each such message:

• identifies the sender — either the broker, Engage/Treadstone acting for the broker, or both, depending on the broker’s configured sending mode;
• provides a working unsubscribe mechanism that will be honoured within the timeframe required by CASL; and
• where applicable, includes the broker’s reply-to address so recipients can respond directly.

Responsibility for consent.Brokers are responsible for obtaining and maintaining the consent required under CASL and other applicable law before connecting client contact information to Engage or having Engage send communications to their clients. Treadstone provides the infrastructure used to send and manage these communications, including unsubscribe processing, but does not independently obtain consent from a broker’s clients.

5. How We Share Information

We do not sell personal information. We share information only as needed to operate the Service, including with the following categories of service providers, each acting under contractual obligations consistent with this policy:

We may also disclose information where required by law, to enforce our Terms of Service, to protect the rights, safety, or property of Treadstone or others, or in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

6. Where Your Data Is Stored

Engage’s infrastructure is hosted in the United States. Application data is stored via Supabase on AWS infrastructure located in the AWS us-east-1 region, the application runs on Vercel, and outbound email is sent through AWS SES. Personal information processed through Engage is stored and processed in the United States, not in Canada. While information is held outside Canada, we handle it in a manner aligned with PIPEDA’s requirements, including with respect to safeguards and accountability, regardless of where it is processed.

By using Engage or connecting client data to it, brokers acknowledge that their clients’ personal information will be transferred to and stored in the United States, and agree to inform their clients of this where required by their own professional or legal obligations.

7. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business purposes, including:

• broker account information, for the duration of the account plus a reasonable period afterward for administrative and legal purposes;
• client contact and mortgage information, for as long as the broker’s account remains connected to the relevant data source, or until the broker disconnects or deletes it; and
• certain records relating to client communications and mortgage-related activity, for up to seven (7) years, to help meet recordkeeping expectations common to mortgage brokering and applicable regulatory requirements.

Where information is no longer needed, we take reasonable steps to securely delete or de-identify it, subject to the retention periods above.

8. Security

We apply administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, or disclosure, including encryption of data in transit and at rest, access controls, and reliance on reputable infrastructure providers (AWS, Supabase, Vercel) that maintain their own security programs. No system is completely secure, and we cannot guarantee absolute security, but we work to maintain safeguards appropriate to the sensitivity of the information involved.

9. Your Privacy Rights Under PIPEDA

Individuals whose personal information is processed through Engage (including a broker’s clients) have rights under PIPEDA, including the right to:

• access the personal information we hold about them;
• request correction of inaccurate or incomplete personal information;
• withdraw consent to certain uses of their personal information, subject to legal or contractual restrictions and reasonable notice; and
• file a complaint with the Office of the Privacy Commissioner of Canada if they believe their privacy rights have been violated.

Because brokers are typically the party responsible for their clients’ personal information, client requests relating to access, correction, or consent withdrawal should generally be directed to the broker in the first instance. Treadstone will support brokers in responding to such requests as needed, and will also respond directly to individuals who contact us, forwarding requests to the relevant broker where appropriate.

The Office of the Privacy Commissioner of Canada can be reached at priv.gc.ca.

10. Children

Engage is a business tool intended for use by licensed mortgage professionals and is not directed to, or knowingly used by, anyone under the age of 18. We do not knowingly collect personal information directly from individuals under 18 through the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will provide reasonable notice, such as by email or an in-app notice, before the changes take effect. The “Last updated” date at the top of this policy reflects the most recent revision.

12. How to Contact Us

Questions, concerns, or requests relating to this Privacy Policy or your personal information can be directed to:

privacy@treadstoneassociates.ca (confirm this address before publishing)
Treadstone Associates

Engage — a product of Treadstone Associates · engageai.treadstoneassociates.ca