Privacy notice

Data residency

Production databases and file storage run in Supabase AWS ca-central-1 (Canada). We do not mirror borrower PII to US regions for application data.

Purposes we collect for

• Operating renewal retention workflows for your brokerage (contact, plans, compliance records).
• CASL consent tracking and proof of send for commercial electronic messages.
• MSA-aligned supervision, activity records, and exports your principal broker may require.
• Billing, security logging, and product analytics when you opt in via your brokerage admin.

Brokerage data processing agreement

Brokerages act as controllers for borrower data; LoopSuit AI is the processor. Request a standard DPA for your compliance file: privacy@loopsuit.ai.

Retention

Brokerages configure retention for compliance exports (default aligns with MSA record-keeping expectations). Billing and security logs are kept only as long as needed for operations and dispute resolution.

Sub-processors

We use infrastructure providers that process data in Canada where available: Supabase (database and auth), Resend (email delivery when configured), Twilio (SMS when configured), Stripe (billing when configured), and optional observability (Sentry, PostHog) only when your brokerage enables those keys.

Breach notification

If we become aware of a breach of security safeguards involving personal information, we will notify affected brokerages without unreasonable delay and cooperate with your PIPEDA breach record obligations.

Access, correction, and deletion

Borrowers and brokers may request access or correction. Deletion requests are honoured where legal retention does not require otherwise (e.g. MSA supervision records). Brokerage admins can export data from Data & export in the app.

Questions

Privacy Officer, LoopSuit AI Inc. — privacy@loopsuit.ai. You may also contact the Office of the Privacy Commissioner of Canada for unresolved concerns.