Privacy policy

This policy describes how DeepFlow handles personal information in connection with its automation platform for mortgage brokers, in accordance with Québec’s Act respecting the protection of personal information in the private sector (“Law 25”).

1. The company

9571-4820 Québec inc. (“DeepFlow”) is a Québec company registered under Québec enterprise number (NEQ) 1182338427, with its establishment located at D1208-5111 Sherbrooke Street East, Montréal, Québec H1T 4B5.

DeepFlow provides an automation platform used by Québec mortgage brokers to collect from their clients the information and documents related to a mortgage application (through a smart form, text exchanges and a secure document upload space), and then to sort and structure them in the broker’s tools.

2. DeepFlow’s role

DeepFlow acts on behalf of the broker. The broker determines what information is requested and the purpose for which it is collected; DeepFlow processes it only to provide this service to the broker, according to the broker’s instructions and under a written agreement with the broker.

DeepFlow is therefore a service provider (mandatary) within the meaning of section 18.3 of Law 25, and the broker remains the person responsible for their clients’ personal information. Any question about a mortgage file should be directed to the broker.

3. Information processed

Depending on what the broker asks of their client, this may include: name and contact details, information on employment and income, the down payment and financial situation, information on the property and the project (purchase, pre-qualification, refinance or renewal), the supporting documents uploaded (identification, proof of income, statements, notices of assessment) and the information extracted from them, the terms of the loan obtained (lender, amount, rate, renewal date), as well as the content of text exchanges with the qualification assistant. Some of this information is sensitive within the meaning of Law 25 and is handled with particular care.

4. Purposes of processing

Information is processed only to: receive and structure the form answers; receive the documents requested by the broker, sort them automatically and extract the relevant information; produce the PDF file sent to the broker; create and fill in the file in the broker’s tools (their CRM and mortgage software); qualify inquiries by text exchange and schedule appointments; produce a borrowing-capacity estimate and a file score; pick out, from the emails the broker receives from lenders, the decisions and conditions that concern the file; help the broker draft their compliance notes; send reminders related to the file; and, on the broker’s behalf, contact their clients as their renewal approaches, when rates move or on their loan anniversary, and request a review once the file is completed.

Automated processing assists the broker; it does not decide. No decision about a person is made exclusively by an automated system: the broker verifies and decides.

DeepFlow never sells personal information, does not use it for any advertising purpose and does not use it to train artificial intelligence models.

5. Consent

Information is provided voluntarily by the person concerned, as part of the process undertaken with their broker, by filling out the form or replying to text messages. Consent may be withdrawn at any time by contacting the broker or DeepFlow (section 11); some services may then no longer be available. Every automated message explains how to opt out: just reply STOP to a text message, or ask the broker. This choice applies to both text messages and emails.

6. Sharing of information

Information is shared with the broker concerned and with a small number of service providers that run the platform on DeepFlow’s behalf: data hosting, sending of emails and text messages, and artificial intelligence analysis (document sorting, file qualification and scoring, reading of lender responses).

These providers are bound by written agreements, may use the information only to deliver their service to DeepFlow, and may under no circumstances use it for their own purposes or to train models. No personal information is disclosed to third parties outside this framework.

More details are published on the Hosting and providers page.

7. Hosting of information

Documents and the database are hosted in Canada. Some services needed to operate the platform (sending of text messages and emails, task scheduling and part of the artificial intelligence processing) are performed outside Québec, including in the United States; these communications are governed by written agreements and are subject to the assessment required by section 17 of Law 25.

Once transmitted, the information also resides in the broker’s tools (their CRM, mortgage software and inbox), which the broker manages in their own accounts and in accordance with their professional obligations.

8. Retention period

DeepFlow keeps the documents and the information extracted from them for as long as needed to process the file, then destroys them automatically, about 120 days after they are received; the broker may extend this period once, by 60 days. A minimal log, from which personal information is erased on the same schedule, is kept for audit purposes. A client record (name, contact details and loan terms, with no documents) remains in the broker’s workspace for renewal follow-up; it is deleted at the request of the person concerned or of the broker. The register of people who have asked not to be contacted again is kept, so that this choice continues to be respected.

The broker is still required to keep certain files longer under their own legal obligations; that retention is the broker’s responsibility and takes place in the broker’s own tools.

9. Safeguards

DeepFlow applies security measures proportionate to the sensitivity of the information, as required by Law 25, including: encryption of data at rest and in transit, hosting of documents and the database in Canada, restricted access segregated by broker, verification of the client’s identity by one-time code, and logging of actions. No measure is infallible.

10. Rights of the persons concerned

Subject to the law, any person concerned may: access the information held about them, request that it be corrected, request that it be deleted, obtain a copy in a structured technological format (portability) and withdraw their consent. Requests are answered within the time limits set by law, generally 30 days. When a request concerns a mortgage file, it should first be addressed to the broker, who is the person responsible for that information; DeepFlow assists the broker in responding and forwards to the broker any request it receives directly.

11. Exercising a right and contacting us

Any question or request may be sent to DeepFlow’s privacy officer (the person in charge of the protection of personal information):

Email: deepflow_ai@outlook.com

12. Information for which DeepFlow itself is responsible

DeepFlow is responsible for the information it collects for its own purposes: the contact details and login credentials of brokers and their users, questions asked to the platform’s help assistant, the technical data needed for support and security, and messages received through the website. This information is used to provide and secure the service, and is kept for the duration of the business relationship. For this information, the rights described in the previous section are exercised directly with DeepFlow.

13. Cookies

The website uses only the cookies that are essential to its operation and to session security. No advertising tracking tools are used.

14. Changes

This policy may be updated. The effective date shown above corresponds to the current version; any significant change is flagged.