This Privacy policy explains how Pathway Mortgage Agency Limited (“Pathway,” “we,” “us”) collects, uses, stores, shares, and protects information in connection with the Mortgage Data Mining Tool (“MDMT,” the “Service”), available at mdmt.pathwaymortgage.ca. MDMT is a customer-relationship and analytics tool used by licensed Canadian mortgage agents and brokerages.
MDMT is a business tool used by mortgage professionals (“Agents”). It is not intended for use by consumers directly, and it is not directed to children.
When an Agent creates an account, we collect their name, email address, mortgage licence details (for regulatory verification), business/brokerage information, and authentication data (a securely hashed password and, where enabled, two-factor authentication details). To verify a licence, we also ask for images of the front and back of a government-issued ID and a proof of licence. We delete those images once the licence is approved, or 30 days after it is declined; we keep a record of the check itself (who reviewed it, when, and the licence number). If you send us an idea or report a problem from inside MDMT or MUT, we keep what you wrote with your account email and the date, so we can follow up. We delete it 24 months after you send it, or when your account is closed.
Agents import and store information about their own mortgage clients (such as names, contact details, mortgage balances, rates, lenders, and renewal dates) in order to analyze their book of business. An Agent may also record notes and a follow-up status for a client, whether and when the client agreed to receive text messages, and income and investment figures entered in the planning calculators. For every email an Agent sends a client from MDMT, whether or not email tracking is on, we record who sent it, the client's name and email address, the type of message, the subject, the time, and whether it was sent. When an Agent sends a client a text message from MDMT, we keep the message, the client's mobile number, the time and whether it was delivered, and we keep any reply the client sends. A reply of STOP is recorded so that no further texts are sent. Details read from a mortgage statement the Agent provides are used to fill in the client's record. Agents are responsible for the client information they upload and for having the necessary rights and consents to do so. Pathway processes this information on the Agent’s behalf.
Agents may also use MUT, Pathway's mortgage application workspace, to prepare and submit a client's mortgage application to a lender. A MUT file can hold: identity and contact details (including date of birth); household details (marital status, dependants and residency status); employment and income; details from the client's credit report, such as the score and existing debts; assets, including the source of a down payment; the properties involved; the mortgage requested; documents the Agent adds to the file, such as bank statements, income documents, appraisals and purchase agreements; and contact details for others involved in the file, such as a referrer or the client's lawyer. MUT does not ask for a social insurance number, and does not copy one from a credit report into the file. A MUT file also records that the Agent has completed the identity verification and the anti-money-laundering risk assessment that Canadian law requires for each application. A MUT file, and every document attached to it, can be opened by the Agent who owns it, by each person that Agent or a Pathway administrator has added to the file, and by Pathway's administrators. As with other client information, Agents are responsible for having the necessary rights and consents, and Pathway processes this information on the Agent’s behalf.
We collect standard technical data such as IP address, browser type, and timestamps for security, auditing, and reliability.
When email tracking is switched on, emails an Agent sends to clients from MDMT, whether through a connected mailbox or our email-delivery provider, carry a one-pixel image and links that pass through MDMT, so the Agent can see whether a message was opened and which links were clicked. For each open or click we record the time, the link clicked, a one-way hash of the recipient’s IP address (never the address itself) and a shortened browser identifier. These records are encrypted at rest.
If an Agent chooses to sign in with Google or Microsoft, we receive basic profile information (name and email address) to create or access their account. If an Agent chooses to connect their mailbox to send client email from their own account, we receive an authorization token from Google or Microsoft. See Section 4 for exactly how Google user data is handled.
We do not sell personal information, and we do not use client information for advertising.
Connecting a mailbox is optional. When an Agent connects their Gmail or Microsoft mailbox, MDMT can send the client emails that the Agent composes within MDMT from the Agent’s own mailbox, so those messages appear in the Agent’s Sent folder and reach clients with strong deliverability. If an Agent does not connect a mailbox, client email is sent through our default email delivery provider instead.
Send-only, never read. When you connect a Google mailbox, MDMT requests a single Gmail permission - https://www.googleapis.com/auth/gmail.send - which lets MDMT send email on your behalf. MDMT does not read, scan, index, search, download, or store the contents of your Gmail inbox or any messages, other than sending the specific emails you compose and choose to send within MDMT.
gmail.send scope), and your basic profile (email/name) to identify the connected mailbox.MDMT’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
If you connect a Microsoft / Outlook mailbox, MDMT requests only the permission required to send mail on your behalf (Microsoft Graph Mail.Send). The same handling described in Section 4 applies: send-only, tokens stored encrypted and used solely for sending, never used to read your mailbox, and revocable at any time from MDMT or your Microsoft account security settings.
We share information only with service providers that help us run the Service, under contract and only as needed, including: our email-delivery provider (for messages not sent through a connected mailbox), our payment processor, Stripe, which would handle billing if paid plans are introduced (MDMT is free for licensed agents today and no subscription is charged; we never store full card numbers), our cloud hosting provider, and Canada Post, whose AddressComplete service suggests addresses as an Agent types a property address. Twilio (United States) carries the text messages an Agent sends from MDMT and the replies, and receives the client's mobile number and the text of each message. Some features send client information to a service the Agent chooses to connect. Trello (Atlassian, United States) receives a card for each file an Agent syncs to their own Trello board, carrying the client’s name, contact details, loan figures and up to 500 characters of the Agent’s notes. Velocity (Newton, Canada) receives the borrower’s name, email address and mobile number when an Agent confirms that a deal is created there. Finmo (Canada) is only read from, using the Agent’s own Finmo key. We may disclose information if required by law or to protect rights, safety, and security. We do not sell personal information.
Information is stored on secured servers. Sensitive data, including client information and connected-mailbox tokens, is encrypted at rest. We apply access controls, auditing, and other safeguards. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard measures. The data we hold ourselves is stored in Canada: on our server in Toronto, Ontario, and in encrypted backups kept in Canada with Amazon Web Services. Your information may be stored or processed outside Quebec. Our server is in Toronto, Ontario, and some of the service providers we use may store or process information elsewhere in Canada or in the United States.
We retain account and client information for as long as an Agent maintains their account and as needed to provide the Service, then delete or anonymize it within a reasonable period, except where longer retention is required by law or for legitimate business or regulatory purposes. Connected-mailbox tokens are deleted when you disconnect the mailbox or close your account. Our web server's request logs (IP address, browser type, and the date, time and web address of each request) are kept for about two weeks.
Agents can access and update their account information in the Service, disconnect a mailbox at any time, and request access to or deletion of their personal information by contacting us. Mortgage clients who wish to exercise rights regarding information held by an Agent should contact that Agent; we will assist the Agent as the data processor where applicable. We handle personal information in accordance with applicable Canadian privacy law (including PIPEDA).
You may withdraw your consent to our collection, use or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. We will tell you what withdrawing means for you, for example that we may no longer be able to provide some or all of the Service. To withdraw, contact us using the details at the end of this policy. If you are a client of an Agent who uses MDMT, you can also ask that Agent.
We may update this Privacy policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.
Questions about this Privacy policy or our data practices:
Pathway Mortgage Agency Limited
Level 2 Mortgage Agent services provided through Get A Better Mortgage Inc., FSRA Licence #10874 (verify on the FSRA registry)
Attention: Privacy Officer
Toronto, Ontario, Canada
Email: info@pathwaymortgage.ca
Web: pathwaymortgage.ca