Privacy Policy

This Privacy Policy describes how Brkrr Technologies Inc. ("Brkrr", "we", "us", or "our") collects, uses, discloses, and protects personal information when you use our website at brkrr.ca and related services (collectively, the "Platform"). We are committed to protecting your privacy in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

By using the Platform you consent to the collection, use, and disclosure of your personal information as described in this Policy. See our Terms of Service for the rules governing your use of the Platform.

1. Who We Are

Brkrr Technologies Inc. operates the Brkrr mortgage agent directory at brkrr.ca. Our principal office is in Ontario, Canada. For privacy enquiries, please contact our Privacy Officer at privacy@brkrr.ca.

2. Personal Information We Collect

2.1 From consumers

• Name and email address when you create an account
• Mortgage enquiry details when you submit a lead: property type, province, city, purchase price, timeline, credit band, down payment range, employment status, existing debts, pre-approval status, language preferences, and any notes you write
• Communications you send us, including support requests and feedback

2.2 From mortgage agents

• Name, email address, and profile information when you create an account
• Licence number, brokerage name, province, city, specializations, languages spoken, years of experience, lenders worked with, and biography
• Brokerage email address submitted during the licence-claim flow
• Website, LinkedIn, and social media URLs you optionally provide
• Phone number and public contact email you optionally add to your profile

2.3 From provincial regulatory registries

We collect publicly-available mortgage agent and broker licensing information from official provincial regulatory registries, specifically:

• Ontario: Financial Services Regulatory Authority of Ontario (FSRA) public registry
• British Columbia: BC Financial Services Authority (BCFSA) public registry
• Nova Scotia: Service Nova Scotia mortgage broker public registry (via official API)
• Future provinces: The equivalent provincial regulator for each province added to the Platform. This Policy will be updated when a new province is seeded.

The legal basis for this collection is the PIPEDA Regulations Specifying Publicly Available Information (SOR/2001-7). Regulatory licensing records are publicly available for the purpose of enabling consumers to verify that the professionals they engage are licensed. We collect, use, and display this information to directly serve that purpose: allowing consumers to find and verify licensed mortgage agents.

2.4 From OAuth providers

When you sign in via Google or LinkedIn, those providers authenticate you under their own privacy policies. Brkrr receives only your name, email address, and provider-issued identifier. We do not receive your Google or LinkedIn contacts, activity, or any other data beyond what you authorise at sign-in.

2.5 Automatic collection

• Device type, browser type, and operating system
• IP address and approximate geographic location (city/region level)
• Pages visited, search queries run, time on page, and referral source
• Authentication session tokens (stored as secure HTTP-only cookies)

2.6 Quiz, calculator, and tool inputs

The "Am I ready?" mortgage readiness quiz collects: credit band, employment status, income range, down payment range, existing debts, and pre-approval status. Your quiz score and answers are stored server-side when you proceed from the quiz into the get-matched form. This information may be shared with matched mortgage agents as part of your lead context so they can provide a relevant response.

Calculator inputs (mortgage payment, affordability, land transfer tax, closing costs, budget planner) may be carried through to the get-matched form if you click a calculator's "Get matched" option. That data is then treated as part of your lead submission.

Consent note: A clear disclosure is presented on the get-matched form before you submit, confirming that your quiz and calculator answers will be shared with matched mortgage agents. You may clear or modify those inputs before submitting.

3. Why We Collect It

We collect personal information only for the following identified purposes:

• Creating and managing your account and verifying your identity
• Matching consumers with licensed mortgage agents based on province, language, and specialization
• Verifying mortgage agent licences against provincial regulatory registries on claim and via nightly automated checks
• Enabling mortgage agents to respond to matched lead requests
• Sending transactional emails: account confirmations, brokerage verification codes, lead notifications, and licence-status alerts
• Sending commercial electronic messages where you have provided the required consent under CASL (see §10)
• Detecting, investigating, and preventing fraudulent or unauthorized activity
• Improving the Platform through aggregated usage analysis (see §4.5)
• Future product development using aggregated, de-identified data (see §4.6)
• Complying with applicable legal obligations

4. How We Use It

4.1 Operating the matching service

When a consumer submits a lead, we use their personal information to identify up to three verified, licensed mortgage agents whose province, language, and specializations best match the consumer's request, and to deliver the lead to those agents. See §5.2 for what agents see and when.

4.2 Verifying licences

We verify agent licence status against the relevant provincial registry when an agent claims their listing and via nightly automated checks. Licence number, status, and brokerage information are synchronized from the public registry.

4.3 Sending communications

We send transactional emails for account management, claim-flow steps, lead notifications, and licence-renewal alerts. We send commercial electronic messages only with the required consent under CASL (see §10). You may manage your email preferences from your dashboard settings or by using the unsubscribe link in any email we send.

4.4 Detecting fraud and abuse

We use device data, IP addresses, and platform activity to detect and prevent fraudulent account creation, lead manipulation, fake reviews, and unauthorized access.

We also use Cloudflare Turnstile, an invisible bot-detection check, on certain public forms such as the mortgage-enquiry and contact forms. See the Cloudflare row in §5.1 for what Cloudflare processes, and Cloudflare's own privacy notice for Turnstile at cloudflare.com/turnstile-privacy-policy.

4.5 Improving the Platform

We analyse aggregated, de-identified usage data to understand how the Platform is used and to prioritize improvements. We also aggregate unmatch reasons submitted by consumers (when a consumer removes an agent from their matched list) and use the aggregate to identify patterns without retaining any individual consumer identifier in that aggregate.

4.6 Future product development and aggregated data

We may use aggregated, de-identified information for research, market analysis, and product development. We may share aggregated, de-identified information with mortgage industry partners, lenders, or regulators for purposes including market research, lender-product fit analysis, and renewal-cycle outreach analytics. We do not sell information that identifies you individually to third parties for their own marketing purposes without your express consent at the time of collection. See our Terms of Service for full details on how we handle your information.

5. Who We Share It With

5.1 Service providers

We share personal information with the following sub-processors who process data on our behalf under contractual obligations consistent with this Privacy Policy:

Brkrr may add or change sub-processors as the platform evolves. We will update this list and notify users of material changes via the change-notification mechanism described in §14. Material changes include adding processors that handle new categories of personal information (such as identity verification, payment data, or analytics and tracking). Any new material processor requires a Privacy Policy update before being enabled in production.

Identity providers: Google and LinkedIn are identity providers whose terms govern their data use separately. Brkrr receives only your name, email address, and provider-issued identifier at sign-in (see §2.4). Google LLC also processes city search queries and lead location data as described in the Google Maps Platform row in the table above.

5.2 Matched mortgage agents

When a consumer submits a matched lead, the lead is offered to up to three verified mortgage agents in the same province. All three may independently accept the match; the consumer then compares responses and chooses which agent to proceed with.

What matched agents see immediately (before accepting): province, city, lead type, purchase price range, timeline, language preferences, notes you wrote, and your quiz or calculator results if you completed them.

What matched agents see after they accept: your email address and phone number (if you provided one).

Note on contact information timing: Your contact details are shared with an agent after that agent accepts the match, before you select which agent to proceed with. This allows agents to reach out so you can compare their approach. By submitting a lead you consent to this contact by matched agents.

Unmatch reasons:If you remove a mortgage agent from your matched list, the reason you provide is sent to that agent in a notification email and is also recorded in an aggregate counter against the agent's profile for trend analysis. No individual consumer identifier is retained in that aggregate.

Direct leads:If you visit a specific agent's profile and submit a lead directly to that agent, your lead is shared only with that agent.

5.3 Public visibility

Mortgage agent profile pages are publicly visible on the Platform. Consumer information is never made public.

5.4 Legal disclosures

We may disclose personal information to law enforcement agencies, regulators, or courts when required by applicable law, lawful court order, or to protect the rights and safety of the Platform and its users.

5.5 Business transitions

In the event of a merger, acquisition, or sale of all or substantially all assets, personal information held by Brkrr may be transferred to the successor entity. We will provide notice to affected users before any such transfer, and the successor will be required to protect your information in a manner consistent with this Policy.

6. Where Your Information Is Stored

Your personal information is stored in Canada. Our production database is hosted in the Canada Central (Montréal) region. Our application servers are configured to run in Canada (Montréal). Certain third-party providers (for example, email delivery and product analytics) process limited data in the United States. Where data is processed or transferred outside Canada, we apply contractual protections consistent with PIPEDA.

7. How Long We Keep It

We retain personal information only as long as necessary for the purposes described in this Policy. The table below sets out our retention windows by data category. Retention windows apply to ordinary account data. When you submit a deletion request under PIPEDA (see §8.2), the right-to-erasure process applies instead and overrides the ordinary retention window.

8. Your Rights

8.1 Access, correction, withdrawal of consent, and complaints

Under PIPEDA you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Withdraw consent for non-essential processing at any time
• Request deletion of your account and associated personal information (see §8.2)
• Complain to the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email us at privacy@brkrr.ca. We will respond within 30 days.

8.2 Right to be forgotten (deletion request)

When you submit a deletion request under our right-to-erasure process, we immediately mark your account and associated lead requests as deleted and hide them from the Platform. You have 30 days to reverse this decision by contacting privacy@brkrr.ca — during this window, no data is permanently removed.

After 30 days, your account information is fully deleted. Lead records are retained in a minimized form: your name, email address, phone number, any notes or financial assessment answers you provided, and the link between your account and those leads are permanently removed. We retain structural information — such as the province and type of mortgage request and the timeline — for dispute resolution and regulatory record-keeping. We retain the structural record of which agents responded to the lead request after removing information that identifies you.

This process applies when you explicitly request deletion of your data. Ordinary account closure from your account settings (without a deletion request) retains your data for up to two years from the closure date, as described in §7.

8.3 Unclaimed mortgage agent listings

If your information appears in an unclaimed mortgage agent listing that was built from a provincial registry, you may request takedown of that listing by emailing privacy@brkrr.ca with your licence number and provincial regulator confirmation. We will hide the listing within 14 days and will maintain a suppression record to prevent re-creation from subsequent registry synchronizations.

Your preferred alternative is to claim your listing — claimed listings give you full control over your public profile.

9. Cookies and Tracking

• Essential cookies: required for authentication and core Platform functionality (session tokens, CSRF protection)
• Preference cookies: to remember your language and filter settings
• Analytics storage: our product-analytics provider (PostHog) stores a first-party identifier in your browser's local storage (not a cookie), and our traffic-analytics provider (Google Analytics 4) sets first-party cookies (_ga and _ga_ followed by a stream identifier, lasting up to two years) to measure Platform usage, such as page views and how far you progress through the matching flow. Both respect Do Not Track and Global Privacy Control signals; we do not use analytics data for advertising, and we have not enabled any advertising or cross-site-tracking features in either tool.
• Spam-prevention checks: our bot-detection provider (Cloudflare Turnstile) runs an invisible check on certain public forms. We have not enabled Turnstile's optional pre-clearance feature, so Turnstile does not issue its cf_clearance cookie for brkrr.ca. Cloudflare may use cookies or similar technologies within its own challenge frame per Cloudflare's privacy notice. See §5.1 and §4.4.

We use a privacy-focused product-analytics tool (PostHog) to understand how the Platform is used and to improve it. Before any analytics event is transmitted, page addresses are reduced to the site address and page path: all query parameters are removed (a traffic-source tag is kept only when its value matches a fixed list of known sources), and known token-bearing address segments are redacted. Event data is filtered against a blocklist of personal- and financial-information field names before it is sent. Session recording is disabled, and PostHog stores its identifier in your browser's local storage rather than a cookie. We honour browser Do Not Track and Global Privacy Control signals, and we do not load advertising or third-party behavioural-advertising cookies. Google Analytics 4 receives the same reduced page addresses (site address and page path only) and never receives page titles, form contents, or the information you enter on the Platform; see Google's Privacy Policy for how Google handles data it receives. You may disable non-essential cookies and local storage through your browser settings.

10. Consent and Withdrawal

Express consent is obtained at lead submission, where you confirm that your mortgage enquiry details — including any quiz or calculator answers — will be shared with up to three matched mortgage agents in your province. You may modify or clear those inputs before submitting.

Express consent for commercial email (newsletters, marketing) is collected separately with an explicit opt-in checkbox. We will not send commercial electronic messages without your express consent under CASL s.6.

Implied consent applies to transactional emails — account confirmations, brokerage verification codes, lead notifications, licence-status alerts — which are messages required to complete a service you requested, permitted under CASL s.10(13) without express consent.

Withdrawal: You may withdraw consent at any time by updating your preferences in your dashboard settings, using the unsubscribe link in any email we send, or emailing privacy@brkrr.ca. These channels control what we email you; they do not control analytics. For analytics, enabling your browser's Do Not Track or Global Privacy Control signal switches off both PostHog and Google Analytics for you from your next page load onward, and you may block non-essential cookies and local storage in your browser settings at any time.

11. Security Safeguards

We protect your personal information through the following technical and organizational safeguards:

• Industry-standard encryption in transit and at rest through our hosting and database providers
• Role-based access controls (consumers, agents, and administrators have access only to the data their role requires)
• Authentication via Google and LinkedIn OAuth — Brkrr does not store passwords
• Brokerage email verification required before any mortgage agent listing is approved
• Nightly automated licence-status checks against provincial regulatory registries
• Rate limiting on authentication and lead-submission endpoints
• We conduct periodic security reviews of our technical and organizational safeguards

12. Security Breach Notification

If Brkrr experiences a security breach, we assess whether the breach creates a "real risk of significant harm" to individuals, as defined under PIPEDA s.10.1 and the Breach of Security Safeguards Regulations (SOR/2018-64).

If we determine a real risk of significant harm exists:

• Regulator notification: We will report the breach to the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible, and in all cases as required by law. We will also notify applicable provincial privacy authorities where required.
• Individual notification: We will notify every affected user directly by email as soon as feasible. Notification will describe what happened, what information was involved, what steps we have taken, and what you can do to protect yourself.
• Public disclosure: Where appropriate, and where doing so does not create further security risk or conflict with law enforcement or provider instructions, we may publish a public status update summarizing the breach and our remediation steps.

We maintain records of all security breaches (including those not requiring notification) for a minimum of 24 months, consistent with the Breach of Security Safeguards Regulations. To report a suspected security vulnerability, email privacy@brkrr.ca.

13. Children

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has submitted information to us, please contact privacy@brkrr.ca and we will delete it promptly.

14. Changes to This Policy

Material changes to this Privacy Policy will be communicated by email to all account holders at least 30 days before taking effect. Minor or clarifying changes (such as adding a new provincial registry or updating a sub-processor's data region) will be noted in the "Last revised" date above. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

15. Contact and OPC Referral

• Email: privacy@brkrr.ca
• Subject line: Privacy enquiry — [your name]
• Mail: Privacy Officer, Brkrr Technologies Inc., Ontario, Canada

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

Related: Terms of Service · Contact us · Submit a mortgage enquiry