Privacy Policy
This policy explains what personal information Mortgages Lab collects, why, who we share it with, where it is processed, how long we keep it, and how you can see, correct or delete it. It covers our website, mortgageslab.ca, our WhatsApp AI assistant, and the follow-up you receive from our team.
1. Who we are
Mortgages Lab is the trade name of MortgagesLab Brokers Inc., a mortgage brokerage based in Langley, British Columbia. Our principal broker, Camilo Rodriguez, is licensed in British Columbia (BCFSA MB142871) and Alberta (RECA CON10682). Ontario mortgages are brokered through Mortgage Architects, FSRA Brokerage Licence #12728.
We are responsible for the personal information we collect and for the service providers that process it on our behalf. We follow Canada’s federal privacy law (PIPEDA), the Personal Information Protection Acts of British Columbia and Alberta, Quebec’s Act respecting the protection of personal information in the private sector, and Canada’s Anti-Spam Legislation (CASL), as each applies.
2. The short version
- We collect what you give us — in our website forms and in WhatsApp — and some technical information when you use the website.
- We use it to answer you, run your numbers, issue a Mortgage Letter if you ask for one, connect you with a licensed mortgage broker and follow up with you.
- We do not sell your personal information.
- Several of our service providers are outside Canada, mostly in the United States. They are listed in section 7.
- Our WhatsApp assistant is an AI, and it says so. It makes no decisions about you; advice about your own situation comes from a licensed broker.
- You can ask to see, correct or delete your information, or withdraw your consent, by writing to our Privacy Officer (section 11).
3. Information we collect on our website
When you browse. Like most websites, ours uses tools that measure how it is used. They load when you open a page, and they set cookies or similar identifiers in your browser.
| Tool | Provider | What it collects | Where it is processed |
|---|---|---|---|
| Google Analytics 4, through Google Tag Manager | Google LLC | The pages you visit, how far you scroll and how long you stay, the buttons and links you click (for example the lender, term and rate next to a “Book a call” button, or the province and language of a WhatsApp button), your device and browser type, and an approximate location Google derives from your IP address. If you sign in to Payoff Lab, we also send Google an internal account number — never your name, email or phone number — so visits from your different devices count as one person. | United States |
| Microsoft Clarity | Microsoft Corporation | Mouse movements, clicks, scrolling and what is on the page, used to replay visits and build heatmaps. Text typed into form fields is masked. Microsoft keeps recordings for about 30 days, and a sample for up to 9 months. | Microsoft’s cloud (Azure); Microsoft does not state the region |
| Google Fonts | Google LLC | Your IP address and browser information when the website’s fonts load. | United States |
| Website hosting | Vercel Inc. | Your IP address, which any website host must process to deliver a page. We use the country and province derived from it to show you your province’s rates; we do not store it. | United States |
Your choices. We do not currently show a cookie banner. You can block or delete cookies in your browser settings, browse in a private window, or install Google’s opt-out add-on for Google Analytics. The website keeps working if you do, except that signing in needs the session cookie described below.
When you sign in. Payoff Lab, the Rental Lab course and our Developer API ask for your name, email and phone number and send you a 6-digit code. To deliver that code by email, we send your name, email, phone number and the code to our customer relationship management system (CRM), GoHighLevel, which sends the email. The code stops working after 10 minutes. When you enter it, we create an account with your name, email and phone number, and set a cookie named session_token that keeps you signed in for 7 days. We also tell our CRM that you verified — and, for Payoff Lab, the lender, term and rate you arrived from, if any.
Payoff Lab. When you ask for your calculation, the figures you enter — for example your home value, mortgage balance, rate and payment, your income, expenses and savings balances, and the debts you list with their balances, rates and payments — are sent to our server to prepare your report, before you sign in. After you sign in, those figures and the report are saved to your account so you can reload them later. They are not sent to our CRM.
Rental Lab course. Your name, email and phone number go to our CRM, which gives you access to the course on Kajabi, our course platform, and sends us back a one-time login link for you.
Developer API. Besides what you give us to sign in: your company and, if you choose, your website and what you plan to build. We store the API key we issue to you. When software calls our public calculator API, we log the IP address, the first characters of the API key (if there is one), the endpoint, the time, the browser or user agent, the website the call came from and the result code, to limit usage and prevent abuse. We do not store the numbers sent for calculation. These logs are deleted after 90 days.
Booking a call. “Book a call” buttons open a booking page hosted by our CRM (GoHighLevel). Some of them — for example those next to a rate — add to the link which button you used and the lender, term and rate you were looking at. What you type on the booking page is collected by GoHighLevel for us.
WhatsApp buttons. Some pages have a button that opens WhatsApp with a message already written, including a short reference to the page, such as “(ref: learn-mortgage-letter)”. Nothing is sent unless you tap Send in WhatsApp. If you do, section 4 applies.
4. Our WhatsApp AI assistant
You are talking to an AI first. When you message us on WhatsApp, the first reply comes from Camilo Rodriguez’s AI virtual assistant, and its first message says so. A licensed broker on our team can take over the same conversation at any time from the WhatsApp Business app, and you can ask for a person whenever you like. The assistant writes in English or Spanish.
What we collect in every conversation. Your WhatsApp phone number and profile name, the language you write in, and the messages you send. If you send a photo or a document, we keep only WhatsApp’s reference to it — we do not download or store the file.
If you tapped one of our ads. If you started the conversation by tapping an ad on Facebook or Instagram, WhatsApp passes us an identifier Meta created for that tap, with details of the ad such as its headline and text. We keep them with your contact record.
If you answer our mortgage questions, in a WhatsApp form or one question at a time in the chat: your full name; your consent choice; your property value; mortgage balance; remaining amortization; current rate; province; whether your lender has made you an offer and at what rate; the type of rate you prefer; the types of debt you want to consolidate and their total; your net monthly household income; monthly living expenses; employment type; any monthly income you draw from a business; whether the property has a basement suite and, if so, the monthly rent it brings in; the types of savings accounts you hold (for example RRSP or TFSA); a range for your cash on hand; and your actual mortgage payment and how often you pay it.
If you ask for a Mortgage Letter: your name, province, what the letter is for (renewal, refinance or purchase), the mortgage amount, your email (required: the letter is sent to you in the WhatsApp chat, and if it can’t be delivered there, a broker emails it to you) and the address of the property (required), which is printed on the letter.
What we never ask for: your Social Insurance Number, date of birth, bank account or card numbers, or credit score.
How the AI is used. The assistant answers general mortgage questions from a knowledge base our team writes and reviews. To do that, the text of your question is sent to Anthropic, the company that provides the AI model (Claude). Under its commercial terms, Anthropic does not train its models on this data. The AI does not read your answers to our mortgage questions, does not do calculations and does not quote rates: every figure in your report comes from an answer you gave — typed into a WhatsApp form, or typed in the chat, where ordinary software reads it and shows it back to you to confirm before keeping it — and fixed calculators do the math. The assistant cannot approve, decline or price a mortgage, and it makes no decision about you: advice about your own situation comes from a licensed broker. If the assistant can’t answer your question, it tells our team your WhatsApp name, your phone number and why it couldn’t help — not the question itself — and offers you a time to talk to a broker.
The Mortgage Letter. A Mortgage Letter is a one-page letter on our letterhead listing the rates available for your province on the day it is issued, which you can take to your own lender. It is not an approval, a pre-approval or a commitment to lend. If a price applies, it is shown to you in the chat before you pay anything. Payment happens on a page hosted by Stripe, our payment processor: you enter your card there, and we never see or store your card number. We send Stripe only an order reference and the amount; Stripe tells us the payment went through and gives us the cardholder name and email you entered, which we use to fill in the letter form for you to confirm or change. When the letter is paid for, we ask nothing about your mortgage until after you have paid.
Advertising measurement. If you reached us by tapping one of our ads, we tell Meta when we send you a payment link for a Mortgage Letter, and again if you pay, with the amount, the time and the identifier Meta created for your tap — not your name, phone number, email or anything you told us. This is how we measure whether our advertising works.
What our CRM receives from WhatsApp. So that a broker can follow up, GoHighLevel receives your name (or, if you haven’t given it, your WhatsApp profile name or the cardholder name Stripe gave us), phone number and email; your province; your answers about your mortgage — property value, balance, remaining amortization, current rate, any offer from your lender, the type of rate you prefer, your payment and how often you pay it, employment type, whether the property has a basement suite and your total debt; the results of your report; what a Mortgage Letter is for, its amount, your consent and how your order is going; your opt-out, if you send one; and, when the conversation is handed to a person, the reason. It never receives your messages, your income, expenses or cash-on-hand range, which savings accounts you hold, the property address on a Mortgage Letter, the ad identifier, or references to files you sent.
Stopping messages. To stop all messages from us, send STOP (or UNSUBSCRIBE; in Spanish, BAJA, ALTO, NO MÁS or CANCELAR SUSCRIPCION). You do not have to use our word for it — a sentence works too: “please stop messaging me”, “unsubscribe me from this list”, “ya no quiero recibir mensajes”, “arrêtez de m’écrire”. We act on it before anything else happens in the conversation, it costs nothing, and we tell our CRM, which marks you “do not disturb” so our team doesn’t contact you there either. If you write to us again later, we treat that as a new conversation and the assistant will reply; you can stop again at any time.
5. Phone, email and text follow-up
If you ask us about a mortgage, sign up on our website or are already our client, our team may follow up by phone, email, text message or WhatsApp. Some renewal reminder calls are made by an AI voice assistant, not a person. Calls and messages handled through our CRM may be recorded or transcribed and summarized there, so the next person who helps you knows the history. You can ask us to stop at any time: tell the caller, reply to the message, or write to our Privacy Officer.
6. How we use your information, and on what basis
- To answer your questions and provide what you ask for: calculations, reports, course access, API keys and Mortgage Letters.
- To connect you with a licensed mortgage broker and, if you decide to apply, to arrange your mortgage.
- To follow up with you about your mortgage and related services, within the limits of your consent.
- To take payment for a Mortgage Letter, keep the records we are required to keep, and handle complaints.
- To keep our services secure, prevent abuse and fix problems.
- To understand how our website and advertising perform.
We rely on your consent. You give it expressly when you tick the consent box in a WhatsApp form (“I agree to be contacted about my mortgage options and to Mortgages Lab handling the information I provide.”) or tap “Yes, that’s fine” in the chat, and implicitly when you contact us or ask us a question. Under CASL, consent implied by an inquiry lasts six months. You can withdraw your consent at any time (sections 4 and 10); if you do, we may no longer be able to provide a service that depends on that information.
7. Who we share it with, and where it is processed
We share personal information only with the service providers that help us run our services, and only what each one needs. We do not sell personal information.
| Provider | What it does for us | Where it processes information |
|---|---|---|
| MongoDB (MongoDB Atlas) | Our main database for website accounts and WhatsApp conversations | Canada |
| Railway | Runs our application servers, including the WhatsApp assistant | United States |
| Vercel Inc. | Hosts the website and its audio files | United States |
| HighLevel (GoHighLevel) | Our CRM: contact records, sign-in code emails, booking pages, follow-up calls and messages | United States; HighLevel says it may also use affiliates and providers in other countries, including India |
| Meta Platforms, Inc. | Carries and stores WhatsApp messages; receives the advertising measurement described in section 4 | United States |
| 360dialog GmbH | Meta-authorized provider that routes WhatsApp messages to our systems | Germany |
| Anthropic, PBC | Provides the AI model that answers general questions on WhatsApp | United States |
| Stripe | Processes card payments for Mortgage Letters | United States |
| Kajabi | Hosts the Rental Lab course | United States |
| Google LLC | Google Analytics, Google Tag Manager and Google Fonts | United States |
| Microsoft Corporation | Microsoft Clarity | Microsoft’s cloud; Microsoft does not state the region |
We also share information with lenders, mortgage insurers and, for Ontario mortgages, Mortgage Architects, when you ask us to arrange a mortgage — and with authorities when the law requires it.
Information processed outside your province or outside Canada is subject to the laws of the place where it is processed, and may be accessed by courts, law enforcement or national security authorities there. You can ask our Privacy Officer for written information about how we use service providers outside Canada.
8. How long we keep it
| Information | How long we keep it |
|---|---|
| WhatsApp messages | No set period at present: kept until you ask us to delete them |
| Records of the WhatsApp forms we send you (which form, and whether you completed it; your answers are kept with your contact record) | 30 days |
| WhatsApp assistant usage statistics (your phone number replaced by a one-way code) | 90 days |
| Background processing records | 7 days after the task is finished |
| Mortgage Letters we issue (the six answers of the order form — name, province, email, what the letter is for, the amount and the property address —, the letter itself, the payment record and, if there was one, the ad identifier) | 7 years, as business records |
| A Mortgage Letter order that was never paid | 30 days |
| Your WhatsApp contact record, your answers to our mortgage questions, your consent and opt-out record, and the ad identifier on your contact record | No set period: kept while we have a relationship with you, or until you ask us to delete it. We keep a record of an opt-out so we can keep honouring it. |
| Website accounts, sign-in records, saved Payoff Lab reports, course enrolments and API keys | No set period: kept until you ask us to delete them |
| Contact records in our CRM | No set period: kept until you ask us to delete them |
| Sign-in cookie | 7 days |
| Calculator API request logs | 90 days |
| Records of administrative actions on our systems (showing only the last 4 digits of a phone number) | Kept indefinitely, for accountability |
| Analytics data held by Google and Microsoft | According to those services’ retention settings (Microsoft Clarity recordings: about 30 days, a sample up to 9 months) |
9. How we protect it
We use encrypted connections (HTTPS) on our website and APIs; a sign-in cookie that scripts on the page cannot read and that is only sent over secure connections; access controls on our systems; and a fixed list of the fields that may be sent to our CRM. Card numbers are entered on Stripe’s page and never reach us. No system is perfectly secure: if a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the privacy regulators as the law requires.
10. Your rights and choices
- Access: ask whether we hold personal information about you, what it is, how we have used it and who we have shared it with.
- Correction: ask us to correct information that is inaccurate or incomplete.
- Withdraw consent: stop messages with STOP (section 4), ask a caller to stop, or write to us.
- Deletion: ask us to delete your information. We will delete it, except what the law requires us to keep — such as an issued Mortgage Letter — and a minimal record of your opt-out, so we don’t contact you again.
- Stop dissemination (Quebec residents): ask us to stop disseminating your personal information, or to de-index a link that gives access to it, in the cases Quebec law allows — for example, when it seriously harms your reputation or privacy.
- Providers outside Canada: ask for written information about how we use service providers outside Canada.
To make a request, write to our Privacy Officer (section 11). There is no charge. We may ask you to confirm your identity, for example by writing from the email or WhatsApp number we have on file. Requests are handled by a person, not automatically, and we reply within 30 days.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, depending on where you live, to the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Information and Privacy Commissioner of Alberta.
11. Our Privacy Officer
Our Privacy Officer is responsible for how we handle personal information and answers questions and requests about this policy.
Privacy Officer
MortgagesLab Brokers Inc.
Email: daniel@mortgageslab.ca
Phone: +1 604 308 1721
Mail: C321 - 8150 207 St, Langley, BC V2Y 4J4, Canada
12. Children
Our services are meant for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact our Privacy Officer and we will delete it.
13. Changes to this policy
When we change this policy, we update the date at the top of this page. If we make a significant change, we will say so on this page and, where the law requires it, ask for your consent.
14. Languages
This policy is published in English, French and Spanish. The Spanish version is a courtesy translation; if the versions differ, the English and French versions prevail.