Privacy Policy

We are responsible for the personal information we hold. Questions, requests and complaints go to our Privacy Officer at info@marwahamer.com.

We collect only what we need to respond to you, run your account and arrange the services you request.

• Website forms: your name, email address, phone number, the service you are interested in, your message, a business you ask about and, when you book a call, the time you chose and your time zone.
• Your account: your sign-in email, your password (stored only as a one-way hash by our authentication provider), your two-step verification settings, and your profile: name, phone number, mailing address, preferred language and an optional photo.
• Documents you upload or that we share with you, the notes you add to them, and the messages you exchange with us in the client area.
• Your application file: its stage, the documents requested and their review status.
• Appointments: the reference of a call booked through our scheduling provider (the booking itself is kept by that provider).
• Consent records: what you agreed to (the exact wording shown), when, and the IP address and browser used.
• Security records: sign-in times, IP addresses, browser type and the approximate city and country of each session, and a log of actions taken in the client area and back office.
• Billing records, if we invoice you: amounts, invoices and payment records.
• Technical information processed by our hosting and form-protection providers to deliver and protect the site, such as IP address and browser type.

We use personal information to respond to enquiries, assess and arrange financing, run your account and your file, deliver the services you request, keep accounts secure, meet legal and regulatory obligations and, only with your consent, send you offers and updates. Notification emails about your file can be turned off in your account settings or with the link in each email.

Marketing emails are optional and sent only if you tick the box that asks for them; every such email has an unsubscribe link. We share a request for legal services with Marwah Law only when you tick the consent box on that request, and we record the wording you agreed to. You may withdraw consent at any time, subject to legal or contractual restrictions.

We share information with lenders, insurers and RMA Mortgages only as needed to arrange the products you request, and with Marwah Law only with your consent. We do not sell personal information.

Our database and stored files are kept in Canada (Montreal). The client area's server functions also run in Montreal. Some of our service providers process data outside Canada, mainly in the United States, under contractual confidentiality and security obligations. Information processed outside Canada may be accessible to the authorities of that country under its laws.

• Hosting and server functions (Vercel): every page and form request. The website's own form functions may run outside Canada.
• Database, authentication and file storage (Supabase): your account, file, documents and messages, stored in Canada.
• Email delivery (Resend): the emails we send you and the firm's copy of a form submission (name, email, phone, service and message).
• Form protection (Cloudflare Turnstile): a verification token and your IP address when you submit a form.
• Scheduling (Cal.com): your name, email, phone, time zone and the notes you give when you book a call.
• Only when the firm has turned them on: electronic signature (DocuSign: signer names and emails, the document to sign), invoicing and payments (Square: your name, email and invoices), video meetings (Zoom: recordings, transcripts and participant emails), meeting summaries (Anthropic: the meeting transcript, to draft a summary for staff) and error reports (Sentry: technical details only, without messages, email addresses or IP addresses).

Website forms are passed to our back office, which stores your enquiry with your account record; the website itself keeps no copy. Access is limited by role to the staff who handle your file, staff must use two-step verification, and data is encrypted in transit. Uploaded files are checked for type and size.

We keep personal information only as long as needed for the purposes above and to meet legal and regulatory record-keeping requirements. Specifically:

• An enquiry from someone who never opened an account and did not agree to receive offers is deleted after a period of inactivity set by the firm, never less than 12 months.
• Client files and documents are kept for the record-keeping period set by the firm (currently 7 years), then deleted with the account.
• A document you remove is deleted after a short period set by the firm (currently 1 day).
• A Download My Data file is available for 24 hours.
• A handled deletion request is kept for 90 days.
• Security and audit records are kept to protect accounts and to show what happened, including after an account is deleted.

You may ask for access to or correction of your personal information, download a copy of your account data from your account settings (Download My Data), close your account, and withdraw consent to marketing at any time. To make a request or a complaint, contact our Privacy Officer at info@marwahamer.com. We respond within the time required by applicable law. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada.

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires, and keep a record of every breach. To report a suspected breach, contact our Privacy Officer at info@marwahamer.com.

This website uses only cookies that are strictly necessary for security, form protection and signing in to your account. If analytics or advertising tools are added in the future, this policy will be updated and consent will be requested where required.

We may update this policy from time to time. The date at the top of the page shows the latest revision.