Privacy Policy

TrustVault is operated by Royal Merit Realty Inc. (“TrustVault,” “we,” “us,” “our”), a corporation registered in Ontario, Canada with its principal office at:

101E-60 Granton Dr.
Richmond Hill, ON, L4B 2N6
Canada

For privacy questions or to exercise your rights, contact: privacy@thetrustvault.app

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through the TrustVault platform (the “Service”). It applies to all users including mortgage professionals (“Subscribers”), team members, and mortgage applicants (“Clients”).

We comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

We collect personal information you provide directly, including:

• Account information: name, email, phone number, password (stored hashed), business name, role
• Mortgage application information: personal details, employment, income, assets, liabilities, properties, SIN (only when required), and similar information you submit through the application form
• Documents you upload: tax returns, NOAs, T4s, bank statements, identification, property documents, and other files required to support a mortgage application
• Communications: messages, comments, and other content you send through the Service
• Payment information (Subscribers only): billing details processed by our payment processor; we do not store full credit-card numbers ourselves
• Technical information: IP address, browser type, device identifiers, log data, and information about how you use the Service

We use personal information to:

• Provide, operate, and improve the Service
• Allow Clients to submit documents and applications to their assigned mortgage professional
• Authenticate users and protect accounts from unauthorized access
• Send service-related notifications (uploads, reminders, alerts)
• Process payments and manage subscriptions
• Comply with legal, regulatory, and tax obligations
• Investigate and prevent fraud, security incidents, or misuse

We share personal information only as follows:

• With your assigned mortgage professional:Clients’ applications and uploaded documents are visible only to the Subscriber and team members of the Subscriber’s organization who are assigned to the file.
• With service providers: hosting (Supabase / AWS), email delivery (Resend), payment processing, and similar vendors who process information on our behalf under contractual privacy obligations.
• With your consent: for example, when you direct us to share your information with a lender, insurer, or appraiser.
• For legal reasons: when required by law, court order, or to protect rights, safety, or property.

We do not sell personal information. We do not use personal information for advertising.

Your personal information, including uploaded documents, is stored on infrastructure operated by Supabase Inc. and Amazon Web Services in the United States (region: US East / Northern Virginia). This means your information may be subject to U.S. laws, including lawful access requests by U.S. authorities.

By using the Service, you consent to this cross-border transfer. We use encryption in transit and at rest, and contractual safeguards with our service providers, to protect your information regardless of where it is stored.

We use commercially reasonable technical and organizational safeguards to protect personal information, including:

• Encryption of data in transit (TLS) and at rest
• Row-level security on the database so users only access their own data
• Multi-factor authentication options for Subscribers
• Session timeout after 15 minutes of inactivity
• IP-based new-device login alerts
• Rate limiting on authentication endpoints

No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you and the appropriate regulator as required by law.

Under PIPEDA and applicable provincial law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent (subject to legal and contractual obligations)
• Request deletion of your account and associated data
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, email privacy@thetrustvault.app. We will respond within 30 days.

We retain personal information for as long as your account is active, plus a period required to comply with our legal, accounting, and regulatory obligations (typically up to 7 years for financial records under Canadian tax law).

If you close your account, your active data is deactivated within 30 days; backup copies and records required by law are retained for the applicable retention period.

We use cookies and similar technologies to keep you signed in and to operate the Service securely. See our Cookie Notice for details.

The Service is not intended for individuals under 18 years of age. We do not knowingly collect information from children.

We may update this Privacy Policy from time to time. If a change is material, we will notify you by email and ask you to review and accept the updated version when you next sign in. The “Effective” date at the top reflects the latest version.

Privacy questions, complaints, or requests can be sent to:
Royal Merit Realty Inc.
Attn: Privacy Officer
101E-60 Granton Dr., Richmond Hill, ON, L4B 2N6
Email: privacy@thetrustvault.app