MortgageScorecard

Privacy policy

Last updated 2026-09-01. Operated by MortgageScorecard Labs. Privacy questions and requests: privacy@mortgagescorecard.io.

Two kinds of people use this platform

Mortgage brokers create accounts and build scorecards. Respondents answer a brokerage's scorecard to get a mortgage estimate. What we hold differs for each, so this page covers them separately. For a respondent's answers, the brokerage that published the scorecard decides why the information is collected; MortgageScorecard stores and processes it on the brokerage's behalf.

If you answered a scorecard (respondents)

We store:

  • Your answers — ballpark financial figures like income, debts and down payment, and choices like province and timeline. We deliberately never ask for a social insurance number, a date of birth, an exact credit score, or any documents.
  • The contact details you give to receive your results: name, email, and phone number if you offered one. The brokerage can also have these, with your answers and estimate, delivered to its own systems (see “Who touches the data”).
  • If the brokerage shows the estimate first, you can see it without giving us anything. We store your answers and the computed estimate on their own, and you decide afterwards whether to leave an email address or ask a broker to get in touch.
  • If the brokerage asks for contact details before the estimate: when you enter your email address and leave that field before finishing, we save it at that moment so you can come back and pick up where you left off, and we may send you one reminder that you did not finish — one, and none at all if you finish. That reminder carries an unsubscribe link like every other commercial email we send. Using it immediately suppresses future commercial email to that address.
  • The computed estimate you were shown, exactly as you saw it, so the brokerage can stand behind what it told you.
  • A consent record: the exact consent wording you saw, when, and what you chose. Canadian anti-spam law (CASL) makes the brokerage prove consent; this record is that proof.
  • Technical details that come with any web request: your IP address, your browser's user agent, the address of the page you were on, and any campaign parameters in it. We keep these with the consent record because anti-spam law makes the brokerage prove where and when consent was given.
  • Notes the brokerage writes about your file — whether you spoke, what evidence there is of that, and whether the estimate helped.

Completing a scorecard is an inquiry, which under CASL gives the brokerage implied consent to email you about it for six months. The checkbox for ongoing marketing is optional and never pre-ticked. Every commercial email includes a working unsubscribe that takes effect immediately. Your estimate is not a credit decision: no credit check happens, nothing is sent to any lender, and the math behind your number is shown to you on your results page.

Anonymized statistics

We may use scorecard answers and computed estimates — with names, email addresses and phone numbers stripped out — to produce aggregate statistics about mortgage readiness in Canada, and we may publish some of them. A published figure would always be a group number drawn from many submissions across many brokerages; it would contain nothing that could identify you, and figures for small groups would not be reported at all.

If you have a broker account or joined the waiting list

  • Your name, email address, and a securely hashed password — we never store the password itself. Signing in sets a session cookie.
  • Your brokerage's profile: legal name, licence numbers, and the disclosure details regulators require on public pages — and, if you upload them, your logo and a photo for your scorecard pages.
  • An activity log of significant actions (publishing, exporting, deleting), kept permanently so the brokerage can answer “who did what, when”.
  • If you joined the waiting list: your name, email address and brokerage name, together with the IP address and browser identification sent with your request, kept until we invite you or you ask us to remove them. We don't email you automatically — if we invite you, the invitation itself is the email you'll get.

Cookies

This site sets two cookies, and nothing else. Signing in as a broker sets a session cookie. Opening a scorecard's landing page sets a one-day cookie whose only content is “1”, so a repeat visit from the same browser is not counted as a new view; it holds no identifier and is not linked to your answers.

Your browser also keeps your answers and a key that lets you resume, so you can come back to a scorecard you did not finish. That storage belongs to the browser on the device you used; we cannot read it from anywhere else.

We use no analytics, no ad pixels and no cross-site tracking. We do record when you click the brokerage's phone number or booking link, so the brokerage knows you tried to reach them.

Who touches the data

  • Our database, hosted with Supabase in Montréal, Canada (ca-central-1), stores everything above.
  • Resend delivers email — results, notifications, password resets. A password reset or a copy of your results is transactional, not marketing.
  • Inngest, a third-party service, runs our background work — your results email, the one reminder above — outside the web request you made. It holds the state of those jobs on its own infrastructure.
  • Vercel hosts the platform. A brokerage's uploaded logo and photo are stored with Vercel in Montréal, Canada, at a public address, because they appear on public pages. Vercel may cache these public images on its global delivery network. Respondent answers and contact details are never stored there.
  • The brokerage's own systems. A brokerage may point its CRM or other software at a webhook. Where the brokerage shows the estimate first, it fires only when you ask to be contacted; where contact comes first, on every completed scorecard. It sends your name, email address, phone number, the answers the brokerage tagged, your computed estimate, a link to your results page, and where you came from. Those systems are the brokerage's, and its own privacy practices apply to them.

We do not sell personal information, to anyone, for anything.

How long we keep it

If you finished a scorecard and left no contact details, we remove your answers and your estimate after six months. The link to your results stops working and only an anonymous count of the completion remains. If you left contact details, or asked a broker to get in touch, we keep what you gave us until you or the brokerage delete it.

Your choices

  • Respondents: every commercial email has an unsubscribe link; suppression is immediate. To have your details corrected or deleted, contact the brokerage that ran the scorecard, or privacy@mortgagescorecard.io — brokers have a per-lead delete that removes your contact details and consent records. We keep your address on the do-not-email list, so an unsubscribe outlives the record, and we keep the completed scorecard itself with nothing left on it that names you — the technical details above go with the consent records that carried them.
  • Brokers: Settings → Your account has “Download my data” and “Delete my account”. Deletion is confirmed by email and is permanent.