Privacy Policy

Kima Technologies Inc. ("Kima", "we", "us") operates the Kima platform, including CallSmart, WorkflowCRM, and DealCheck, as well as the website at usekima.com. This policy explains what personal information we collect, why we collect it, how we use it, and your rights under Canadian privacy law — including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

By using our website or products, you agree to the practices described in this policy. If you do not agree, please do not use our services.

1. Who we are

Kima Technologies Inc. is a Canadian company that builds operational software for mortgage brokers and brokerages. We are the controller of personal information collected through our website and platform.

Privacy inquiries and data requests can be directed to:
legal@usekima.com

2. Information we collect

We collect personal information in several ways depending on how you interact with Kima.

2.1 Website visitors

• IP address, browser type, and device information
• Pages visited, time on page, and referring URLs
• General geographic location (city/region level)

This is collected automatically through Google Analytics (see Section 5).

2.2 Demo and contact requests

When you book a demo or contact us, we collect:

• Full name and email address
• Phone number
• Brokerage name and province of operation
• Role/title and team size

2.3 CallSmart users

CallSmart processes mortgage broker call data. Depending on your input method (Upload, Manual/Dictate, or Live Call), we may process:

• Audio recordings of mortgage consultation calls
• Transcripts generated from those recordings
• Client names, financial details, and mortgage specifics as they appear in call content
• AI-generated summaries, deal notes, and follow-up emails derived from the above

Important: CallSmart is designed for use by regulated mortgage professionals. Before recording or processing any client call, you are responsible for obtaining your client's informed consent in accordance with applicable Canadian law.

2.4 WorkflowCRM users

• Client contact details entered into the CRM (name, email, phone)
• Deal and pipeline data (property details, loan amounts, lender information)
• Communication records and workflow activity logs

2.5 DealCheck users

• Financial documents uploaded for verification (T4s, NOAs, bank statements, pay stubs)
• Calculated ratios and risk scores derived from document content (GDS, TDS, risk score)
• Borrower identity information as it appears in submitted documents

3. How we use your information

We do not sell your personal information to third parties. We do not use your information for automated decision-making that produces legal or similarly significant effects without human review.

4. Data storage and location

All personal data processed through the Kima platform is stored on servers located in Canada. We use infrastructure providers that maintain Canadian data residency to support your obligations under PIPEDA and provincial regulations.

Some sub-processors (listed in Section 5) may process data outside of Canada, including in the United States. Where this occurs, we ensure that appropriate contractual safeguards are in place. We will notify Canadian enterprise customers of cross-border data flows on request.

5. Third-party service providers

We engage the following sub-processors to operate our services. Each is bound by data processing agreements and their own privacy commitments.

Google Analytics

We use Google Analytics 4 to understand how visitors use our website. Google Analytics uses cookies and similar technologies to collect anonymised usage data. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

AI sub-processors

CallSmart sends call transcript content to one or more of the AI providers listed above for analysis and output generation. We apply data minimisation practices — only the transcript content required to generate the requested output is transmitted. We do not send client PII beyond what is naturally present in the call content, and we contractually restrict these providers from using your data to train their models.

6. Cookies

Our website uses the following cookies:

You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the Kima platform.

7. How long we keep your data

After the applicable retention period, data is securely deleted or anonymised. You can request early deletion at any time (see Section 8).

8. Your privacy rights

Under PIPEDA, and where applicable Quebec's Law 25 and other provincial privacy legislation, you have the following rights:

To exercise any of these rights, contact us at legal@usekima.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are unsatisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada or, if you reside in Quebec, the Commission d'accès à l'information du Québec.

9. Quebec residents — Law 25

Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) imposes additional obligations on organizations that collect personal information about Quebec residents. In addition to the rights in Section 8:

• You may request that we stop disseminating your personal information or de-index any hyperlinks associated with your name, where applicable.
• You have the right to data portability — to receive your information in a structured, commonly-used, technological format.
• You have the right to human review of any decision made solely on the basis of automated processing that significantly affects you.
• We conduct Privacy Impact Assessments before deploying new technologies that process personal information, as required by Law 25.

Our Privacy Officer can be reached at legal@usekima.com.

10. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including:

• Encryption in transit (TLS 1.2+) and at rest for all personal data
• Access controls limiting data access to authorised personnel only
• Canadian-hosted infrastructure for platform data
• Regular security assessments of our platform and sub-processors
• 7-day expiry on document upload links (DealCheck)

In the event of a privacy breach that poses a real risk of significant harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by PIPEDA, within 72 hours of becoming aware of the breach.

11. Children

Kima's services are designed for licensed mortgage professionals and are not directed at individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us at legal@usekima.com and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. When we do, we will update the effective date at the top of this page. For material changes, we will notify active users by email at least 30 days before the change takes effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

13. Contact us

We aim to respond to all privacy requests within 30 days. If your request is complex, we may extend this by an additional 30 days and will notify you accordingly.