Legal

Privacy Policy

Effective May 18, 2026

Mortgage Pipeline Machine ("MPM", "we", "us") is operated by Bibek Bhandari as a sole proprietor. This policy explains what data we collect, why we collect it, who we share it with, and the rights you have over it. It is written in plain language because it is meant to be read.

1. Data we collect

From you (the broker, our customer)

Account data: name, email, phone, brokerage name, city, province — collected during signup and saved in your broker profile.
Authentication data: email + hashed password, or Google OAuth identity — stored by Supabase (our auth provider).
Deployment data: your Google Sheet ID, n8n domain, webhook URLs, rate-lock threshold — used to configure your private dashboard.
Activity logs: page views inside the app, sign-in events, configuration changes — for support and audit.
Payment data: handled entirely by Stripe — we never see your card details. We receive only the metadata Stripe sends us (charge confirmations, invoice IDs).

From your clients (the mortgage applicants)

When you deploy MPM, you connect it to a Google Sheet that you own. Your clients' data — names, emails, phone numbers, loan amounts, property addresses, employment details — lives in your Google Sheet, in your Google Drive. We never copy or store this data on our servers. We never see it unless you explicitly share it with us during a support session.

From visitors to this website

We do not use Google Analytics, Facebook Pixel, or any third-party tracking script. The website does not set marketing cookies. The only client-side storage is the Supabase session token (so you stay signed in across page refreshes).

2. How we use your data

Run the service: provision and operate your dashboard, send transactional emails (welcome, password reset, deployment status), respond to support.
Improve the product: aggregated, anonymized usage patterns help us prioritize what to build next.
Comply with law: tax records, contractual records, anything legally required of a Canadian sole proprietor.

We do not use your data to train AI models. We do not sell your data to anyone. Ever.

3. Who we share data with (sub-processors)

To deliver the service, we rely on the following providers. Each is bound by their own privacy commitments — links go to their policies.

Supabase — authentication and broker profile storage. EU/US regions available; we pick the closest to you.
Cloudflare — website hosting (Cloudflare Pages) and CDN.
Calendly — discovery and kickoff call booking.
Stripe — payment processing.
Google — Gmail (for sending and OAuth), Google Sheets (your CRM), Google Cloud (API key for Sheets reads).
n8n Cloud — workflow execution for your deployment.

Important — Google data handling

Your dashboard accesses your Google Sheet via a restricted, read-only API key you generate in your own Google Cloud project. We never receive a refresh token. Your Gmail OAuth connection lives in your own n8n credentials — we configure it, but it's bound to your Google account, and you can revoke it at myaccount.google.com/permissions at any time.

4. Your rights

Under PIPEDA (Canada), GDPR (EU), and CCPA (California), you have the right to:

Access any personal data we hold about you
Correct inaccurate data
Delete your account and associated data (right to be forgotten)
Export your data in a portable format (JSON or CSV)
Object to certain processing or withdraw consent
Complain to your local data protection authority

To exercise any of these, email mortgagepipelinemachine@gmail.com with "Data Request" in the subject. We respond within 5 business days.

5. Data retention

Active account: data retained for the life of your retainer.
Cancelled account: profile and activity logs deleted within 30 days of cancellation. Your Google Sheet remains in your Drive — we never touch it.
Billing records: retained 7 years for Canadian tax compliance, then deleted.

6. Security

We follow industry baseline practices:

All traffic over HTTPS (TLS 1.3, HSTS preloaded).
Database encrypted at rest by Supabase. Row-level security limits each broker to their own data.
Passwords hashed with bcrypt by Supabase Auth — never stored in plaintext.
Service-role keys held only by Bibek, never embedded in client code.
Sub-processor list above is the only third parties with any access.

No system is 100% secure. If we ever experience a breach affecting your data, we'll notify you within 72 hours per GDPR Article 33.

7. International transfers

Supabase, Cloudflare, Calendly, Stripe, Google, and n8n may process data in the US, EU, or Canada depending on region. By using MPM you consent to these cross-border transfers, which are covered by Standard Contractual Clauses where required.

8. Children

MPM is a B2B service for licensed mortgage brokers. We do not knowingly collect data from anyone under 18.

9. Changes to this policy

If we make a material change, we'll email all active customers at least 30 days before it takes effect. Non-material changes (typo fixes, clarifications) we just publish.

10. Contact

Bibek Bhandari · mortgagepipelinemachine@gmail.com