Privacy Policy

To match you with brokers and produce comparable quotes, we collect:

• Contact: first name, email, phone, preferred language.
• Risk facts (auto): vehicle year/make/model/VIN/annual km, driver licence class and years licensed, tickets and at-fault claims history, current carrier and continuous coverage.
• Risk facts (home): property type, year built, square footage, coverage limits, prior claims.
• Postal code for service-area matching.
• Anti-abuse signals: form-completion time, browser fingerprint, IP address, user agent.
• Verification: email and phone one-time codes (we store the timestamp of verification, never the code).
• Consent records: the terms-version you accepted, the timestamp, your IP and user agent.

We do notcollect your driver’s licence number, date of birth (day), social insurance number, or banking information through our quote forms. Brokers may request these directly from you after you select them.

PIPEDA limits us to collecting only what is reasonably necessary for stated purposes. We use your information to:

• Match you to brokers licensed for your product line, region, and language.
• Let those brokers produce a comparable quote without seeing who you are.
• Verify you control the contact details you provided (phone/email OTP).
• Detect and block abuse (fake submissions, duplicates, automated scraping).
• Operate our service, respond to support requests, and comply with law.

Until you actively select a broker, brokers see only a maskedversion of your request: your first name, postal-code FSA (first three characters), preferred language, masked VIN (last four), an approximate driver age, and the risk facts above. Your full name, email, phone, full postal code, and full VIN are withheld from brokers until the moment you choose one. We log every PII access in an internal audit table you can inspect at /privacy-log.

When you select a broker, that one broker is granted access to your full contact and the documents needed to bind your policy. We never resell your information to third parties for marketing.

Your application data and primary database are hosted in Canada (Toronto, Ontario) on our own infrastructure. The following third-party sub-processors may receive limited data when their function is invoked:

• Stripe (US) — only when a broker pays a subscription invoice. Customers’ personal information is not sent to Stripe.
• Twilio (US) — phone number, for sending the verification SMS.
• Resend (US) — email address, for sending the verification email and quote notifications.
• Cloudflare — DNS resolution only; our DNS records are not proxied through Cloudflare, so requests to maplebind.ca reach our Toronto server directly.

We do not use Vercel or Neon. Earlier copy that listed them was wrong and has been corrected.

We retain quote-request data while it is active and for a defined window after it expires or is fulfilled, so we can support disputes, comply with insurance recordkeeping expectations, and improve matching. After that window we anonymize or delete it. You can ask us to delete identifiable data sooner — see “Your rights” below.

• TLS in transit; encryption-at-rest for documents.
• PII access is minimized at the data layer (masked-by-default queries).
• Every read of identifiable data by a broker is audited in pii_access_audit.
• Administrative access is role-gated and limited to platform administrators.
• SSH to our server is key-only; password authentication is disabled.

No system is perfect. If you believe your account has been compromised, contact privacy@maplebind.ca immediately.

Under PIPEDA (and Law 25 in Québec) you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Withdraw consent for future processing and request deletion of identifiable data we are not legally required to keep.
• Lodge a complaint with our Privacy Officer, and, if unresolved, with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d’accès à l’information du Québec.

To exercise any of these rights, contact our Privacy Officer at /legal/dpo. We respond within 30 days under PIPEDA (14 days under Law 25 where applicable).

We use a small number of strictly necessary cookies for authentication, language preference, and anti-abuse fingerprinting. We do not use third-party advertising cookies.

When this policy changes materially we will update the “Last updated” date above and, where you have an account, notify you by email. We record the terms-version you accepted at submission so we can show you what you agreed to.