Privacy Policy

1. Introduction

Closact Inc. ("Closact," "we," "us," or "our") is committed to protecting the privacy and security of personal information entrusted to us in connection with our AI-powered secured loan closing platform and related services (collectively, the "Services"), accessible at www.closact.ai (the "Website").

This Privacy Policy (this "Policy") describes the types of personal information we collect, the purposes for which we collect and use it, how we disclose it, and the rights and choices available to individuals with respect to their personal information. We adhere to the ten fair information principles underlying Canadian federal and provincial privacy legislation: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use and Disclosure, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

This Policy applies to all users of our Website and Services, including lending professionals, law firms, and other individuals who access or use our platform. In the event of a conflict between this Policy and any other agreement between you and Closact with respect to privacy matters, this Policy shall govern.

Please read this Policy carefully. By accessing our Website or using our Services, you indicate that you have read and understood this Policy and the purposes for which personal information is processed. If you do not agree with our policies and practices, you must not access or use our Website or Services. We will notify you of material changes to this Policy (see Section 17). Your continued use of the Website or Services after we post changes and provide notice indicates your acceptance of those changes.

2. About Closact

Closact Inc. is a corporation incorporated under the laws of the Province of Alberta, Canada. Our principal place of business is located in Alberta, Canada. We operate as an artificial intelligence-enabled platform designed to facilitate and streamline secured loan closing transactions, including AI-powered commitment letter processing, loan transaction facilitation, loan document generation, government registry integration, and digital closing coordination.

For the purposes of Canadian privacy legislation, Closact acts as the organization responsible for personal information under its custody or control, as contemplated by the Personal Information Protection Act (Alberta) (S.A. 2003, c. P-6.5) ("Alberta PIPA") and the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) ("PIPEDA"), as applicable.

Closact has designated a Privacy Officer with overall responsibility for our compliance with applicable privacy legislation. The contact details for our Privacy Officer are set out in Section 18 of this Policy.

3. Definitions

In this Policy, the following terms have the meanings set out below:

"Business Contact Information" means an individual's name, title, business address, business telephone number, business fax number, and business email address when used for the purpose of communicating or facilitating communication with that individual in relation to their business, employment, or profession. Business Contact Information is generally excluded from the definition of personal information under applicable Canadian privacy legislation.

"Personal Information" means any information about an identifiable individual, that is, information that can be used on its own or in combination with other information to identify, contact, or locate a specific person. Personal Information does not include Business Contact Information or information that has been de-identified or aggregated such that no specific individual can reasonably be identified.

"Privacy Laws" means applicable laws relating to privacy, data protection, information security, and data breach notification in the applicable jurisdiction, including PIPEDA, Alberta PIPA, the Personal Information Protection Act (British Columbia) (S.B.C. 2003, c. 63) ("BC PIPA"), and any successor or replacement legislation, and, where applicable, US privacy laws including the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the New York SHIELD Act.

"Online Portal" means the secure, web-based interface through which authorized users access and use the Services.

"Services" means the AI-powered secured loan closing platform, software, and related services provided by Closact through the Online Portal and Website.

"Software" means Closact's proprietary AI-powered secured loan closing software application, including all algorithms, models, features, interfaces, and related functionality made available through the Services.

4. Scope of this Policy

This Policy applies to: (a) personal information collected through the Website, including information submitted through contact forms, account registration, and related interactions; (b) personal information collected in connection with the Services, including information uploaded or submitted by authorized users in the course of their use of the platform; (c) personal information of end clients or transaction parties (including borrowers, guarantors, and property owners) whose information is processed through the Services by authorized users; and (d) personal information collected from prospective customers, business partners, and other individuals who contact Closact.

This Policy does not apply to the personal information of Closact employees, contractors, or job applicants, which is governed by separate internal policies.

Note on Closact PC: Closact PC, a professional law corporation affiliated with Closact, processes personal information as an independent controller for the purposes of providing legal services under its Engagement Letter with customers. Closact PC's data processing obligations are governed separately by the Engagement Letter and applicable Privacy Laws. Individuals whose personal information is processed by Closact PC should refer to Closact PC's engagement letter and applicable professional obligations.

Note on B2B Data Processing: Enterprise customers who have entered into a services agreement with Closact may be subject to additional data processing obligations under that agreement. This Policy governs privacy practices applicable to all individuals whose personal information is collected through the Website or Services.

5. Information We Collect

5.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us, including: Account and Registration Information (name, email address, telephone number, professional role or title, organization name, account credentials); Transaction and Closing Data (real property descriptions, legal descriptions, parties to a transaction including buyer, seller, borrower, guarantor, lender, and other principals, closing and registration dates, purchase prices, mortgage details); Uploaded Documents (commitment letters, agreements of purchase and sale, title documents, mortgage commitment letters, identification documents, corporate records, declarations); Identification Information required under applicable law society rules, which may include government-issued identification details; Correspondence and Communications when you contact us for support, submit feedback, or respond to surveys; and Billing and Payment Information processed through our third-party payment processors. We do not store full payment card numbers on our systems.

5.2 Information Collected Automatically

When you access or use the Website or Services, we and our service providers may automatically collect Log and Device Data (IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, time spent, date and time of visit), Usage and Activity Data (feature usage patterns, search queries, transaction workflow steps, and interactions with platform functions), and Cookies and Similar Technologies as described in Section 15.

5.3 Information from Third Parties

We may receive personal information about you from Integration Partners (e.g., title search providers, document management systems, identity verification services); Authorized Users and Organizations that have provided you with access to the Services; Customer-Provided Data, where customers uploading commitment letters and initiating loan transactions represent and warrant that they have authority to provide information about borrowers, guarantors, and others whose information is contained in submitted data for the purpose of delivering the Services; and Publicly Available Sources such as land registry records, corporate registry information, and court records.

5.4 Limiting Collection

We will collect personal information only by fair and lawful means and will limit the amount and type of personal information collected to that which is reasonably necessary to fulfill the identified purposes. We do not collect personal information indiscriminately.

6. Purposes for Collection, Use, and Disclosure

We will identify, at or before the time of collection, the purposes for which personal information is collected. Our primary purposes are: Provision of the Services; Artificial Intelligence Processing (see Section 7); Customer Support; Security and Fraud Prevention; Legal Compliance, including obligations under applicable privacy, anti-money laundering, and professional regulatory frameworks; Improvement of the Services, using de-identified or aggregated data wherever practicable; Communications, including transactional and administrative notices and CEMs where consent has been provided as permitted by Canada's Anti-Spam Legislation (CASL); Business Operations; and use of De-identified and Aggregated Data for legitimate business purposes such as product development, analytics, and benchmarking.

We will not use or disclose personal information for purposes other than those for which it was collected, except with your consent or as required or permitted by applicable Privacy Laws.

7. Artificial Intelligence Processing

7.1 How We Use AI

Closact's Services are powered by artificial intelligence and machine learning technologies. When you upload documents or input data into the platform, that information is processed by AI systems to extract structured information, identify parties and key terms, flag anomalies, generate summaries, and assist in preparing closing and loan documentation. This processing is integral to the delivery of the Services and is performed on the basis of your agreement to our Terms of Use and, where applicable, your Pilot Services Agreement or SaaS Agreement. We use both proprietary AI models and third-party AI infrastructure providers (including large language model providers). Documents and data processed through these systems may be transmitted to and processed by such third-party providers' systems, subject to appropriate data processing agreements and confidentiality obligations. A current list of our AI sub-processors is available upon written request to legal@closact.ai.

7.2 No Model Training on Customer Data

Closact does not use customer documents, transaction data, or related personal information to train or fine-tune AI models. Customer-submitted data is processed only to provide the requested extraction, drafting, registry, signing, and closing workflow functions.

Our authorized AI provider processes submitted document text to return results to Closact and is contractually prohibited from using that data to train its models. We may improve the Services using de-identified or aggregated operational information that does not identify a customer, transaction, or individual.

Note for California Residents: Legal and financial documents submitted through the Services may constitute "sensitive personal information" under the California Privacy Rights Act (CPRA). California residents have the right to direct Closact to limit the use of sensitive personal information to purposes strictly necessary for providing the Services. To exercise this right, please contact us at legal@closact.ai.

7.3 Automated Decision-Making

Where the Services involve automated processing of personal information that produces legal or similarly significant effects on individuals, we will ensure that such individuals are informed and, where required by applicable Privacy Law, provided with the opportunity for human review. To inquire whether a particular use of the Services involves such automated decision-making, please contact us at legal@closact.ai.

8. Accuracy

We will make reasonable efforts to ensure that personal information in our custody or control is as accurate, complete, and up-to-date as necessary for the purposes for which it is used. We rely on individuals and customers to provide us with accurate and current information, and to inform us of any changes. Where personal information is used on an ongoing basis to make decisions affecting an individual, we will take additional steps to ensure accuracy. Please contact us at legal@closact.ai if your personal information requires correction.

9. Disclosure of Personal Information

We do not sell, rent, or trade personal information to third parties for monetary consideration or for their own marketing purposes. We may disclose personal information to: Service Providers and Sub-Processors (cloud infrastructure and hosting providers, AI and machine learning model providers, document storage and management providers, identity verification and KYC/AML service providers, customer support and communications platforms, analytics and monitoring services, payment processing providers), all engaged under written agreements that impose confidentiality obligations and prohibit use of personal information for any purpose other than the specific purpose for which we supply it; Authorized Users and Organizations linked to your account; Transaction Parties in the normal course of facilitating a secured loan closing (opposing counsel, lenders, title insurers, land registries, government authorities, digital signature platforms); Subsidiaries and Affiliates bound by privacy obligations consistent with this Policy; in connection with Business Transfers, including any merger, acquisition, reorganization, amalgamation, or sale of assets, where we will require any successor entity to honour the commitments made in this Policy; to comply with Legal Requirements and Public Interest, including legal obligations, court orders, regulatory requests, the establishment, exercise, or defence of legal claims, the protection of rights, property, or safety, and fraud prevention; and otherwise With Your Consent.

10. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Factors include the nature and sensitivity of the information; the purpose for which it was collected and whether that purpose has been fulfilled; applicable legal, regulatory, or professional retention requirements (including obligations arising under real estate, legal, and financial regulations in British Columbia, Alberta, and Ontario); whether the information is subject to an ongoing legal proceeding, investigation, or regulatory inquiry; and the user's or organization's continued subscription. Upon expiry of the applicable retention period, personal information will be securely deleted, destroyed, or de-identified. To request information about specific retention periods applicable to your data, please contact us at legal@closact.ai.

11. Data Security and Safeguards

The security of your personal information is very important to us. We implement and maintain technical, administrative, and physical safeguards appropriate to the sensitivity of the personal information in our custody, including: Technical measures (encryption of data in transit and at rest using industry-standard protocols, access controls, role-based permissions, multi-factor authentication, firewalls and intrusion detection systems); Administrative measures (employee training on data security and privacy practices, security clearances and need-to-know access, written data security policies, incident response procedures); and Physical measures (restricted physical access to systems and facilities, secure disposal and destruction of personal information in physical formats). We require our service providers to provide a comparable level of protection.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) credentials for access to the Services, you are responsible for keeping those credentials confidential and not sharing them with anyone.

Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure. In the event of a security incident involving your personal information, we will notify you and, where required, applicable regulatory authorities, in accordance with our obligations under applicable Privacy Laws.

12. Cross-Border Transfers of Personal Information

Closact is headquartered in Alberta, Canada. Personal information collected through the Website and Services is stored in Canada. However, we engage service providers and AI infrastructure partners, including certain AI model and cloud computing providers, that operate in or process data in the United States. As a result, your personal information may be transferred to and processed in the United States in connection with the delivery of the Services.

When your personal information is transferred to or processed in the United States, it will be subject to United States federal and state law, and the governments, courts, law enforcement, or regulatory agencies of the United States may be able to obtain access to your personal information in accordance with applicable law, including under the USA PATRIOT Act, the Foreign Intelligence Surveillance Act, and other applicable legislation.

Where such transfers occur, we take steps to ensure that appropriate contractual protections are in place (such as data processing agreements and standard contractual clauses) so that your personal information continues to receive a level of protection consistent with applicable Canadian privacy legislation. You are welcome to contact us at legal@closact.ai for further information about our policies and practices regarding service providers located in the United States, including a list of the countries in which our service providers operate. By using the Services, you acknowledge that your personal information may be transferred to and processed in the United States, which may have different privacy laws than those in your province or country of residence.

13. Your Privacy Rights

13.1 Rights Under Canadian Privacy Legislation (Alberta PIPA and PIPEDA)

If you are located in Canada, you have, subject to applicable exceptions under Alberta PIPA and PIPEDA: the Right of Access to the personal information we hold about you, the purposes for which it is used, and the third parties to whom it has been disclosed (subject to legally permissible exceptions, including solicitor-client privilege and the rights of other individuals); the Right to Correct personal information that is inaccurate or incomplete; the Right to Withdraw Consent, subject to legal or contractual restrictions and reasonable notice; and the Right to Challenge Compliance with this Policy and applicable privacy legislation (see Section 18). To exercise any of these rights, submit a written request to legal@closact.ai. We will acknowledge your request and respond within thirty (30) days, or within such extended period as permitted under applicable law. We may need to verify your identity before processing your request.

13.2 Note for Quebec Residents

The Services are not currently available to Quebec residents. Residents of Quebec may access the public Website at www.closact.ai, but are not eligible to register for or use the Services at this time. Accordingly, Section 13.1 above reflects the privacy rights applicable to residents of other Canadian provinces where the Services are offered. Quebec residents who have privacy inquiries related to their use of the Website may contact our Privacy Officer at legal@closact.ai.

13.3 Rights of California Residents (CCPA/CPRA)

This Section 13.3 applies to residents of the State of California, United States, to the extent Closact is subject to the CCPA/CPRA. California residents have the Right to Know the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it; the Right to Delete personal information we have collected from you, subject to certain exceptions; the Right to Correct inaccurate personal information; the Right to Opt-Out of Sale or Sharing (we do not sell personal information for monetary consideration and do not share personal information for cross-context behavioral advertising purposes); the Right to Limit Use of Sensitive Personal Information to uses necessary for providing the Services; and the Right to Non-Discrimination. To submit a CCPA/CPRA rights request, please contact us at legal@closact.ai. We will acknowledge receipt within ten (10) business days and respond substantively within forty-five (45) calendar days, subject to any permitted extensions. We may need to verify your identity, and you may designate an authorized agent to submit a rights request on your behalf by providing written authorization to us.

13.4 Rights Under New York Law

Closact complies with the New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act), which governs the security of private information of New York residents. In the event of a data breach affecting your private information as defined under the SHIELD Act, we will provide notification in accordance with our obligations thereunder. We will continue to monitor developments in New York privacy legislation and update this Policy as necessary.

14. CASL and Marketing Communications

We will only send commercial electronic messages ("CEMs") to you, including promotional emails, newsletters, and other marketing communications, where we have obtained your express or implied consent in compliance with Canada's Anti-Spam Legislation (CASL) (S.C. 2010, c. 23). Each CEM will include accurate identification of Closact as the sender, our physical mailing address and contact information, and a clear and functional unsubscribe mechanism. You may withdraw consent at any time by clicking the "unsubscribe" link in any CEM, emailing legal@closact.ai with your unsubscribe request, or adjusting your communication preferences in the Online Portal (if applicable). We will process unsubscribe requests within ten (10) business days. Opting out of CEMs does not affect your receipt of transactional or administrative notices necessary for the operation of your account or the delivery of the Services (such as account confirmations, service alerts, or security notices).

15. Cookies and Tracking Technologies

15.1 Types of Technologies Used

As you navigate through and interact with our Website, we and our service providers may use cookies and similar technologies, including: Essential Cookies for core Website functionality, user sessions, and authentication; Performance and Analytics Cookies to understand usage patterns and improve performance; Functional Cookies to remember preferences and settings; and Web Beacons (also referred to as clear gifs, pixel tags, or single-pixel gifs) on Website pages and emails to count users and gather related statistics.

15.2 What We Do Not Do

We do not use cookies or other tracking technologies to serve interest-based or behavioral advertising, or to track your online activities across third-party websites or online services for advertising purposes. If this practice changes in the future, we will update this Policy and provide you with appropriate notice and choice.

15.3 Your Cookie Choices

Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device. You may adjust your browser settings to refuse or delete certain cookies; however, disabling cookies may affect the functionality of the Website. For more information, refer to your browser's help documentation or visit the Digital Advertising Alliance of Canada at www.youradchoices.ca.

15.4 Do Not Track

Some browsers transmit "Do Not Track" signals to websites. Because no consistent industry standard for responding to such signals has been established, our Website does not currently respond to "Do Not Track" browser signals. We will update this Policy if our practices change.

16. Third-Party Links and Integrations

The Website or Services may contain links to third-party websites or integrate with third-party services (including document management platforms, land registry portals, digital signature services, and professional association systems). This Policy does not apply to such third-party websites or services, and we are not responsible for their privacy practices. We have no control over the contents of any such third-party sites and accept no responsibility for any loss or damage that may arise from your use of them. We encourage you to read the privacy policy of every website you visit or third-party service you use.

17. Changes to this Privacy Policy

It is our policy to post any changes we make to this Policy on our Website with a notice that the Policy has been updated. The date of the most recent revision is shown at the top of this page. If we make material changes to how we collect, use, or disclose personal information, we will provide more prominent notice, which may include posting a notice on the Website homepage, sending a notification to the email address associated with your account, or providing an in-platform notification. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically visiting our Website and reviewing this Policy for changes. Where your prior consent is required by applicable Privacy Laws to implement a change, we will seek such consent before implementing the change.

18. Contact Information, Complaint Handling, and Challenging Compliance

18.1 Privacy Officer

Closact has designated a Privacy Officer who is responsible for overseeing our compliance with applicable Privacy Laws and for handling privacy-related inquiries, access requests, and complaints.

Privacy Officer, Closact Inc.
1603 – 215 13 Ave SW, Calgary, Alberta, Canada T2R 0V6
Email: legal@closact.ai  |  Website: www.closact.ai

18.2 Submitting an Inquiry or Request

To exercise any of the rights described in this Policy, to withdraw consent, to request access to or correction of your personal information, or to ask questions about our privacy practices, please contact our Privacy Officer using the contact information above. We will acknowledge your request promptly and respond within the timeframe required by applicable Privacy Law. We may need to verify your identity before processing any rights request.

18.3 Complaint Handling Process

If you have a concern or complaint, please submit a written complaint to our Privacy Officer at legal@closact.ai, describing the nature of your concern and the relief you are seeking. We will acknowledge your complaint promptly, typically within five (5) business days, investigate all written complaints, and communicate our findings and decision to you in writing within a reasonable time. If your complaint is found to be justified, we will take appropriate measures to resolve it, which may include amending our practices, correcting your personal information, or providing a remedy, as applicable.

18.4 Escalation to Regulatory Authorities

If you are not satisfied with our response, or if you believe we have not complied with applicable Privacy Laws, you have the right to escalate the matter to the applicable privacy authority: Alberta: Office of the Information and Privacy Commissioner of Alberta (www.oipc.ab.ca); British Columbia: Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca); Ontario / Federal: Office of the Privacy Commissioner of Canada (www.priv.gc.ca); California: California Privacy Protection Agency (cppa.ca.gov) or California Attorney General's Office (oag.ca.gov/privacy); and New York: New York Attorney General's Office (ag.ny.gov).