Privacy Policy

SimplyBorrowed Inc. · Version 2026-10-23 · Effective October 23, 2026 for new customers and November 22, 2026 for existing customers

SimplyBorrowed Inc. (SimplyBorrowed, we, us) offers consumer loans to residents of Ontario, Canada. This policy explains what personal information we collect, why we use it, who receives it and the choices available to you. It applies to our website, customer portal and communications with you.

1. Who is responsible

SimplyBorrowed Inc., 231 Oak Park Blvd, Suite 301, Oakville, ON L6H 7S8, is responsible for personal information under its control. Our Privacy Officer oversees our privacy practices. Send privacy enquiries, access requests and complaints to info@simplyborrowed.ca, addressed to the Privacy Officer, or write to the address in section 14.

2. What we collect

• Identity and contact information: your name, date of birth, email address, telephone number and address.
• Identity and eligibility evidence: the document you upload to show your status in Canada, and the results of identity verification. Certn verifies your identity by comparing a photo of your face with your identification document and checking that a live person is completing the verification. We receive and keep the images of the front and back of your identification document, the photo of your face and Certn’s overall result. We do not receive biometric templates or liveness scores.
• Employment and income information: your employer, job title, employment type and income range, and information you provide to support your application.
• Banking information: with your authorisation, Zum Rails retrieves your account details and the transaction history it makes available for the accounts you connect. We may retrieve the information covered by that authorisation again while we assess your application or manage your loan, for example after you change your bank account. Connecting a different account requires your new authorisation. We never receive or store your online banking password.
• Credit information: only after your express consent, we obtain your credit report and score from Equifax to assess your application. We do not obtain new reports while servicing your loan under that consent. A new application that requires a report needs your new consent.
• Loan information: your applications, loan terms, payments, missed payments and communications about your application or loan.
• Website and portal usage information: device and browser information, IP addresses, pages visited and cookies or similar technologies, as described in section 10.

3. Why we use your information

• To verify your identity and assess your eligibility, creditworthiness and capacity to repay.
• To prepare and sign your loan agreement, disburse funds, collect payments and administer your loan.
• To communicate about applications, accounts, payments, enquiries and complaints.
• To prevent and investigate fraud, protect our services, resolve disputes and meet our legal and record-keeping obligations.
• With your express marketing consent, to send promotional emails and text messages, as described in section 9.

We explain our purposes at or before collection and obtain consent where required by law. We do not require consent to uses beyond what is necessary to provide the product or service you request. Optional marketing consent is separate from your loan application, and declining it does not affect your eligibility or existing loan. If we propose a new purpose that requires additional consent, we explain it and obtain that consent first. We do not sell your personal information.

4. Automated assessment and staff review

We use automated systems and AI tools, including tools provided by our service providers, to assist with application assessment. They help review the completeness and apparent authenticity of identity and eligibility documents, categorise banking transactions, estimate repayment capacity and prepare application summaries. They may identify inconsistencies or ask you for further information. Their outputs can contain errors.

The system can decline an application automatically by applying our criteria, for example when Equifax has no credit file for you, when you decline the credit check, or when an application is not completed within the time allowed. Every loan approval and release of funds requires individual approval by a SimplyBorrowed staff member. Standard offers are approved in advance and are not individually approved each time they are presented.

You can request a staff review of an automated decline, an application decision or a request for further documents by emailing info@simplyborrowed.ca. Staff apply the same criteria. A review does not guarantee approval or a different outcome, and you may point out errors and provide relevant information.

We do not use customer information to train, test or improve models, and we do not plan to.

5. Who receives your information

We disclose personal information only as necessary for the purposes in this policy, subject to consent requirements and legal restrictions. Service providers receive personal information to provide services to us, including:

• Banking data and payments: Zum Rails.
• Credit reports: Equifax, as described below.
• Identity verification: Certn.
• Electronic signatures: DocuSign.
• AI-assisted application review: PurpleLab, as described in section 4.
• Other services: hosting and file storage, sign-in, email and text messages, customer administration, accounting, document and transaction reading, transaction categorisation, system logs and error monitoring.

A current list of our service providers is available on request at info@simplyborrowed.ca.

We remain accountable for personal information transferred to providers for processing on our behalf, and we use contracts to limit their use of it to the services they provide to us. Some organisations, such as credit bureaus and financial service providers, may also have their own obligations and purposes, which we explain when we ask for any authorisation they require.

Credit bureau: with your express consent, we obtain credit information from Equifax during your application. We do not currently report loan balances or payment history to Equifax or any other credit bureau. Before we start, we will explain the reporting and obtain any authorisation required by law.

Other lawful disclosures: we may disclose relevant information where authorised or required by law, including to respond to lawful demands, prevent fraud or collect a debt.

Business transactions: where permitted by law, we may disclose information necessary to evaluate or complete a proposed financing, merger, acquisition or similar transaction. Recipients must agree to use it only for the transaction, protect it and return or destroy it if the transaction does not proceed. We use aggregated or de-identified information where it is enough for the purpose.

6. Processing locations and provider safeguards

We store your files with Amazon Web Services in Canada, and Google Cloud reads your documents and transaction descriptions in Montreal. Other providers store or process information outside Canada, mainly in the United States: our portal is hosted by Heroku in the United States, and transaction categorisation, AI-assisted review, system logs and error monitoring run in the United States. Information outside Canada is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement and other public authorities. We remain accountable for it and use contracts and other measures to provide a comparable level of protection. PurpleLab may use your information only to provide its services to us, under a written data processing agreement.

7. Retention and deletion

We keep personal information only as long as reasonably necessary for the purposes for which it was collected. For applications and loans that end on or after October 23, 2026, we delete or anonymise your personal information 12 months after your application is declined or abandoned, or 12 months after your loan is paid in full. We keep a record of each loan (amount, terms, payments and agreement) as required for legal, tax and accounting purposes. Information from applications and loans that ended earlier is being reviewed and deleted progressively under the same rule.

Where an investigation, dispute or legal obligation requires us to keep specific records, we keep them for the necessary period and restrict their use. Providers that process information for us must follow our retention and deletion instructions. Copies in backups are deleted as the backups expire and remain protected until then.

8. Your rights and choices

• Access and correction: you may request access to your personal information and ask us to correct inaccuracies by emailing info@simplyborrowed.ca. We may verify your identity before responding. We respond within 30 days unless the law permits an extension; if we extend, we tell you within the first 30 days, explain why and give the new deadline, and remind you of your right to complain to the Office of the Privacy Commissioner of Canada. If an exception applies, we explain any refusal and your complaint options.
• Withdrawing consent: you may withdraw consent, subject to legal or contractual restrictions and reasonable notice. We explain the consequences. Withdrawing optional marketing consent does not affect your loan. Withdrawing consent necessary to assess an application may prevent us from completing it. Withdrawal does not cancel an outstanding debt.
• Deletion: when you have no active loan, you can delete your information from your profile page. You may also request deletion at any time by emailing info@simplyborrowed.ca, including while a loan is outstanding; we answer within 30 days and explain anything we must keep under section 7.
• Complaints: contact our Privacy Officer at info@simplyborrowed.ca. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. Our internal process does not limit your right to raise concerns externally.

9. Marketing communications

We send promotional emails and text messages only after you expressly opt in. Marketing consent is separate from applying for or maintaining a loan. You may unsubscribe using the mechanism in a message or by emailing info@simplyborrowed.ca. We process unsubscribe requests without delay and no later than 10 business days after receipt. We may continue necessary application, account, payment, security and legal communications where permitted by law.

10. Cookies and analytics

Our customer portal uses only the cookies and similar storage needed for sign-in and security; it has no analytics or advertising trackers. Our public website, simplyborrowed.ca, uses Google Analytics to understand website usage. We do not use Google Ads or Meta advertising technologies, and we do not send customer information or application activity to advertising platforms. You can block or delete cookies in your browser settings, and contact info@simplyborrowed.ca with questions.

11. Security and breaches

We use administrative, technical and physical safeguards appropriate to the sensitivity of personal information. Connections to our portal and systems are encrypted, staff access depends on their role, and documents are shown through links that expire after 10 minutes. If a breach of personal information under our control creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as required by law. We keep records of breaches as required by law.

12. Intended audience

Our lending services are intended for Ontario residents aged 18 or older. We do not knowingly accept loan applications from minors. If we discover that a minor has submitted personal information, we delete it unless it is required for a lawful purpose. Eligibility requirements appear in section 1 of our Customer Portal Terms and Conditions.

13. Changes to this policy

We explain material changes and their effective date by email or through a prominent notice in the customer portal at least 30 days before they take effect. If a change must take effect sooner to comply with law or address an urgent security issue, we give as much notice as reasonably possible and explain why. Where a change requires additional consent, we obtain it before applying the changed practice to your information; publishing a revised policy or your continued use of our services does not replace that consent.

14. Contact

Privacy Officer · SimplyBorrowed Inc. · 231 Oak Park Blvd, Suite 301, Oakville, ON L6H 7S8 · info@simplyborrowed.ca