For the purposes of UK data protection law:

• Data Controller: Mortgage AI Toolkit Ltd
• Registered office: Unit 13 The Oak Trees Business Park, The Courtyard, Orbital Park, Ashford, Kent, UK TN24 0SY
• Contact email: collibry@mortgageaitoolkit.com

Collibry processes personal data on behalf of business customers and acts as a data processor and process personal data for its own business purposes (for example, account management and billing), and acts as a data controller.

Collibry is a web-based video meeting platform accessible via web browsers on computers, tablets, and mobile devices, with no separate desktop or native mobile applications. It is primarily designed for mortgage advisors, enabling them to conduct client consultations efficiently using features tailored to mortgage advisory workflows, including structured checklists for collecting and managing client information during meetings. Collibry is committed to protecting personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When a user signs up for and uses Collibry, we collect and process limited personal data necessary to create and manage user accounts, provide our services, and administer meetings and subscriptions. At sign-up, this includes a required email address and, where provided, optional information such as first and last name, username, and a profile photo.

In the course of using the platform, we also process user account details, meeting participant information (such as names and email addresses used for invitations), guest information (limited to a name and stored temporarily), meeting-related details (including titles, descriptions, participant lists, and duration), basic usage metrics (such as number of participants), and limited payment-related information, such as subscription status. Bank card details are not stored; only payment identifiers are retained.

Personal data means: any information relating to an identified or identifiable individual, including information that Collibry can link to a specific person. When you use or interact with Collibry products and services, we may collect personal data directly from you or process personal data on behalf of our customers. This may include the following categories of personal data:

• Account Information: Information associated with an account that licenses Collibry products and services, including the administrator's name, contact details, account ID, billing and transaction information, and account plan details.
• Profile and Participant Information: Information linked to a Collibry user profile or provided by participants joining a meeting, whether licensed or unlicensed. This may include name, display name, profile picture, email address, phone number, job- related information, user ID, and other information provided by the user and/or the account owner.
• Contact Information: Contact details added by accounts or licensed users to create contact lists within Collibry services, including information integrated from third- party applications or provided for the purpose of sending referral or invitation communications.
• Settings Information: Information relating to account or user preferences and settings, such as audio and video settings, recording file locations, screen-sharing preferences, and other configuration details.
• Registration Information: Information provided when registering for a Collibry meeting, webinar, recordings, etc. which may include name and contact details, responses to registration questions, and any other information requested by the host.
• Device Information: Information about the computers, phones, and other devices used to access Collibry products and services, including details such as device identifiers, IP addresses (which may be used to infer general location), Wi-Fi information, and other device attributes such as battery level or Bluetooth signals.
• Meeting, Webinar, and Messaging Content: Content created or shared during meetings, webinars, chats, and other collaborative features ("Customer Content"), such as audio, video, messages, whiteboards, files, transcripts, Q&A submissions, and feedback. This may include your voice or image, depending on account settings and what you choose to share. Collibry employees do not access Customer Content unless authorised by the account owner or required for legal, security, or support purposes.
• Usage Information: Information about how users and their devices interact with Collibry products and services, including meeting participation, messaging activity, features used, performance data, interactions with third-party integrations, and use of Collibry's websites. Some usage data collection is optional and can be managed through diagnostic data settings.
• Email and Calendar Information: Limited information from Collibry's email and calendar services, including email metadata (sender and recipient addresses, time sent, and attachment size), calendar details relating to meeting invitations and scheduling.
• Third-Party Integration Content: Information from third-party services (such as email, calendars, or file storage) that account owners or users choose to integrate with Collibry. Collibry does not access this content unless authorised or required for legal, security, safety, or support reasons.
• Communications with Collibry: Information and content from your communications with Collibry, including support requests, virtual chat interactions, account-related enquiries, and feedback about our products and services.
• Information from Partners: Information received from third-party partners, such as business or market data providers and advertising partners, which may include company details, contact information, or information about interactions with advertisements.

• Personal data is used to operate and deliver Collibry's services, including user authentication, meeting creation and management, recordings and transcripts, AI- powered features, subscription and payment management, usage tracking, email notifications, and where enabled, Google Calendar integration.
• To support these activities, personal data is shared with trusted third-party service providers that assist with identity management, communications, payments, infrastructure, analytics, and integrations, including Stream.io, Stripe, MongoDB Atlas, AWS Bedrock (Anthropic), AssemblyAI, Google Calendar, and email service providers. All such providers process personal data in accordance with applicable data protection requirements.
• Collibry employees do not access or use Customer Content—including meeting, webinar, messaging, or email content (such as audio, video, files, chats, and similar collaborative content), unless authorised by the hosting account owner or required for legal, safety, security, or support purposes.
• Collibry does not use audio, video, chat, screen sharing, attachments, or other communications like Customer Content to train its own or any third-party artificial intelligence models.
• Where technically feasible and in accordance with applicable settings, Collibry uses personal data to provide its products and services to account owners and invited participants and providing customer support.
• Personal data is also used to manage relationships and contracts with account owners and others, including billing, subscription administration, compliance with contractual obligations, and facilitating payments to third-party developers in connection with purchases made through Collibry.
• Certain optional features involve additional processing. If enabled, local device video features - such as filters, studio effects, avatars, or gestures—may process more information about your movements solely to apply the selected effects; this data does not leave your device, is not retained, and cannot be used to identify you.
• Users may join Collibry meetings without creating an account however, guest participants access is limited to participation in live meetings only. In such cases, guest participants are only required to provide a name. And no email address or account-related data is collected or stored. Usernames and display names are optional for registered users.
• Collibry also supports integration with certain third-party services, such as Google Calendar, with additional third-party login or sign-in options available. Personal data is visible to and processed by meeting hosts and participants as necessary for meeting functionality, as well as by authorised Collibry personnel and trusted third-party service providers.
• Cookies and Tracking: Collibry uses a limited number of cookies strictly necessary for the operation of its platform. These cookies are used solely for essential purposes such as user authentication and session management and are required for the platform to function correctly. Collibry does not use analytics, performance, or marketing cookies, and no third-party analytics tools (such as Google Analytics) are currently deployed. Essential cookies may be used both on Collibry's website and within the web application to support secure access and maintain user sessions.
• Marketing and Promotions: With your consent or as allowed by settings, Collibry and its marketing partners may promote Collibry products and services. This may use general information from your product use, referral invitations, visits to our websites, and interactions online. We may also use this data to show you relevant ads or engage third-party partners to analyze your website or app activity. Customer Content is never used for marketing.
• Authentication, Security, and Safety: We use personal data to verify accounts, detect and prevent fraud or harmful activity, address security threats, protect public safety, and secure Collibry services. Automated tools may be used in limited circumstances to scan certain content—such as virtual backgrounds, profile images, emails from non-Collibry users, and files exchanged in chat to detect malware, illegal content, or security threats, in accordance with applicable law.
• Communication: We use personal data, including contact info and messages through our chat feature, to update you on products, services, your account, and changes to policies or terms. We also use it to respond to inquiries you send us.
• Legal Compliance: We may use personal data to comply with laws or legal requests, respond to government or law enforcement inquiries, participate in civil litigation, protect against fraud or unlawful activity, and enforce or investigate violations of our Terms of Service or policies.

Collibry shares personal data with third parties only with your consent or as allowed by law, including:

• Resellers: If you purchase Collibry products via a third-party reseller, the reseller may access user data, including meetings, webinars, and messages hosted by the account owner.
• Service Providers: Collibry works with third-party service providers to support and improve our products, technical infrastructure, and business services (e.g., payment processing, analytics, advertising). Vendors access personal data only as needed to provide services, under contractual and technical safeguards.
• Legal Reasons: Personal data may be shared to comply with law or legal requests, including from government or law enforcement. It may also be shared to investigate or enforce Terms of Service or policies; detect, prevent, or investigate fraud, abuse, or safety threats; protect rights, property, or resolve disputes; and fulfill corporate or social responsibility obligations.
• Marketing, Advertising, and Analytics Partners: Third-party partners may receive information for analytics, advertising, and marketing, including targeted ads based on your website activity. Data may be collected via cookies. You can manage cookie preferences in our Cookies Settings. Where required by law, consent will be obtained before sharing for marketing.
• Corporate Affiliates: Data may be shared with affiliates to provide integrated experiences across Collibry services and to prevent fraud, abuse, or safety threats.
• Change of Control: Personal data may be shared with potential buyers, their representatives, or participants during a sale, merger, acquisition, restructuring, or similar events, including bankruptcy.

When you send messages, join meetings or webinars, or use other collaborative features on Collibry, the content and information you share may be visible to, shared with, or processed by other individuals or organisations. This may include third parties outside the specific meeting, webinar, message, or collaboration.

• Account Owner: The account owner is the individual or organisation that registers for a Collibry account. Account owners typically appoint one or more administrators to manage the account and user permissions. Subject to their Collibry licence, account owners may add users, create and access user profile information, and invite others—including guests or unlicensed participants—to meetings or webinars hosted on their account. Collibry provides account owners with controls to manage how their account is used, including whether certain content (such as recordings or Collibry chat messages) may be created or shared, and which third-party apps may be enabled. Depending on account settings, account owners and authorised users may access personal data relating to participants who join meetings or webinars on their account or exchange messages with users on the account. Account owners may also influence what information Collibry and others can access and use.

  Account owners may have access to the following information:

  • Account and Product Usage: Information about how users and devices interact with the account, including chat activity involving their users, email addresses, IP addresses, device details, meeting and webinar participation, recording access, duration of participation, message timestamps, integrations used, and related usage metrics.
  • Participant Lists: Information about participants in meetings, webinars, or chats, which may include names, display names, email addresses, phone numbers, and participant or user IDs.
  • Registration Information: Information provided when registering for meetings, webinars, Collibry Rooms, or recordings hosted on the account.
  • Collibry Chat and Features: Where enabled, account owners and authorised users may view information about Collibry chat activity involving their users, including sender and recipient details, timestamps, and participant counts. Depending on account settings, this may also include access to message content and shared materials such as files, and images.
  • In-Meeting and Webinar Messages: Depending on account settings, account owners may be able to view sender and recipient details and, where archiving or recording is enabled, the content of messages sent during meetings, webinars, or dedicated meeting group chats. This may include messages sent to all participants, to panelists in recorded webinars, within meeting group chats, and direct messages where archiving has been enabled.
  • Recordings and Transcripts: Account owners can view and share the recordings and transcripts of meetings and webinars hosted on their account.
• Meeting Hosts, Participants, and Invitees: When you join a Collibry meeting, other participants may be able to see basic profile information such as your name, email address, profile picture and availability status. Depending on the account owner's settings, meeting hosts and participants may also be able to view, record, save or share meeting content, including audio, transcripts, chat messages, files and other information that you choose to share during the meeting or in group chats.
• Meeting Recordings and Transcripts: Collibry allows meetings to be recorded; however, recording is optional and is not enabled by default. Only the meeting host has the ability to start or stop a recording, and recordings must be initiated manually. When a recording is active, all participants are notified through a visible indicator within the meeting interface. Recordings are stored securely in the cloud using Stream.io, with related metadata stored in MongoDB within the European region. Transcripts are generated automatically during meetings where recording is enabled. There is no automatic deletion policy for recordings or transcripts; they are retained until they are manually deleted by the user or until the associated account is deleted. Users may delete meetings, which may also remove any associated recordings and transcripts.
• Collibry Email, Calendar and Collibry Chat Recipients: People who receive Collibry emails or calendar invitations can view, save and share that content with others. Messages sent through Collibry chat can be seen by the recipients, along with any related reactions or shared content. Depending on the account owner's settings, chat messages may also be saved, recorded or shared.
• Webinar Panelists and Attendees: Only panelists may be visible to attendees during a webinar, but attendees who agree to unmute can be heard by other attendees. If an attendee agrees to become a panelist during a webinar, they may be visible to other attendees, depending on settings. Panelists and attendees may be able to see the name of a participant who asks a question during a Q&A, along with their question, unless the participant submits the question anonymously.
• Intelligent Features: Users may be able to access, based on underlying permissions, customer content and context from meetings, webinars, messaging, and other collaborative features through their use of intelligent features.
• Livestreams: Meeting and webinar hosts can choose to livestream to a third-party site or service, which means anyone with access to the livestream will be able to see the meeting or webinar.

User account data is deleted when an account is closed or deleted. Meeting metadata, including information associated with meetings and recordings, is retained until it is manually deleted by the user or until the associated account is deleted; no automatic, time-based deletion is currently implemented. Collibry does not operate a formal support ticketing system, and therefore does not retain structured support correspondence. Retention periods are not currently configurable by users or organisations.

We keep personal data only for as long as necessary to support the purposes outlined in this Privacy Statement, unless a longer retention period is required by law.

When deciding how long to retain personal data, we consider:

• How long we have an active relationship with you and provide Collibry products or services (for example, while your account remains active or you continue to use our services);
• Whether account owners or users update or delete information through their accounts;
• Whether we are legally required to retain the data for a specific period; and
• Whether keeping the data is appropriate for legal or regulatory reasons, such as enforcing agreements, resolving disputes, or meeting statutory limitation periods, litigation, or investigations.

If you are in the UK or the EEA, your rights in relation to your personal data processed by us as a controller specifically include:

• Right of access and/or portability: You have the right to access any personal data that we hold about you and, in some circumstances, have that data provided to you so that you can provide or "port" that data to another provider;
• Right of erasure: In certain circumstances, you have the right to the erasure of personal data that we hold about you (for example, if it is no longer necessary for the purposes for which it was originally collected);
• Right to object to processing: In certain circumstances, you have the right to request that we stop processing your personal data and/or stop sending you marketing communications;
• Right to rectification: You have the right to require us to correct any inaccurate or incomplete personal data;
• Right to restrict processing: You have the right to request that we restrict processing of your personal data in certain circumstances (for example, where you believe that the personal data we hold about you is not accurate or lawfully held).

If you have any other questions about our use of your personal data, please send a request at the contact details specified in the 'How to Contact us' section of this Privacy Statement.

Please note that we may request you to provide us with additional information in order to confirm your identity and ensure that you are entitled to access the relevant personal data.

You also have the right to lodge a complaint to a data protection authority. For more information, please contact your local data protection authority.

We process personal data lawfully, fairly and transparently. Where Collibry acts as a data controller for individuals in the UK, or EEA we rely on the following legal bases under applicable data protection laws, depending on the circumstances:

• Performance of a contract: Where we enter into a contract with you, we process personal data as necessary to prepare for, enter into, manage and perform that contract. This includes providing our products and services, managing user accounts, billing, compliance with contractual obligations, and related administration. If we cannot process this data, we may be unable to provide some or all of our services.
• Consent: We rely on your consent where required, including for the use of cookies and similar technologies for analytics and advertising purposes. You may withdraw your consent at any time via our Cookie Settings.
• Compliance with legal obligations: We process personal data where necessary to comply with legal and regulatory obligations to which we are subject, including UK and EEA laws, regulations, codes of practice and guidance. This includes responding to requests from competent authorities and preventing, detecting and investigating fraud, unlawful activity and breaches of data protection laws.
• Vital interests: In limited circumstances, we process personal data where necessary to protect vital interests, including to prevent serious harm or unlawful activity that impacts public safety.
• Legitimate interests: We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes processing personal data to provide, manage and support our products and services under contracts with account owners or resellers; to develop, test, improve and secure our platform; to protect accounts, prevent misuse, and enforce our terms and policies; to send relevant marketing communications and promotions where permitted; and to comply with applicable laws, protect our legal rights and property, resolve disputes, and meet our corporate and social responsibility obligations.

• Collibry is based in the United Kingdom and operates internationally. As a result, personal data may be transferred, stored, and processed outside the UK, including in Sri Lanka where our software development and technical support teams are located, and in other countries where our service providers or clients operate. This may include situations where you participate in meetings, use Collibry products and services, or communicate with users or organisations located outside the UK.
• Collibry's application servers are hosted in the United Kingdom (London, AWS eu- west-2), while database infrastructure is hosted in Europe using MongoDB Atlas. Certain third-party service providers may store or process data in other locations, depending on the provider. Platform infrastructure is managed from the UK, with access to systems strictly controlled through role-based permissions and security measures; however, authorised personnel may be located outside the UK. Where personal data is transferred internationally, Collibry ensures appropriate safeguards are in place in accordance with UK GDPR, including data processing agreements and the use of the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, where applicable.
• Some countries outside the UK may have data protection laws that differ from those in the UK. Where personal data is transferred internationally, Collibry ensures appropriate safeguards are in place to protect it in accordance with this Privacy Statement and applicable data protection laws. This includes the use of contractual protections, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, where required.
• Collibry takes reasonable and appropriate steps to ensure that personal data remains protected wherever it is processed. Where required, we carry out transfer risk assessments to ensure an adequate level of protection. If you would like further information about our international data transfers and the safeguards we use, please contact us using the details provided in this Privacy Statement.

Collibry may use personal data for the following business and commercial purposes: to provide Collibry Products and Services; for Product Research and Development; for Marketing and Promotions (Collibry does not use meeting or messaging content, or any content generated or shared as part of other collaborative features for any marketing or promotions); Authentication, Integrity, Security, and Safety; to Communicate with You; and for Legal Reasons.

Collibry may permit advertising and analytics services that are intended to deliver advertising to you and/or analyze your interactions, based on your interactions with our website or app. We may use cookies and similar technologies for analytics and advertising, subject to your consent where required under UK law.

Under UK data protection laws, including the UK GDPR and the Data Protection Act 2018, you have the right to:

• Access your personal data and receive information about how and why we process it, including who it is shared with;
• Request correction of inaccurate or incomplete personal data;
• Request deletion of your personal data in certain circumstances;
• Request restriction of, or object to, our processing of your personal data; and
• Receive your personal data in a portable format where applicable.

Collibry does not sell personal data. We may use cookies and similar technologies for analytics and advertising purposes, which you can manage through our Cookie Settings. If you believe your rights have been infringed, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

We may process certain categories of sensitive personal data, including financial and account information, communications content from meetings, webinars, messaging and collaboration features, limited email and calendar data, and biometric data where you choose to enable these features and provide explicit consent.

This information is processed only where necessary to provide our services, for security, authentication and fraud prevention, product improvement, legal compliance, and to communicate with you, or where you have given consent. We do not use sensitive personal data for automated decision-making or profiling that produces legal or similarly significant effects.

You may exercise your data protection rights at any time. We may need to verify your identity before responding to certain requests and may refuse requests where permitted by law. If you are dissatisfied with our response, you have the right to raise a complaint with the UK Information Commissioner's Office (ICO).

We may update this Privacy Statement periodically to account for changes in our collection and/or processing of personal data, and will post the updated Privacy Statement on our website, with a "Last Updated" date at the top. If we make material changes to this Privacy Statement, we will notify you and provide you an opportunity to review before you choose to continue using our products and services.