Privacy Policy
Version 2026-07-17 · Last updated 14 August 2026
This notice explains how Mortevo Ltd ("Mortevo", "we", "us") processes personal data when you use the Mortevo platform, including the public marketing site, broker portal, and lender / BDM portal. It applies to all users in the United Kingdom and has been written to comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Company registration and ICO registration number are being finalised and will appear here once confirmed.
1. Who is the controller?
Mortevo Ltd is the data controller for personal data collected through the platform. For any privacy question, subject access request, or complaint, contact privacy@mortivo.co.uk. We aim to respond within five working days and, in any event, within one calendar month as required by Article 12(3) UK GDPR.
2. Data we process
The table below is the authoritative register of personal-data categories processed by Mortevo, the lawful basis under Article 6 UK GDPR, and how long we keep each category.
| Category | Examples | Lawful basis | Retention |
|---|---|---|---|
| Authentication credentials | Email, hashed password, session tokens. | Contract (Art. 6(1)(b)) | Deleted on account closure. |
| User profile | Full name, company name, account type. | Contract (Art. 6(1)(b)) | Deleted on account closure. |
| Broker firm records | Firm name, FCA number, registered address, membership. | Contract (Art. 6(1)(b)) | 6 years after last activity (FCA record-keeping), then anonymised. |
| Lender profile & BDMs | Lender brand, BDM name, business email, phone, specialisms. | Legitimate interests — enabling broker discovery. | 2 years after last review, then anonymised. |
| Broker case data | Non-identifying case facts (loan amount, LTV, credit events) entered into Ask Mortevo. | Contract (Art. 6(1)(b)) | 2 years, then anonymised for matching-model improvement (only if AI-improvement consent given). |
| Uploaded documents | Criteria guides, rate sheets, product PDFs uploaded by lenders. | Contract (Art. 6(1)(b)) | 12 months after document is superseded, then deleted. |
| Contact form messages | Name, email and enquiry submitted via /contact. | Legitimate interests — responding to enquiries. | 2 years, then deleted. |
| Ask Mortevo prompt logs | Prompt text, model name, tokens used, latency. | Legitimate interests — cost control, abuse prevention. | 12 months, then user identifiers anonymised. |
| Security & sign-in logs | IP address, user-agent, timestamp of sign-in and privileged actions. | Legitimate interests — platform security. | 90 days. |
| Consent audit trail | Cookie / marketing / AI-improvement decisions. | Legal obligation (Art. 7(1) UK GDPR). | 2 years after withdrawal. |
| CRM sync (HubSpot) | Firm/lender name, business email, account status. | Legitimate interests — sales and account management. | Deleted from HubSpot on request; UK GDPR SCCs in place for US transfer. |
We do not process special-category data (Article 9 UK GDPR) or criminal-offence data (Article 10). Do not upload client identifiers, applicant names, or lender decisions when using Ask Mortevo.
3. How we use AI
Ask Mortevo uses large language models routed through Mortevo AI to interpret the natural-language description of a case and extract structured facts (loan amount, LTV, credit events, etc.). The matching decision itself is deterministic — it is produced by our internal rules engine, not by the model. No automated decision with legal or similarly significant effect (Article 22 UK GDPR) is made about you or your clients.
Prompts are stored for cost control, abuse prevention and, if you have opted in via the cookie banner, matching-model improvement. You can opt out at any time in .
4. Processors and international transfers
We share personal data only with the processors listed below, each under a Data Processing Agreement compliant with Article 28 UK GDPR. Where a processor is outside the UK / EEA we use the UK International Data Transfer Addendum to the EU SCCs.
| Processor | Role | Transfer safeguard |
|---|---|---|
| Supabase (Supabase Inc. — data hosted in EU-West) | Database, authentication, storage. | EU (no international transfer). |
| Mortevo AI | Routes Ask Mortevo prompts to the selected model provider. | EU / UK. Prompts are not used to train foundation models. |
| Cloudflare | CDN, DDoS protection, TLS termination. | Global edge; UK IDTA in place. |
| HubSpot (HubSpot Inc.) | CRM for sales and lender/firm relationship management. | US. UK Addendum + SCCs in place. |
| Resend / transactional email provider | Sends transactional emails (verification, approvals). | EU. |
We do not sell personal data or share it with advertisers.
5. Your rights
Under UK GDPR you have the right to:
- Request a copy of the personal data we hold about you (Article 15).
- Ask us to rectify inaccurate data (Article 16).
- Ask us to erase your data where a lawful basis no longer applies (Article 17).
- Restrict or object to processing (Articles 18 and 21).
- Receive your data in a portable, machine-readable format (Article 20).
- Withdraw consent at any time where consent is the lawful basis (Article 7(3)).
To exercise any of these rights email privacy@mortivo.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
6. Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 via our hosting provider). Access to production data is restricted to named Mortevo administrators and logged. Row-Level Security policies enforce that brokers only see their firm's data, and lenders only see their own lender profile.
7. Cookies
See our Cookie Policy for the full list. You can manage or withdraw consent at any time via .
8. Changes to this notice
When we change this notice materially we bump the version at the top of the page and, where the change affects consent, re-prompt you via the cookie banner. Historical versions are retained in our internal policy register and can be requested via privacy@mortivo.co.uk.