Privacy notice
Who we are, what we collect when you enquire, why, who helps us, how long we keep it and your rights.
Who we are
Mortgage Mode is a trading name of Funding Street Limited, registered in England and Wales (company number 08290406), registered office 49 Greek Street, London W1D 4EG. Funding Street Limited is the controller of the personal data described here.
Questions about your data, or any request under this notice: email privacy@mortgagemode.co.uk.
We are not a lender and we do not give financial advice. We arrange a call with one of our commercial mortgage or buy-to-let specialists.
What we collect
- From the enquiry form: your name, mobile number, email address, the type of mortgage, what the loan is for, the loan amount and the property value.
- Evidence of your agreement to be contacted: the exact wording you agreed to, when, the page, your IP address and browser details.
- What you tell us later by WhatsApp, text, email or on a call: details of the property and the loan, who would borrow, your availability, and any questions.
- Calls with Monty are transcribed. We keep the written transcript and the answers taken from it. We do not keep audio recordings.
- Your appointment with a specialist and its outcome.
- If you tell us about circumstances that may make you vulnerable, we record only a general category (for example health or a life event) so we can take care, never the details.
- How you use our pages, collected without cookies unless you accept analytics cookies (see our cookie policy).
We do not collect your date of birth, address, income, bank details or National Insurance number, and we do not run credit searches. We do not process images or files you send us.
Why we use it, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry, contact you by automated call, WhatsApp, SMS and email, and book your specialist call | Steps you asked us to take (UK GDPR Art. 6(1)(b)); your consent for automated calls and messages (PECR regulations 19 and 22) |
| Assess your enquiry against our rules (see below) | Steps you asked us to take, and our legitimate interest in focusing our specialists’ time |
| Send appointment reminders and the specialist’s summary of your enquiry | Steps you asked us to take |
| Keep evidence of consent, records of contact and our do-not-contact list | Legal obligation and legitimate interests (showing we contacted you lawfully and never again after you asked us to stop) |
| Protect our systems, prevent misuse and fix faults | Legitimate interests |
| Care for you if you tell us you may be vulnerable | Your explicit consent, or where needed to protect you |
| Understand how our pages are used | Your consent for analytics cookies; otherwise legitimate interests, without cookies |
Monty, our AI assistant
Monty is an AI assistant. It makes the first call or sends the first messages, confirms your figures and books your call with a specialist, who is a real person. Monty cannot give financial advice.
Calls with Monty are transcribed, not recorded. You can ask to speak to a person at any point, by saying so on the call or replying to any message.
Monty’s replies are written by a language model and checked by fixed rules and a second, independent model before they are sent. Our AI usage policy explains this in more detail.
How we assess your enquiry
When you send an enquiry, our system applies a fixed set of written rules to the details you gave us: the loan amount, the property value (and so the loan as a share of the value), what the loan is for, and, once we know them, the type of property, who would borrow (for example you personally or a company) and your role.
The rules decide only one thing: whether we can book you a call with one of our specialists now, or whether your enquiry falls outside what our specialists currently cover, in which case we keep in touch by WhatsApp and a member of the team reviews it. They produce an internal score from 0 to 100 that helps the team prioritise.
This is not a credit decision and not a decision about whether you can get a mortgage. We do not run a credit search, we do not ask for bank details, and the score is never shown to lenders or used to set any price. Monty, our AI assistant, never sees the score or the rules.
A person can always review the outcome. If you think we have assessed your enquiry wrongly, or you want a person to look at it again, email us and a member of the team will review it and reply. You can also ask for the details we used to be corrected.
Who we share it with
Our specialists see your enquiry so they can call you. We use the service providers below (sub-processors), each under a written contract that limits what they may do with your data. We never sell your data and we do not share it with lenders without telling you first.
| Provider | What for | What they receive | Where |
|---|---|---|---|
| DigitalOcean (hosting) | Runs our servers, database, encrypted storage and encrypted backups | Everything we hold (stored encrypted at rest) | United Kingdom (London data centre) |
| Twilio | Sends and receives WhatsApp and SMS messages; carries our phone line | Your mobile number, message content and delivery records | United States |
| Meta (WhatsApp) | Delivers WhatsApp messages | Your WhatsApp number or username, message content and delivery records | United States and Ireland |
| Vapi | Runs calls with Monty, our AI assistant, and produces the call transcript | Your mobile number, what is said on the call (transcribed, not recorded) and call records | United States |
| Vapi’s speech and language providers (speech-to-text, text-to-speech, language model) | Turn speech into text and text into speech during a call with Monty | What is said on the call, while the call is in progress | United States |
| OpenAI | The language model behind Monty’s messages and call replies, and content safety checks | The conversation text needed for the reply; never your phone number or email address | United States |
| Anthropic | A second, independent model that checks Monty’s replies before they are sent | The latest message and the proposed reply; never your phone number or email address | United States |
| Resend | Sends appointment emails and calendar invites, and our internal notifications | Your email address, first name and appointment time | United States |
| PostHog | Website analytics, cookieless unless you accept analytics cookies | How the page is used; never your name, phone number or email address | European Union (Frankfurt) |
| Sentry | Error reports from our software, with personal data removed | Technical error details; phone numbers, emails and message text are stripped | European Union (Frankfurt) |
| Better Stack | Uptime monitoring of our public pages and alerts when a backup or scheduled job misses its check-in | No personal data (page addresses, check-in signals and check results only) | European Union |
Transfers outside the UK
Our database, files and backups are stored in the United Kingdom. Twilio, Meta, Vapi and its speech providers, OpenAI, Anthropic and Resend process data in the United States. Each of those transfers is covered by the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework, with the provider’s security commitments. PostHog and Sentry process data in the European Union, which the UK treats as adequate.
We send the language model providers only the text needed for the reply, never your phone number or email address, under terms that they do not use it to train their models.
How long we keep it
| What | How long |
|---|---|
| An enquiry that did not lead to a booked call, and the messages, calls and records that belong to it | 12 months from the last activity |
| An enquiry that led to a booked call with a specialist | 6 years from the last activity |
| WhatsApp and SMS messages, call transcripts and the answers taken from calls | 12 months |
| Records of your consent | 6 years (kept even after the enquiry is deleted, as evidence) |
| How we assessed your enquiry (scoring records) | 6 years, and never longer than the enquiry |
| Security and audit logs | 24 months |
| Operational logs | 90 days |
| Our do-not-contact list (a one-way code made from your number or email, never the number or email itself) | Indefinitely, so we never contact you again |
| Encrypted backups | Up to 35 days; deleted or erased data can remain in a backup until it expires, and is erased again if a backup is ever restored |
An automated job deletes records when their period ends, and asks our providers to delete their copies where they offer a way to do so.
Your rights
- See the data we hold about you (we reply within one month).
- Have it corrected if it is wrong.
- Have it deleted. We will also ask our providers to delete their copies, keep a one-way code of your number and email so we never contact you again, and tell you when it is done.
- Object to how we use it, or ask us to restrict it.
- Have a person review how we assessed your enquiry, and contest the outcome.
- Take back your consent to automated calls and messages at any time.
- Complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We would like the chance to put things right first.
To make a request, email privacy@mortgagemode.co.uk. We may ask you to confirm your identity first, usually by replying from the number or email address you gave us; the one-month period starts once we can confirm it is you.
Stopping contact
- Reply STOP to any WhatsApp or text message.
- Tell Monty on a call that you do not want to be contacted.
- Use the unsubscribe link in any email (appointment reminders continue until you cancel the appointment or reply STOP).
- Email privacy@mortgagemode.co.uk.
Cookies
Our cookie policy explains the one cookie we always use and the analytics cookies we use only if you accept them.
Changes to this notice
We will update this notice when how we use your data changes, and show the date it took effect at the top.