Privacy Policy

Section 01

Introduction

RealEasy Technologies Inc. ("RealEasy," "we," "us," or "our") explains here how we collect, use, disclose, and safeguard your information when you use our technology platform, website, and services (collectively, the "Platform").

RealEasy operates in Alberta. Alberta's Personal Information Protection Act (PIPA) governs our handling of personal information.

Section 02

Definitions

• Personal Information: Information about an identifiable individual, excluding business contact information
• Sensitive Personal Information: Information requiring higher protection, including government identifiers and identity verification data
• Third-Party Services: External services integrated with our Platform

Section 03

Information we collect

3.1 Information You Provide Directly

Account Information:

• Name, email address, phone number
• Date of birth, used to confirm you are at least 18 and not retained (see Section 3.1a)

Identity Verification Information:

• The name and address as attested by your government-issued identification
• The type, issuing country and expiry date of that identification
• The outcome of the verification, the reasons for any failure, and the confirmation that you are at least 18
• The identifier of the verification session with our provider

3.1a What We Do Not Keep From Identity Verification

Identity verification is performed by Didit. You present your identification and a selfie to Didit; those images, the document number and your date of birth are processed by Didit and are not stored by RealEasy. We do not retain the provider's raw verification payload.

We keep the attested name and address, the document type, issuing country and expiry date, the verification outcome and its reasons, the confirmation that you are at least 18, and the session identifier — the record we need to show, years later, that a party to a transaction was verified. Where the underlying evidence is required for a dispute or a legal obligation, it is retrieved from Didit using that session identifier.

We also use the attested name and address to identify you as a party to agreements you enter through the Platform — including, if you list a property, the agreement between you and RealEasy that covers that listing. Before your name and address are used that way, we show you what we hold and ask you to confirm or correct it, because the name on identification is often not the name a property is held in.

Property Information:

• Property addresses and descriptions
• Photos and virtual tours
• Listing details and pricing
• Property documents

Transaction Information:

• Offer details and terms
• Negotiation history
• Electronic signatures
• Closing information
• If a listing sells: the sale price and the date of sale, as reported to us

3.1b Sale Prices

Where a listing sells, we record what it sold for and when. Two things about that are worth stating plainly, because a sale price is not only the seller's information.

It describes both parties. A sale price attached to a property address also describes the purchase the buyer made, and the buyer becomes the owner of that address. We therefore treat a sale price as personal information of the seller and of the buyer, and we ask each of them for consent rather than relying on the sale being a matter of record.

We publish it only if you separately agree, and you can change your mind. Recording a sale price and publishing one are different things and we treat them differently. Recording happens as part of running the Platform. Publication happens only under a separate consent, asked for on its own, never bundled into these terms or into any other agreement, and never turned on by default. That consent is its own registered document so that it can be revised, re-issued and withdrawn independently of this Policy — you can withdraw it at any time, and withdrawing it does not change your fee, is not a condition of listing or of any service, and will not cause you to be treated differently in any respect.

Where sale information is published under that consent, it is the municipal address, the sale price, the date of completion, and the property details you already published in your listing. We do not publish the seller's or the buyer's name or contact information with it.

We never price your home for you, consent or not. RealEasy does not provide valuations, appraisals, comparative market analyses, or price advice of any kind, and no consent you give authorises us to select, compare, rank or aggregate properties, or to offer any estimate or opinion of value. That limit is not a matter of policy we could quietly change — it is written into the consent document itself.

Alberta land title records are public. The price paid for a property appears in the Transfer of Land registered at Alberta Land Titles, and anyone may order that record. That is a separate public record maintained by the Government of Alberta; it is not something we publish, and our recording it here does not make it any more or less available than it already is.

Communications:

• Messages between buyers and sellers
• Support requests and correspondence

3.2 Information Collected Automatically

Technical Information:

• IP address and device identifiers
• Browser type and version
• Operating system
• Time zone settings

Usage Information:

• Pages visited and features used
• Click paths and interaction data
• Search queries
• Session duration and frequency

Cookies and Tracking Technologies:

• Session cookies for authentication
• Preference cookies for settings
• Analytics cookies for improvement

3.3 Information from Third Parties

• Identity verification results, from our identity-verification provider

We do not receive property records, market data or comparables, credit data, social-media profiles, or information from partner services.

Section 04

How we use your information

4.1 Primary Purposes

We use your personal information to:

Provide Platform Services:

• Create and manage user accounts
• Facilitate property listings and searches
• Enable communication between parties
• Process offers and negotiations
• Generate documents and contracts

Verification and Security:

• Verify user identities
• Identify you as a party to agreements you enter through the Platform, using

the name and address attested by your identification as confirmed or corrected by you

• Prevent fraud and illegal activities
• Maintain Platform security
• Enforce Terms of Use

Legal and Compliance:

• Comply with legal obligations
• Respond to legal requests
• Protect rights and safety
• Maintain transaction records

Understanding how the Platform performs:

• Analyse sale prices and dates from completed transactions on the Platform, to

understand how listings perform and what it costs us to provide the service

This analysis is internal, and it does not produce a valuation, an estimate, or a suggested price for any property. It is separate from publication, which happens only under the separate consent described in Section 3.1b.

4.2 Secondary Purposes

With your consent, we may use information for:

Communications:

• Service updates and notifications
• Marketing communications (opt-in)
• Customer surveys

Improvement and Analytics:

• Analyse Platform usage patterns
• Improve features and functionality
• Develop new services

Section 05

How we share your information

5.1 Sharing with Other Users

Public Listings: Property listings are publicly visible and include information you provide about the property (but not your personal contact information until you choose to share it).

Transaction Parties: When you enter a transaction, we share necessary information with the other party to facilitate the transaction.

5.2 Service Providers

We share information with service providers who assist us in operating the Platform:

• Authentication: Supabase Auth for sign-in
• Identity Verification: Didit for identity verification services
• Electronic Signatures: DocuSign for document signing
• Cloud Infrastructure: Render, Vercel and Supabase for hosting, storage and infrastructure
• Transactional Email: Resend
• Analytics: PostHog and Vercel Analytics for product and performance analytics
• Maps: Mapbox for map display and location search

This list is the complete set of processors that receive personal information. The `/privacy` pages published on our websites state the same list; where they differ, this registered document governs.

5.3 Professional Services

With your consent, we may share information with a lawyer or other professional you choose to engage. We do not select, recommend or refer professionals to you.

5.4 Legal Disclosures

We may disclose information where required or permitted by law, including to comply with legal process, to respond to a lawful government request, to protect our rights or property, to prevent fraud, or to protect personal safety.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, which will remain bound by this Policy in respect of that information.

5.6 Aggregated Data

We may share aggregated, de-identified data that cannot identify you.

Sale prices are excluded from this section. We do not share them aggregated, averaged, banded, or in any other derived form. In a market with few comparable sales, an average is not anonymous — it can be worked back to individual properties — and a derived price figure is the kind of valuation statement Section 3.1b says we do not make.

The separate consent described in Section 3.1b is the only route by which sale information becomes public, and it permits publication of individual sale records as they stand — not selection, comparison, ranking, or aggregation.

Section 06

Data retention

We retain personal information for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements.

Specific Retention Periods:

• Account information: Duration of account plus 7 years
• Transaction records: 7 years
• Identity verification records, as described in Section 3.1a: 7 years
• Communications: 3 years
• Technical logs: 1 year
• Marketing preferences: Until consent withdrawn

6.1 Records We Do Not Delete or Alter

Some records exist to show what happened, and a record that can be changed afterwards cannot do that. The following are held in a form that cannot be edited or deleted, by anyone, including us: transaction and negotiation history, offers and their terms, documents generated and executed, consent and acceptance records, identity verification records, and the audit log of Platform activity.

This is enforced by the database itself and not by policy. There is no administrative function, no support process, and no request that will remove one of these records.

Two consequences follow, and we would rather you know them before you use the Platform than discover them later:

Correction happens by addition, not replacement. If a record is wrong, we append a correcting record. The original stays, and both are visible. We do not overwrite.

We will refuse a deletion request for these records and tell you why. We can delete your account, remove your listing from public view, and stop contacting you. We cannot remove the record of a transaction you were party to.

Records outside that set — your marketing preferences, your listing's public visibility, your profile details — can be changed or removed on request.

Section 07

Your privacy rights

Under Alberta's Personal Information Protection Act you have the right to:

7.1 Access Your Information

Request a copy of the personal information we hold about you, and information about how it has been used and to whom it has been disclosed.

7.2 Correct Your Information

Request correction of inaccurate or incomplete information. Where the information is in a record described in Section 6.1, the correction is made by appending a correcting record rather than by altering the original.

7.3 Request Deletion

Request deletion of your personal information. We will refuse this request in respect of the records described in Section 6.1, and will tell you which records we are refusing to delete and why. Information outside that set will be deleted.

7.4 Withdraw Consent

Withdraw consent for any use of your information where consent is the basis for it, including the sale-price publication consent described in Section 3.1b. Withdrawal may limit our ability to provide services, and we will tell you how before you withdraw.

7.5 Object to Marketing

Ask us to stop sending you marketing communications at any time.

7.6 Complain

Complain to us at support@getrealeasy.ca, and, if you are not satisfied, to the Office of the Information and Privacy Commissioner of Alberta.

To exercise these rights, contact us at support@getrealeasy.ca. We aim to respond within 30 days.

Section 08

Data security

8.1 Security Measures

• Encryption in transit: TLS/SSL
• Encryption at rest: Documents you upload or that the Platform generates for you are encrypted by RealEasy before they are stored, using AES-256 in GCM mode. This covers documents held in your document vault, property ownership documents, offer documents and the signed offer package, and executed Platform Agreements. Each stored document is bound to its own location, so a document cannot be substituted for another, and the stored copy is checked against a recorded fingerprint each time it is sent to you.
• What that encryption does not cover: Photographs of a listed property are stored without this encryption, because they are published on the Platform for anyone to see. Separately, our hosting providers encrypt stored data at rest under their own controls; that is their protection and not ours, and the key RealEasy holds is stored alongside the credentials for the storage it protects, so this measure protects against exposure of that storage and not against compromise of our own systems.
• Access controls: Role-based access, with write and delete permissions removed from the application role for the records described in Section 6.1
• Authentication: Sign-in is handled by Supabase Auth. RealEasy does not hold your password.
• Infrastructure: Cloud hosting with Render, Vercel and Supabase

8.2 Incident Response

In the event of a breach affecting your personal information, we will notify you and the Office of the Information and Privacy Commissioner of Alberta as required by law, take steps to mitigate harm, and investigate and remediate the cause.

8.3 Your Security Responsibilities

You are responsible for maintaining the confidentiality of your sign-in credentials, logging out of shared devices, and reporting suspicious activity.

Section 09

Where your information is held

Our service providers hold information in Canada and in the United States. Information held outside Canada is subject to the laws of the jurisdiction where it is held, and may be accessible to courts and law enforcement in that jurisdiction.

We contract with each provider on terms requiring them to protect personal information and to use it only for the purposes we specify.

Section 10

Children's privacy

The Platform is not intended for individuals under 18. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly.

Section 11

Cookies

Essential cookies are required for the Platform to function, including for authentication. Preference cookies remember your settings. Analytics cookies help us understand how the Platform is used.

We do not use advertising or marketing cookies. You can control cookies through your browser settings; disabling essential cookies will prevent you from signing in.

Section 12

Third-party links

The Platform may contain links to third-party websites. We are not responsible for their privacy practices.

Section 13

Marketing communications

Marketing communications are sent only with your consent. You can opt out at any time by using the unsubscribe link in any marketing email, updating your account preferences, or contacting us.

We may send non-marketing communications necessary for service delivery regardless of your marketing preferences.

Section 14

Changes to this policy

We may issue a new version of this Policy. A new version does not take effect for you automatically. When a new version takes effect, you will be asked to review and accept it before continuing to use the Platform. Until you do, the version you accepted continues to govern.

Each version is recorded with its own effective date, and the version you accepted is retained.

Section 15

Accountability

15.1 Privacy Officer

We have designated a Privacy Officer responsible for compliance with this Policy, for handling privacy inquiries and complaints, and for privacy assessments. The Privacy Officer can be reached at support@getrealeasy.ca.

15.2 Confidentiality

Everyone with access to personal information is bound by confidentiality obligations.

15.3 Privacy by Design

We consider privacy in feature development, system design, and data handling.

Section 16

Consent

16.1 Forms of Consent

We obtain express consent for sensitive information and for uses beyond what is needed to provide the service you have asked for. We rely on implied consent only where the use is necessary to provide that service and would be obvious to you.

16.2 Withdrawal of Consent

You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal may limit our ability to provide services.

Section 17

Accuracy

We take reasonable steps to keep personal information accurate and complete where it is used to make a decision affecting you. Please tell us when your information changes.

Section 18

Contact information

Privacy Officer RealEasy Technologies Inc. Email: support@getrealeasy.ca Address: Red Deer, Alberta, Canada

Section 19

Regulatory authority

Office of the Information and Privacy Commissioner of Alberta 410, 9925 - 109 Street NW Edmonton, Alberta T5K 2J8 Phone: 780-422-6860 Website: www.oipc.ab.ca

By using the Platform you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described in it.