Privacy Policy

Section 01

Introduction

1.1 Who we are

RealEasy Technologies Inc. ("RealEasy Technologies", "we", "us" or "our") operates the RealEasy website, applications, and services (the "Platform"). This Privacy Policy explains how we collect, use, disclose, keep, and protect personal information, and the choices and rights you have.

• Address: 38177 Range Road 264, Red Deer County, Alberta T4E 0Y7, Canada
• Telephone: 587-295-4255
• Privacy Officer: privacy@getrealeasy.ca

1.2 The laws that apply

We handle personal information in accordance with Alberta's Personal Information Protection Act ("PIPA"). Where personal information crosses a provincial or national border in the course of our commercial activities, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") may also apply. Where both apply, we comply with both.

1.3 What this Policy covers

This Policy covers personal information about people who visit our website, join our waitlist, create an account, list a property, make or receive offers, request or host showings, send messages, buy optional items, or contact us. It does not cover the practices of other people, such as a buyer, a seller, or a lawyer, who receive information from you through the Platform, or of third-party websites we link to.

1.4 Summary

• We collect what we need to run a platform on which people buy and sell their own homes, verify who is taking part, keep a reliable record of what was agreed, and keep users safe.
• Identity verification uses a photograph of your face and your identity document. Our provider processes them. We keep the result and a few details, not the images.
• Transaction records are kept in a form that cannot be changed, because their purpose is to show what happened. They are kept for a fixed period and then destroyed or made non-identifying.
• We do not sell personal information, and we do not estimate or publish what anyone's home is worth or sold for. We use advertising cookies only on our marketing website, and only if you accept them.
• You can ask to see and correct your information, and you can complain to us or to the Information and Privacy Commissioner of Alberta.

Section 02

Definitions

• "Personal information" means information about an identifiable individual. It does not include business contact information used to contact a person about their business.
• "Sensitive personal information" includes identity documents, biometric information such as a facial image used for matching, financial information, and information about a person's safety.
• "Service provider" means a business that processes personal information for us, on our instructions, to help us operate the Platform.
• "Transaction record" means an offer and its terms, its negotiation history, the documents generated from it and signed, and the electronic signature evidence for those documents.
• "Protected record" means a record described in section 11.1.

Other capitalized terms have the meanings given in our Terms of Use.

Section 03

Information we collect

3.1 Account information

When you create an account we collect your name, email address, and telephone number, and what you tell us you came to the Platform to do. During identity verification, Didit reads your date of birth from your identity document; we receive only the confirmation that you are at least 18.

3.2 Identity verification information

To verify your identity, our identity verification provider, Didit, collects from you a photograph or scan of a government-issued photo identity document and a photograph or short video of your face, and compares them. This involves biometric processing: Didit creates a mathematical representation of your face to compare it with the photograph on your document. We ask for your express consent before you begin.

From the verification we receive and keep:

• your name and address as they appear on your identity document;
• the type of document, the country that issued it, and its expiry date;
• whether the verification succeeded, the reasons for any failure, and the confirmation that you are at least 18; and
• the identifier of the verification session.

Except as described in the rest of this section, we do not receive or keep the images of your document or face, your document number, your date of birth, or any biometric template. Didit keeps them for seven years after you verify, and then deletes them. If you never sign an agreement through the Platform, we instruct Didit to delete them sooner, when we destroy your identity verification record under section 9.2. Where the underlying evidence is needed for a dispute, an investigation, or a legal obligation within that period, we may retrieve it from Didit using the session identifier.

We use the name and address from your identity document, as you confirm or correct them, to identify you as a party to documents you sign on the Platform. A correction is recorded beside the name on your document, and we may review it and ask you for evidence before it is used.

3.3 Property and listing information

If you list a property, we collect its address and legal description, its title reference number where you provide it, its description, features, photographs, price, and availability for showings, and the declarations you make about it, including your declaration under the Dower Act (Alberta), the capacity in which you sell, and the other registered owners.

3.4 Ownership documents

We collect the ownership documents you upload, such as a certificate of title or a property tax notice. They may contain personal information about you and other owners, and information about mortgages or other registrations.

3.5 Offers, negotiations and agreements

We collect the terms of every offer and counter, the negotiation history, the documents generated from them, and the signed agreements. When you sign electronically, our electronic signature provider records your name, email address, signature, the date and time you viewed, signed, or declined each document, and the IP address from which you did so, in a certificate of completion that forms part of the signed document.

3.6 Showings

We collect each showing request and its date and time, the number and names of the people who will attend, the notes the buyer and the seller add, the confirmation code, and each confirmation, decline, cancellation, and reported outcome, together with who did it and when.

3.7 Messages

We collect the messages you send and receive through the Platform, and records of when conversations were opened, read, blocked, or reported.

3.8 Reports and safety records

If you or another person reports a concern, we collect the report, the information it refers to, and the steps we take, including any warning, restriction, suspension, or disclosure to authorities.

3.9 Purchases and shipping

If you buy an optional item or receive a welcome package, we collect your name, the delivery address, a telephone number for delivery, the items, the price and taxes, and the order, payment, shipping, and refund status. Your payment card details are collected and processed by our payment processor, Stripe. We receive only a transaction identifier, the card brand, the last four digits of the card, its expiry month and year, and whether the payment succeeded.

3.10 Waitlist and marketing

If you join our waitlist or agree to receive marketing email, we collect your name, email address, and a record of your consent: when you gave it, the wording you agreed to, and the IP address from which you gave it.

3.11 Support and correspondence

We collect what you tell us when you contact us, and our replies.

3.12 Technical and usage information

When you use the Platform, we and our hosting providers automatically collect your IP address, device and browser type, operating system, the pages and features you use, the searches you make, the listings you view and save, the date and time of each request, session and request identifiers, and security events such as refused requests.

3.13 Cookies and similar technologies

We use cookies and similar technologies as described in section 15.

3.14 Information from other sources

We receive verification results from Didit, signing events from our electronic signature provider, payment and refund confirmations from our payment processor, and delivery tracking from shipping carriers. We do not buy personal information, obtain credit reports, or run criminal record or background checks.

Section 04

What we do not do

• We do not publish sale prices, and we do not record whether a sale closed or the final amount paid on completion. Marking a listing sold records only that it was marked sold, and when. The price in an offer is one of that offer's terms and forms part of the transaction record.
• We do not value property. We do not estimate what any property is worth, and we do not publish offer prices in any form, including averaged or aggregated.
• We do not sell personal information, and we share it for advertising only as section 15 describes.
• We do not use advertising cookies in our application or allow advertising networks to track you there. On our marketing website, we use advertising measurement only if you accept advertising cookies, as section 15 describes.
• We do not make decisions about you by automated means that have legal effects, except that the Platform automatically ends an offer, a negotiation round, or a showing request when a deadline stated in it passes, as the Terms of Use describe.

Section 05

How we use personal information

We use personal information for the following purposes, and only for purposes a reasonable person would consider appropriate in the circumstances:

• To provide the Platform: creating and managing accounts; publishing listings; enabling searches, saved searches, offers, negotiations, document generation, electronic signatures, showings, and messages; and processing and delivering orders.
• To verify identity and prevent fraud: checking, by matching an identity document to a photograph of the person's face, each account holder who lists, offers, messages, or requests, confirms or hosts a showing; reviewing ownership documents before a listing is published; detecting and preventing fraud, impersonation, and misuse.
• To keep people safe: reviewing reports, restricting or suspending accounts, preserving evidence, and, where the law permits, disclosing information to the police or others to protect a person's safety.
• To keep a reliable record: recording what each party proposed, agreed, and signed, and when, so that the parties and their lawyers can rely on it and so that disputes can be resolved.
• To communicate with you: sending service messages about your account, listings, offers, showings, orders, and security, and, with your consent, saved-search alerts and marketing email.
• To operate, secure, and improve the Platform: maintaining and protecting our systems, diagnosing problems, measuring how features are used, and developing new features, using de-identified or aggregated information where we can.
• To understand how listings perform: analysing, internally, the prices and dates of offers accepted through the Platform. This analysis does not produce a valuation, an estimate, or a suggested price for any property, and we do not publish it.
• To meet legal obligations and protect rights: complying with the law, court orders, and lawful requests; keeping tax and accounting records; enforcing our Terms of Use and the Platform Agreement; and establishing, exercising, or defending legal claims.

If we want to use personal information for a new purpose, we will tell you, and we will ask for your consent where the law requires it.

Section 06

Consent

6.1 How we obtain consent

We obtain your express consent before we collect biometric information for identity verification, before we send you marketing email, and before we disclose your personal information for any purpose that is not necessary to provide the Platform. We rely on your consent, implied by your use of a feature, for collection, use, and disclosure that is necessary to provide that feature and that a reasonable person would expect. Where PIPA or PIPEDA permits, we may collect, use, or disclose personal information without consent, for example to investigate a breach of an agreement or a contravention of law, in an emergency that threatens a person's life, health, or security, or to comply with a legal obligation.

6.2 Withdrawing consent

You may withdraw your consent at any time on reasonable notice, subject to legal and contractual restrictions. Withdrawing consent does not affect what was done before you withdrew it and does not require us to delete a transaction record. If you withdraw consent to something that is necessary to provide a feature, you may not be able to use that feature, and we will tell you so.

6.3 Information about other people

If you give us personal information about another person, such as a co-owner, a spouse who must consent under the Dower Act (Alberta), or a person who will attend a showing with you, you confirm that you are entitled to give it to us for the purposes described in this Policy.

Section 07

How we disclose personal information

7.1 Published listings

A published listing shows the property's address, description, features, price, and photographs to anyone who views the Platform. It does not show the seller's name, email address, or telephone number. Showing availability is visible only to signed-in users who have completed identity verification.

7.2 Other users you deal with

When you deal with another user, we share with them what is needed for that dealing:

• Messages: your display name, your messages, and whether you have completed identity verification.
• Offers and agreements: the full name and address you confirmed, your email address for notices under the agreement, the terms you propose and agree to, and the documents you sign. Each signed document includes its certificate of completion, which records each signer's name, email address, signing times, and IP address.
• Showings: your display name, the time of the showing, the names and number of attendees, the notes you add for the other party, the confirmation code, and whether you have completed identity verification.

7.3 Lawyers

We disclose information to a lawyer only when you ask us to or authorize us to. You may also download your documents and give them to any lawyer yourself. We do not choose, recommend, or have any arrangement with any lawyer. If a lawyer acting for another party asks us for information about you, we refer them to their own client, who holds the signed agreement, and we disclose more only with your consent or where the law permits or requires it.

7.4 Service providers

We use the following service providers. Each processes personal information only on our instructions and under a written agreement that requires it to protect the information and use it only for the services it provides to us.

• Supabase: account sign-in, the database, and file storage, in its Canadian region. It holds all of the personal information described in section 3, except the images and payment card details held by Didit and our payment processor and the waitlist held by Resend. It also keeps backups of our database for seven days.
• Render: hosting for our application servers and scheduled jobs. It processes all of the personal information described in section 3 while our servers handle it, and keeps operational logs, which may include IP addresses and request details, for a limited period.
• GitHub: runs the scheduled job that creates our encrypted backups. It processes the information in our database and file storage while each backup is created and encrypted, and keeps only the job's logs, which do not contain that information.
• Amazon Web Services: stores our encrypted backups in its Canadian region. They contain all of the personal information described in section 3 that Supabase holds.
• Vercel: hosting for our websites, and privacy-friendly performance and usage analytics. It processes technical and usage information.
• Didit: identity verification, as described in section 3.2.
• BoldSign: electronic signatures. It receives the documents you sign and your name and email address, and records the signing information described in section 3.5.
• Resend: email delivery, and our waitlist. It receives your name, email address, and the content of each email we send you, and, if you join our waitlist, the record of your consent described in section 3.10.
• PostHog: analytics on our marketing website, only if you accept analytics cookies. It receives technical and usage information.
• Mapbox: maps and location search. It receives the locations you view or search for and technical information about your device.
• Stripe: payment processing for optional items, as described in section 3.9.
• Shipping carriers: delivery of optional items and welcome packages. They receive your name, the delivery address, and a telephone number for delivery.
• Our email and office software provider: hosts the mailboxes for our getrealeasy.ca addresses. It receives the correspondence you send us and our replies.

If we add or replace a service provider that receives personal information, we will update this Policy and tell you before the new provider receives it. Because such a change does not change the purposes for which we use your information, it applies from the date we tell you, as section 18 describes.

7.5 Legal, safety and enforcement disclosures

We may disclose personal information where the law requires or permits it, including:

• to comply with a subpoena, warrant, court order, or other legal process, or a request from a body with legal authority to compel it;
• to the police or other authorities to report or help investigate a crime, fraud, or a safety concern;
• in an emergency that threatens the life, health, or security of any person;
• to investigate or respond to a breach of our Terms of Use or of an agreement; and
• to establish, exercise, or defend legal claims.

7.6 Business transactions

If we are involved in a merger, acquisition, financing, or sale of all or part of our business, personal information may be disclosed to the other parties to evaluate and complete the transaction, under agreements that restrict its use as PIPA requires, and may be transferred to a successor that will be bound by this Policy.

7.7 With your consent

We disclose personal information for any other purpose with your consent.

7.8 De-identified and aggregated information

We may use and share information that has been de-identified or aggregated so that it no longer identifies any individual. We never share the prices in offers made through the Platform in any de-identified, averaged, banded, or aggregated form, because in a market with few sales an aggregate can be traced back to individual properties. Offer prices are disclosed only to the parties to the offer, and as section 7.5 permits.

Section 08

Where your information is processed and stored

Our service providers process and store personal information in Canada, the United States, and the European Union. In particular:

• Canada: Supabase stores our database and files in its Canadian region. Amazon Web Services stores our encrypted backups in its Canadian region. BoldSign stores signed documents, their certificates, and signer information in its Canadian region.
• United States: Render, GitHub, Vercel, Resend, PostHog, Mapbox, and Stripe process or store information in the United States. BoldSign may process some information in the United States, including for email delivery.
• Advertising measurement: if you accept advertising cookies on our marketing website, Meta Platforms receives the information section 15.1 describes and may process it in the United States and other countries.
• European Union: Didit processes identity verification information in the European Union and may process it in other countries.

Personal information held outside Canada is subject to the laws of the country where it is held and may be accessed by the courts, law enforcement, and national security authorities of that country. You may obtain written information about our policies and practices for service providers outside Canada, and ask questions about how they collect, use, disclose, or store personal information for us, by contacting our Privacy Officer at privacy@getrealeasy.ca or 587-295-4255.

Section 09

How long we keep personal information

9.1 Our rule

We keep personal information only for as long as we reasonably need it for legal or business purposes. When a period below ends, we destroy the information or make it non-identifying, unless a legal hold described in section 9.3 applies.

9.2 Retention periods

• Transaction records for an offer that led to an agreement signed by both parties: 10 years after the Completion Date stated in that agreement.
• Transaction records for offers and negotiations that did not lead to a signed agreement: 2 years after the offer ended.
• Listings, ownership documents, and seller declarations: if the listing led to a signed agreement, as for that agreement's transaction record; otherwise, 2 years after the listing was withdrawn or ended.
• Identity verification records (section 3.2): if you were a party to a signed agreement, as for that agreement's transaction record; otherwise, 2 years after your account was closed or your last activity on the Platform, whichever is earlier.
• Account information: while your account is open, then 2 years after it is closed, except where it forms part of a record kept for longer under this section.
• Messages: if the conversation concerned a property for which you signed an agreement, as for that agreement's transaction record; otherwise, 2 years after the last message in the conversation.
• Showing records: 2 years after the date of the showing, unless they form part of a report or a transaction record kept for longer.
• Reports and safety records: 7 years after the report was closed.
• Orders, payments, refunds and shipping: 6 years after the end of the tax year in which the order was placed, as Canadian tax law requires.
• Consent records, including marketing, waitlist, and acknowledgment records: for as long as the consent or the related record is kept, and then for 3 years.
• Usage records, such as listings viewed and searches made: 13 months, after which we keep only aggregated information.
• Sign-in session records: 60 days after the sign-in that created them. Security event records: 90 days.
• Waitlist information: until you join the Platform or withdraw your consent, and in any case no longer than 2 years after you joined the waitlist.

9.3 Legal holds

If a record is relevant to a dispute, an investigation, a safety report, a legal proceeding, or a request we are legally required to answer, we place it under a legal hold and keep it until the hold is released, even if its retention period has ended.

9.4 How we destroy information

We destroy or de-identify personal information using methods appropriate to its sensitivity. For protected records (section 11), we make the personal information in them non-identifying by permanently destroying the encryption keys that protect it, so that the record of what happened remains but no longer identifies anyone.

We keep encrypted backups in Canada, locked against change or deletion while they are kept, so that the record of what happened survives an error or an attack. We keep each daily backup of our database for 35 days, and one from each month for 12 months. We keep a backup copy of each file stored on the Platform for as long as the file is kept, and for up to 35 days after it is deleted. Each backup is deleted within 30 days after its lock ends. Supabase also keeps backups of our database for seven days and then deletes them. Until a backup is deleted, it may still contain information, or a copy of an encryption key, that we have since destroyed. We use a backup only to restore the Platform after a loss of data. If we restore one, we first re-apply every destruction and de-identification made since the backup was taken, so that destroyed information and keys are not used again.

Section 10

Your rights

10.1 Access

You may ask for access to the personal information we hold about you, information about how we have used it, and the names of the people and organizations to whom we have disclosed it.

10.2 Correction

You may ask us to correct an error or omission in your personal information. Where the information is in a record that cannot be changed (section 11), we correct it by adding a correcting record that is kept with the original, and where we do not make the correction, we note the request in the record.

10.3 Withdrawing consent and closing your account

You may withdraw your consent as described in section 6.2, unsubscribe from marketing email as described in section 16, and ask us to close your account. We cannot close an account while an offer you are party to is open or awaiting signature, or before the Completion Date stated in an agreement you signed. When an account is closed, its information is kept and then destroyed or made non-identifying as section 9 describes.

10.4 Deletion requests

PIPA does not give a general right to have personal information deleted on request, but we will consider every request. We will not delete a protected record during its retention period, because its purpose is to show what happened, and we will tell you which records we are keeping and why. We will delete or de-identify information we are not required to keep.

10.5 How to make a request

Send your request to privacy@getrealeasy.ca or to our address in section 1.1. We may ask you to confirm your identity before we respond. We respond within the time PIPA requires, which is generally 45 days, and we aim to respond within 30 days. We do not charge a fee for a request. If we refuse a request, we will tell you why, unless the law prevents us, and how you may ask the Information and Privacy Commissioner of Alberta to review our decision.

Section 11

Records that cannot be changed

11.1 What they are

The following records ("protected records") are held in a form that the Platform's software cannot edit or delete during their retention period: offers and their terms once submitted; negotiation history; documents generated and signed; electronic signature evidence; ownership documents uploaded; seller declarations; consent and acceptance records; identity verification records; the time, parties, and outcome of each showing; messages; reports; and the audit log of Platform activity.

11.2 Why

These records exist to show what happened. A record that could be changed afterwards could not do that, for you, for the other party, for your lawyer, or for a court. The database itself enforces this protection.

11.3 What follows

Corrections are made by adding a new record, not by replacing the original. A request to delete a protected record during its retention period will be refused. At the end of its retention period, a protected record is made non-identifying as section 9.4 describes.

Section 12

How we protect personal information

12.1 Safeguards

We protect personal information with physical, administrative, and technical safeguards appropriate to its sensitivity, including:

• encryption in transit using TLS;
• encryption of documents you upload and documents the Platform generates, before they are stored, using AES-256 in GCM mode, with each stored document bound to its location and checked against a recorded fingerprint whenever it is sent to you;
• role-based access controls, so that staff access only the information they need for their role;
• sign-in through Supabase Auth, so that we never hold your password; and
• an audit log that records who did what, and when.

Photographs of a published listing are not encrypted in this way, because they are public. Our hosting providers also encrypt stored data under their own controls.

12.2 No guarantee

No method of transmission or storage is completely secure, and we cannot guarantee the security of personal information.

12.3 Your part

Keep your sign-in credentials confidential, sign out of shared devices, and tell us right away about any suspicious activity.

Section 13

Breaches

If a loss of, unauthorized access to, or unauthorized disclosure of personal information under our control creates a real risk of significant harm to an individual, we will notify the Information and Privacy Commissioner of Alberta without unreasonable delay, and we will notify affected individuals as the Commissioner requires or the law otherwise requires. We will take steps to contain the incident and reduce the risk of harm, and we keep a record of every such incident.

Section 14

Children

The Platform is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18, other than the names of children a user lists as attending a showing. If we learn that a person under 18 has created an account, we will close it, and its information will be kept and destroyed as section 9 describes.

Section 15

Cookies and analytics

15.1 What we use

• Essential cookies are needed for the Platform to work, including to keep you signed in and to protect against misuse. They cannot be turned off without preventing sign-in.
• Preference cookies remember your settings and choices, such as your cookie choices.
• Analytics help us understand how the Platform is used. On our marketing website, PostHog analytics cookies are set only if you accept them, and you can change your choice at any time through the cookie preferences link. Vercel Analytics measures performance and page use without setting cookies.
• Advertising measurement tells us whether our advertisements on Meta's services lead people to visit our marketing website or join our waitlist. Only on our marketing website, and only if you accept advertising cookies, we use the Meta Pixel. It sets a cookie that lasts up to 90 days and sends Meta technical and usage information, such as the pages you visit, your IP address, your browser, and the fact that you joined our waitlist. It does not send your name or email address. Meta receives this information under its own terms and privacy policy and may use it to measure, improve, and deliver advertising. You can change your choice at any time through the cookie preferences link.

15.2 What we do not use

We do not use advertising or cross-site tracking cookies in our application. On our marketing website, the only advertising cookie is the Meta Pixel described in section 15.1, and it is set only if you accept it.

15.3 Your controls

You can also block or delete cookies through your browser settings. Blocking essential cookies will prevent you from signing in.

Section 16

Marketing and other email

16.1 Marketing email requires consent

We send marketing email, including saved-search alerts about new listings and emails to people on our waitlist, only with your express consent. Every marketing email identifies RealEasy Technologies, gives our mailing address and contact information, and includes a way to unsubscribe.

16.2 Unsubscribing

You can unsubscribe at any time by using the link in any marketing email, by changing your email settings or turning off alerts in your account, or by contacting us. We give effect to your request within 10 business days.

16.3 Service messages

We send service messages necessary to operate your account and the features you use, regardless of your marketing choices. They do not contain marketing.

Section 17

Safety reports and requests from authorities

When we receive a report about a user, a showing, a message, or a listing, we use the information in the report and the related records to review it and to decide what to do. We may tell the person reported that a report was made, but we do not tell them who made it unless the law requires us to or the reporter agrees. We respond to requests from the police and other authorities in accordance with the law, and we may refuse a request that is not legally authorized. Where the law permits, we may disclose information to the police or others without a request if we believe it is necessary to protect the life, health, or security of any person.

Section 18

Changes to this policy

We may issue a new version of this Policy. Except for a change to the list of service providers under section 7.4, a new version does not take effect for you until you accept it. When a new version takes effect, you will be asked to review and accept it before continuing to use your account. Until you do, the version you accepted continues to govern. Each version is recorded with its own effective date, and the version you accepted is retained.

Section 19

Accountability and contact

19.1 Privacy Officer

Our Privacy Officer is responsible for our compliance with this Policy and with privacy law, for answering questions about how we and our service providers handle personal information, and for handling requests and complaints.

Privacy Officer RealEasy Technologies Inc. 38177 Range Road 264, Red Deer County, Alberta T4E 0Y7, Canada Telephone: 587-295-4255 Email: privacy@getrealeasy.ca

19.2 Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer first. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta:

Office of the Information and Privacy Commissioner of Alberta 410, 9925 109 Street NW, Edmonton, Alberta T5K 2J8 Telephone: 780-422-6860 Website: www.oipc.ab.ca

You may also contact the Office of the Privacy Commissioner of Canada where PIPEDA applies, at www.priv.gc.ca.

By ticking the box to accept this Privacy Policy, you confirm that you have read and understood it, and you consent to the collection, use, and disclosure of your personal information as it describes, except where this Policy says we will ask for your express consent separately.