myAbode Privacy Policy

This Privacy Policy (“Policy”) explains how myAbode Inc. (“myAbode,” “we,” “our,” or “us”) collects, uses, discloses, and protects Personal Information across its website available at www.myabode.ca (the “Website”) and software platforms including the myAbode Deals platform available at https://app.myabode.ca (all together, the “Platform”), a real estate transaction management tool used by real estate brokerages across Canada. It does not cover third-party websites or services that may be linked from the Platform or our Website, third-party systems that a brokerage connects to the Platform, or information a brokerage collects through its own systems outside the Platform.

2. Who This Policy Applies To
The Website and Platform serve several distinct groups, each with a different relationship to myAbode, as detailed below.

Throughout this Policy, “you” refers to whichever of the groups above - a Platform User, a Brokerage Client, a Website Visitor, or a myCommission Applicant - is reading this Policy. Where something applies to only one group, this Policy states so specifically.

3. Our Role in Handling Personal Information
MyAbode’s role in relation to your Personal Information depends on which group described above you belong to, and on the type of information involved.

For Brokerage Clients’ Personal Information, and for the transaction and commission information that Platform Users enter in the Platform, we act as a service provider, handling that information on behalf of, and under the instructions of, the brokerage. The brokerage has control of that information and is accountable for it: it decides why the information is collected and how it is used and remains responsible for its own obligations toward Brokerage Clients, including obtaining any consent required. The brokerage’s agreement with us includes a data processing addendum (DPA), which governs our processor obligations in detail, including the scope of our authority to process data, sub-processor arrangements, and our obligations on breach notification, deletion, and audit. Contact the brokerage, or contact us at privacy@myabode.ca, for a copy of that agreement.

For Platform Users’ own account, login and activity information, and for the Personal Information of Website Visitors and myCommission Applicants, we are the organization in control of, and accountable for, that information, and we decide why and how it is used. We are also accountable for a limited set of our own purposes that apply across all groups: securing and operating the Platform and the Website, product analytics, keeping records of AI processing for troubleshooting and service quality, and testing and evaluating our AI (see Sections 6 and 11).

4. Personal Information We Collect
The table below summarizes the categories of Personal Information handled by the Platform or Website.

7. Consent
Platform Users consent to the collection, use, and disclosure of their Personal Information as described in this Policy when they create an account and accept this Policy. For Brokerage Clients, the subscribing brokerage is responsible for obtaining appropriate consent (including explicit consent where required, for example for government identification and banking information) to enter their information into the Platform and for its handling as described in this Policy, consistent with the brokerage's own privacy notices and its obligations under the Trust in Real Estate Services Act, 2002 (“TRESA”) and Personal Information Protection and Electronic Documents Act (2000) (“PIPEDA”) and any other applicable law.

Website Visitors consent to the collection, use and disclosure of their Personal Information as described in this Policy by using the Website and where they submit a form. You may withdraw your consent at any time, subject to legal or contractual restrictions, and may unsubscribe from our marketing emails using the link in each message.

Where Personal Information is received by our AI assistant through unsolicited email or appears in an uploaded document because a brokerage's client or counterparty is named in it, we process that information as part of delivering the Platform's core transaction-management function on behalf of the subscribing brokerage. We do not use this information for any purpose beyond the purposes described in Section 6.

8. Disclosure to Service Providers and Third Parties
myAbode does not sell Personal Information. We disclose Personal Information only to service providers engaged under contract to perform a specific function on our behalf (for example, AI-assisted document processing, email delivery, electronic signatures, workflow automation, analytics, and cloud hosting), and only to the extent needed for that function. In addition, a subscribing brokerage's administrators may issue API keys or connect their own third-party systems to the Platform; information disclosed to those systems at the brokerage's direction is governed by the brokerage's own privacy practices, not this Policy. Each service provider's own data-handling terms (including retention periods) are governed by our contracts and data-processing agreements with them and are available on request.

Note that we will not share your Personal Information with other third parties, or for purposes not detailed in this Policy, unless you have authorized it or it is required by applicable law. You may contact us directly at privacy@myabode.ca regarding our use or disclosure of your Personal Information.

9. Cross-Border Transfers
Our own systems store Personal Information in Canada, in data centres located in Montreal, Quebec, encrypted at rest. To deliver certain features, Personal Information is also transmitted to, and in some cases retained by, service providers located outside Canada, in the United States and the European Union. Section 8 describes the types of service providers we use, what Personal Information they receive and where they are located.

Some of these cross-border transfers occur only while the relevant feature is being used (for example, while a document is being read by AI), and the underlying record stays in Canada. AI providers may retain information for a limited period for abuse and safety monitoring. Other providers keep a copy outside Canada, including our email, electronic-signature, analytics, error-monitoring, Website session-recording, workflow automation, internal team-messaging and software-testing providers. While information is outside Canada, it is subject to the laws of the jurisdiction in which it is processed, including potential access by that jurisdiction's courts, law enforcement, and national security authorities.

10. Cookies and Analytics
The Platform sets a small number of first-party cookies needed to sign you in and keep you signed in; our analytics provider may set its own cookies to recognise a returning browser. The Platform also uses an analytics provider to collect information about how the Platform is used — including pages viewed, actions taken, and features used — from anyone who uses it, including people who are not signed in, such as visitors to the signing page. For signed-in Platform Users, this may also include an account identifier and, in some cases, name, email, and role; usage from people who are not signed in is not linked to an account. The Platform uses an error-tracking tool to detect and diagnose errors. It does not record user sessions. We may change our analytics or monitoring tools from time to time, consistent with Section 8.

Our Website uses cookies and similar technologies set by us and by our providers to measure traffic, understand how visitors use the Website (including through heatmaps and session recordings, with form inputs masked) and improve it. Most browsers let you block or delete cookies; you can also opt out of Google Analytics using Google’s browser add-on. Blocking cookies will not prevent you from using the Website.

11. Automated Processing and Our AI Assistant
The Platform uses artificial intelligence to automatically read uploaded documents and incoming email in order to extract deal information (such as names, prices, dates, and conditions), respond to messages, and assist agents with transaction management. The AI assistant can be reached by anyone who sends an email to the Platform's address, including people who are not myAbode customers or otherwise expected senders.

A record of each AI interaction – the information given to the AI and its response – is retained for troubleshooting, service-quality, and compliance purposes. This information is processed by the AI providers named in Section 8 and is not used by myAbode to make automated decisions producing legal or similarly significant effects on individuals; the AI assistant may take limited operational actions on its own – such as replying to email or organizing deal information – but it does not make final decisions about the transaction itself, which remain with the Platform Users.

We also use records of AI processing and a limited, fixed set of real transaction documents to test and evaluate the Platform's document reading and to adjust prompts, instructions and settings. This is not AI training: we do not train or fine-tune any AI model on Personal Information, and our AI providers' commercial terms prohibit them from training on it. This testing runs on our CI/testing provider using the same AI providers as the Platform. The set is fixed, its results are not published outside our engineering environment, and access is limited to our engineering team.

12. Data Security and Retention
We protect Personal Information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption of stored data and additional protection for highly sensitive information such as government identification, anti-money-laundering information and banking details. Access is limited to personnel and service providers who need it for the purposes described in this Policy and who are bound by confidentiality obligations. We review our safeguards regularly, although no method of transmission or storage is completely secure.

Personal Information is retained for as long as needed for the purposes described in Section 6 and to meet our legal obligations. For information we handle on behalf of a brokerage, retention and deletion are also governed by our agreement with that brokerage. Certain records are retained for longer and cannot be deleted on request: records required for FINTRAC or other regulatory compliance; financial records, including landlord payout details, which form part of the transaction record; records of email received by the Platform and of AI processing, and other audit-trail records such as the change history, deal messages, review notes and document-classification records. Where we cannot delete Personal Information on request, we will tell you why and, where appropriate, restrict its further use instead.

14. Children’s Privacy
The Platform and the Website are not directed to children, and we do not knowingly collect Personal Information directly from children. If you believe that a child has disclosed Personal Information to us directly, or that we inadvertently hold Personal Information about a child, please email us at privacy@myabode.ca. If we become aware that a child has provided us with Personal Information, we will take steps to delete that information as soon as possible, unless we are required to retain it for legal or contractual reasons.

15. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technology, service providers, or legal requirements. We will post the revised Policy with a new “Last Modified” date and, where changes are material, we will take reasonable steps to let you know, for example by posting a notice on our Website or within the Platform.