Privacy Policy

1. Our Commitment (PIPEDA)

RealBio is committed to protecting personal information in accordance with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation. This Policy explains what information we collect from Realtors (our customers) and from visitors to a Realtor's public page, how it is used, and the choices available to you.

2. Information We Collect

We collect two categories of personal information:

• Realtor account data: name, email, username, brokerage details, billing information, and content you upload to build your page.
• Visitor / lead data: name, email, phone number, and message content submitted through a Realtor's contact or inquiry forms, plus aggregate analytics (page views, clicks, device type, and referral source) collected via cookies, subject to the visitor's Cookie Preferences.

Manually entered CRM data. Our public, automated forms (contact forms, inquiry forms, open house check-ins) require and validate visitor consent before a lead is stored. However, a Realtor may also manually add contacts to their CRM (for example, from a business card, a paper sign-in sheet, or a personal referral). RealBio has no way to verify the accuracy, provenance, or consent status of manually entered records. For any data a Realtor inputs manually, full legal responsibility for the accuracy of that information and for having the right to collect, hold, and use it rests 100% with the Realtor; RealBio bears no liability for manually entered CRM data.

3. Cookies & Tracking

Public RealBio pages use Essential cookies (required for the page to function) and, unless a visitor opts out in the "Cookie Preferences" panel, Analytics & Tracking cookies to measure page views, clicks, and referral source. Visitors can change this choice at any time, and disabling analytics immediately stops any further tracking data from being sent for that visitor.

Analytics uses a random identifier stored in your browser. It is not linked to your name, and it is not used to build a profile of you across other websites.

Where consent must come first. Visitors located in the European Economic Area, the United Kingdom or Switzerland are not tracked at all until they actively turn analytics on, and are asked on their first visit. Elsewhere, analytics starts on the implied-consent basis PIPEDA permits for low-sensitivity, aggregate measurement, and can be switched off at any time.

3b. AI Assistant Conversations

Some Realtor pages offer an AI assistant. Messages you type into it are sent toOpenAI, our AI processing provider, on servers located in the United States, so that a reply can be generated. Conversations are stored in our database and shown to the Realtor whose page you were on, whether or not you go on to share your contact details.

What OpenAI does with it. Your conversation is not used to train OpenAI's models; RealBio does not opt in to that. OpenAI does retain the messages sent and the replies returned for up to 30 days in its abuse-monitoring logs before deleting them, and we do not ask it to store them beyond that. Only the conversation itself is sent: if you submit the contact form, your name, email and phone number go straight to RealBio and are never sent to OpenAI.

The assistant is not a person and its answers are generated automatically. Please do not enter information you would not want the Realtor to see, such as financial account numbers or government identifiers.

3c. Service Providers We Use

We rely on a small number of processors to run the Platform. Each one only receives what it needs for its function, and is bound by its own contractual confidentiality and security obligations:

• Supabase: database, authentication and file storage.
• Cloudflare: hosting, content delivery and security.
• Stripe: subscription billing. Card details go directly to Stripe and are never stored by RealBio.
• Resend: transactional email delivery.
• OpenAI: AI assistant replies (see above).
• Google: optional Places/reviews lookups on Realtor pages that enable them.

If a Realtor connects their own CRM (for example Follow Up Boss or Lofty), leads captured on their page are also sent to that CRM at their instruction, and that CRM's own privacy policy then applies.

4. Leads Are Never Sold or Shared

RealBio does not sell, rent, trade, or otherwise disclose to third parties the lead databases captured through a Realtor's CRM.

Leads submitted through a Realtor's forms belong to that Realtor and are used exclusively to (a) deliver the lead to the Realtor who owns the page, and (b) operate the underlying infrastructure that makes delivery possible (e.g., our database and email-notification providers, who are bound by confidentiality obligations and are not permitted to use lead data for their own purposes). We do not monetize, aggregate for resale, or share this data with advertisers, data brokers, or any other Realtor.

Controller / Processor roles. For the purposes of PIPEDA and applicable Canadian privacy law, the Realtor is the Data Controller of the leads and contacts they collect; they determine why that information is collected and are solely responsible for having obtained valid, legally sufficient consent from each lead before storing or acting on their personal information. RealBio acts solely as a Data Processor, storing and processing lead data strictly on the Realtor's instructions, through the Platform's tools, and for no independent purpose of its own.

5. How We Use Information

We use personal information to operate and improve the Platform, deliver leads to the correct Realtor, process payments, send account and service-related communications, and comply with legal obligations. We do not use lead or visitor data for advertising purposes.

CASL compliance. Realtors who use the Platform's CRM email-sending tools to contact leads or subscribers must comply with Canada's Anti-Spam Legislation ("CASL"). This includes obtaining express or implied consent before sending a commercial electronic message, clearly identifying themselves (and their brokerage, where applicable) as the sender, and including a functional unsubscribe mechanism in every message. RealBio provides the messaging tools; the Realtor is solely responsible for using them in a CASL-compliant manner.

6. Data Storage & Security

Data is stored with reputable infrastructure providers using industry-standard security controls, including encryption in transit. Access is restricted to personnel and systems that require it to operate the Platform.

Cross-border data transfers. RealBio relies on global cloud infrastructure providers to operate the Platform. As a result, personal information may be processed, stored, or backed up on servers located outside of Canada, including in the United States. When information is transferred across borders, it becomes subject to the laws of the jurisdiction in which it is held, which may differ from Canadian law and may permit access by foreign courts, law enforcement, or government authorities. By using the Platform, Realtors and visitors acknowledge and accept this cross-border processing.

7. Data Retention

We retain account and lead data for as long as the associated account remains active, or as needed to comply with legal, accounting, or regulatory requirements. You may request deletion of your account and associated data at any time, subject to legal record-keeping obligations. Deleting a Realtor account also deletes the leads, conversations and analytics belonging to it.

Data that is not tied to a live account is deleted automatically on a fixed schedule:

• Analytics events: deleted after 14 months.
• AI assistant conversations: deleted 12 months after the last message.
• Leads: kept while the Realtor's account is active, since they are that Realtor's client records.
• Security incident records: kept for at least 24 months, as PIPEDA requires.

8. Your Rights Under PIPEDA

You have the right to access, correct, or request deletion of personal information we hold about you, and to withdraw consent for its collection or use, subject to legal and contractual restrictions. We respond to requests within 30 days.

If a Realtor contacted you through RealBio and you want it to stop, you do not need an account and you do not need to contact the Realtor. Use theunsubscribe page and we will mark your record as withdrawn immediately, and always within the 10 business days Canada's anti-spam legislation allows. Every email we send also carries an unsubscribe link that stays valid for at least 60 days.

For access, correction or deletion, email our Privacy Officer atprivacy@realbio.iofrom the address you were contacted on, or tell us which Realtor's page you used, so we can locate your records.

8b. Security Incidents

We keep a register of every breach of security safeguards involving personal information, whether or not it meets the reporting threshold, and retain each entry for at least 24 months. Where a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible.

9. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact / Privacy Officer

The person accountable for the protection of personal information at RealBio is:

Questions, access requests, and complaints about this Policy can be directed there. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or, if you are in Quebec, to the Commission d'accès à l'information du Québec.