Privacy Policy

1. Our Commitment (PIPEDA)

RealBio is committed to protecting personal information in accordance with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation. This Policy explains what information we collect from real estate agents (our customers) and from visitors to a real estate agent's public page, how it is used, and the choices available to you.

2. Information We Collect

We collect two categories of personal information:

• Real estate agent account data: name, email, username, brokerage details, billing information, and content you upload to build your page.
• Visitor / lead data: name, email, phone number, and message content submitted through a real estate agent's contact or inquiry forms, plus aggregate analytics (page views, clicks, device type, and referral source) collected via cookies, subject to the visitor's Cookie Preferences.

Manually entered CRM data. Our public, automated forms (contact forms, inquiry forms, open house check-ins) require and validate visitor consent before a lead is stored. However, a real estate agent may also manually add contacts to their CRM (for example, from a business card, a paper sign-in sheet, or a personal referral). RealBio has no way to verify the accuracy, provenance, or consent status of manually entered records. For any data a real estate agent inputs manually, full legal responsibility for the accuracy of that information and for having the right to collect, hold, and use it rests 100% with the real estate agent; RealBio bears no liability for manually entered CRM data.

3. Cookies & Tracking

We use three kinds of cookies and similar browser storage. You can change your choice at any time withCookie preferences, and the change applies right away.

• Essential. Needed for the site to work: signing in, security checks against bots, and remembering your cookie choice. Always on.
• Analytics. RealBio's own statistics on page views, clicks and referral source, using a random identifier that is not linked to your name and is not shared with advertisers. In the European Economic Area, the United Kingdom, Switzerland and Quebec, analytics stays off until you turn it on. Elsewhere it starts on the implied-consent basis PIPEDA permits for low-sensitivity, aggregate measurement, and you can switch it off at any time.
• Advertising (Meta Pixel). Only on RealBio's own website pages (for example the home page, sign-up and checkout), and only if you choose to allow it, wherever you are. It lets Meta Platforms tell us which of our ads led to a visit, a sign-up, a free trial or a purchase, and lets us show RealBio ads to people who visited. Meta receives the page address, the event (for example "Purchase" and its amount), and technical data your browser sends, such as your IP address and device details, and may combine it with your Meta account underMeta's Privacy Policy. We never send your name, email address or phone number to Meta. If your browser sends a Global Privacy Control signal, advertising cookies stay off.

Real Estate Agent pages. The public pages of agents who use RealBio, and their property pages, never load advertising cookies or the Meta Pixel. They only use the essential and analytics cookies described above.

Record of your choice. When you choose, we keep a record of it (the choice, the date, the policy version, your country and region, and your browser type, linked to a random identifier and, if you are signed in, to your account) so we can show what you agreed to. We do not store your IP address in this record.

3b. AI Assistant Conversations

Some Real Estate Agent pages offer an AI assistant. Messages you type into it are sent toOpenAI, our AI processing provider, on servers located in the United States, so that a reply can be generated. Conversations are stored in our database and shown to the real estate agent whose page you were on, whether or not you go on to share your contact details.

What OpenAI does with it. Your conversation is not used to train OpenAI's models; RealBio does not opt in to that. OpenAI does retain the messages sent and the replies returned for up to 30 days in its abuse-monitoring logs before deleting them, and we do not ask it to store them beyond that. Only the conversation itself is sent: if you submit the contact form, your name, email and phone number go straight to RealBio and are never sent to OpenAI.

The assistant is not a person and its answers are generated automatically. Please do not enter information you would not want the real estate agent to see, such as financial account numbers or government identifiers.

3c. Service Providers We Use

We rely on a small number of processors to run the Platform. Each one only receives what it needs for its function, and is bound by its own contractual confidentiality and security obligations:

• Supabase: database, authentication and file storage.
• Cloudflare: hosting, content delivery and security.
• Stripe: subscription billing. Card details go directly to Stripe and are never stored by RealBio.
• Resend: transactional email delivery.
• Brevo: marketing email, only for people who opted in.
• OpenAI: AI assistant replies (see above).
• Google: optional Places/reviews lookups on real estate agent pages that enable them.
• Cloudflare Turnstile: invisible check that a form is sent by a person, not a bot.
• Meta Platforms: advertising measurement on RealBio's own pages, only with your consent (see section 3). Meta acts as an independent controller for the data it receives.

If a real estate agent connects their own CRM (for example Follow Up Boss or Lofty), leads captured on their page are also sent to that CRM at their instruction, and that CRM's own privacy policy then applies.

4. Leads Are Never Sold or Shared

RealBio does not sell, rent, trade, or otherwise disclose to third parties the lead databases captured through a real estate agent's CRM.

Leads submitted through a real estate agent's forms belong to that real estate agent and are used exclusively to (a) deliver the lead to the real estate agent who owns the page, and (b) operate the underlying infrastructure that makes delivery possible (e.g., our database and email-notification providers, who are bound by confidentiality obligations and are not permitted to use lead data for their own purposes). We do not monetize, aggregate for resale, or share this data with advertisers, data brokers, or any other Real estate agent.

Controller / Processor roles. For the purposes of PIPEDA and applicable Canadian privacy law, the real estate agent is the Data Controller of the leads and contacts they collect; they determine why that information is collected and are solely responsible for having obtained valid, legally sufficient consent from each lead before storing or acting on their personal information. RealBio acts solely as a Data Processor, storing and processing lead data strictly on the real estate agent's instructions, through the Platform's tools, and for no independent purpose of its own.

5. How We Use Information

We use personal information to operate and improve the Platform, deliver leads to the correct Real estate agent, process payments, send account and service-related communications, and comply with legal obligations. We do not use lead or visitor data for advertising purposes.

CASL compliance. Real estate agents who use the Platform's CRM email-sending tools to contact leads or subscribers must comply with Canada's Anti-Spam Legislation ("CASL"). This includes obtaining express or implied consent before sending a commercial electronic message, clearly identifying themselves (and their brokerage, where applicable) as the sender, and including a functional unsubscribe mechanism in every message. RealBio provides the messaging tools; the real estate agent is solely responsible for using them in a CASL-compliant manner.

6. Data Storage & Security

Data is stored with reputable infrastructure providers using industry-standard security controls, including encryption in transit. Access is restricted to personnel and systems that require it to operate the Platform.

Cross-border data transfers. RealBio relies on global cloud infrastructure providers to operate the Platform. As a result, personal information may be processed, stored, or backed up on servers located outside of Canada, including in the United States. When information is transferred across borders, it becomes subject to the laws of the jurisdiction in which it is held, which may differ from Canadian law and may permit access by foreign courts, law enforcement, or government authorities. By using the Platform, real estate agents and visitors acknowledge and accept this cross-border processing.

7. Data Retention

We retain account and lead data for as long as the associated account remains active, or as needed to comply with legal, accounting, or regulatory requirements. You may request deletion of your account and associated data at any time, subject to legal record-keeping obligations. Deleting a real estate agent account also deletes the leads, conversations and analytics belonging to it.

Data that is not tied to a live account is deleted automatically on a fixed schedule:

• Analytics events: deleted after 14 months.
• AI assistant conversations: deleted 12 months after the last message.
• Leads: kept while the real estate agent's account is active, since they are that real estate agent's client records.
• Marketing consent records: when you agree to or withdraw from RealBio marketing emails, we keep a record of the wording you saw, the date, your email address, IP address and device. We keep it for 3 years after your last change, even if you delete your account, so we can show we respected your choice. Nothing else is kept with it.
• Security incident records: kept for at least 24 months, as PIPEDA requires.

8. Your Rights Under PIPEDA

You have the right to access, correct, or request deletion of personal information we hold about you, and to withdraw consent for its collection or use, subject to legal and contractual restrictions. We respond to requests within 30 days.

If a real estate agent contacted you through RealBio and you want it to stop, you do not need an account and you do not need to contact the real estate agent. Use theunsubscribe page and we will mark your record as withdrawn immediately, and always within the 10 business days Canada's anti-spam legislation allows. Every email we send also carries an unsubscribe link that stays valid for at least 60 days.

For access, correction or deletion, email our Privacy Officer atprivacy@realbio.iofrom the address you were contacted on, or tell us which real estate agent's page you used, so we can locate your records.

8b. Security Incidents

We keep a register of every breach of security safeguards involving personal information, whether or not it meets the reporting threshold, and retain each entry for at least 24 months. Where a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible.

9. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact / Privacy Officer

The person accountable for the protection of personal information at RealBio is:

Questions, access requests, and complaints about this Policy can be directed there. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or, if you are in Quebec, to the Commission d'accès à l'information du Québec.