Privacy Policy

PropertyBin Inc. (“PropertyBin”, “we”, “us”, or “our”) operates a real estate discovery, directory, and software platform serving consumers, homebuyers, sellers, licensed real estate agents, brokerages, home builders, and professional service providers across Canada.

We are committed to maintaining the highest standards of data stewardship, privacy, and security. This Privacy Policy sets out how PropertyBin collects, uses, discloses, retains, and protects personal information when you access our website (propertybin.ca), mobile interfaces, mortgage tools, real estate marketing features, CRM, Marketing Hub, and interactive directories.

By using PropertyBin, creating an account, saving properties, or submitting inquiries through our platform, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.

PropertyBin operates strictly in accordance with Canadian federal and provincial privacy legislation and electronic communications laws, including:

• PIPEDA: Federal rules for commercial collection, use, and disclosure of personal information.
• BC PIPA / Alberta PIPA: Provincial private-sector privacy statutes.
• Quebec Law 25: Enhanced consent, transparency, and breach rules for Quebec residents.
• CASL: Rules governing commercial electronic messages (CEMs).

Pursuant to PIPEDA Principle 1 (Accountability) and Quebec Law 25, PropertyBin has appointed a designated Privacy Officer:

Under PIPEDA Principle 4 (Limiting Collection), we only collect personal information that is strictly necessary for the PropertyBin platform. Categories below reflect systems in production:

A. Account & profile

• Contact & credentials: Name, email, phone, address, username, hashed passwords, email-verification status.
• Role & professional context: Consumer vs agent/builder/professional-service role, organization membership, public profile fields.
• Portfolio media: Project photos, videos, awards, and credentials you upload.

B. Search, listings activity & on-device preferences

• Server-side: Saved searches, alerts, follows, wishlist when synced to your account.
• On-device: Favourites, compare, and recently viewed may live in localStorage (Functional category) until you save them while signed in.

C. Inquiries, CRM & showings

• Profile leads: Name, email, phone, message, source (profile form, open house, site-plan lot, etc.).
• CRM (professionals): Contacts, stages, activities, reminders, webhooks owned by the professional account.
• Lockboxes, bookings & visit notes: Showing requests, availability bookings, RSVPs, private visit notes.

D. Email, marketing & consent records

• Email logs: Operational delivery metadata (default ~90 days).
• Newsletter prefs: Category opt-ins and unsubscribe state.
• Marketing consent ledger: Email, categories, consented_at, source (footer/account/import), policy version for CASL auditability.

E. Marketing Hub & social connections

• OAuth: Linked accounts with encrypted tokens (enc:v1) and scopes; tokens excluded from self-serve exports.
• Content & brand kit: Drafts, schedules, organization brand assets.

F. AI-assisted features

• Listing text, images, or prompts you submit for describe/enhance/social generation. See AI Features & Processors.

G. Performance & technical data

• Web Vitals RUM: Metrics, path, device class; hashed IP; Analytics consent only; ~30 day retention.
• Device/usage: Browser, OS, pages, search queries, approximate region from IP.

1. Direct submissions: Registration, profiles, searches, showings, calculators, newsletter, contact forms.
2. Automated technologies: Logs, cookies, storage, first-party Web Vitals when Analytics is on.
3. Feeds & verification: Listing feeds, builder registries, professional badge checks.
4. Social OAuth: Encrypted tokens when professionals connect Marketing Hub accounts.

• Core platform: Search, maps (Mapbox when Functional allows), dashboards, saved listings.
• Lead facilitation: Route inquiries to the professional you selected.
• Notifications: Alerts and digests you requested.
• AI assistance: Content generation when you invoke those tools.
• Marketing Hub: Draft and publish to connected social accounts.
• Security & compliance: Fraud prevention, licensing, legal duties.
• Product improvement: First-party performance metrics under Analytics consent.

• Express opt-in: Marketing checkboxes off by default; consent stores timestamp, source, categories, policy version.
• Transactional: Security and service messages under existing business relationship rules.
• Unsubscribe: One-click in messages, account prefs, unsubscribe page, or privacy@propertybin.ca — within one send cycle / CASL 10 business days.

Zero sale policy: We do not sell or rent personal information to data brokers or external ad networks.

• Requested professionals: Your inquiry details shared with the agent/builder/service you contacted.
• Processors: Hosting, email, Mapbox (when allowed), AI providers for features you use — under contract.
• Legal: When required by Canadian law or to protect rights and safety.

Optional AI tools (Property AI, Marketing Hub content studio, ask-about-property) may send listing or marketing content you provide to configured LLM/image providers (e.g. OpenAI, Anthropic, Google, xAI). API keys stay in server environment only.

• Purpose: Generate or improve copy, blurbs, classifications, or answers you request.
• Minimization: We do not send passwords, payment data, or OAuth tokens in prompts.
• Not a sale: Processor relationship for the feature you invoked.
• Training: Provider terms apply; avoid sensitive third-party personal data in free-text prompts.

Core search and account features do not require AI. In-product notices appear near primary AI actions where practical.

Servers and backups may be in Canada and the United States. Processing outside Canada may be subject to foreign lawful access; we require contractual security controls from processors.

• Encryption: TLS 1.3; salted password hashing; marketing tokens enc:v1.
• Access control: RBAC and least privilege.
• Hardening: Rate limits, Secure/HttpOnly/SameSite session cookies.
• Breach notification: Where RROSH exists, notify individuals and the OPC as required.

• Active accounts: While the account remains active.
• Email logs: Default ~90 days (configurable).
• Web Vitals: ~30 days.
• Marketing consent / unsubscribe: As needed for CASL evidence and honouring withdrawal.
• CRM / leads: While the owning professional account is active, subject to owner deletion.
• Portfolio media: Until removed or account wipe.

Self-serve (logged-in): Use Account → Privacy & data to download a structured JSON export (secrets redacted) or submit an account deletion request. Deletion is logged, subject to cooling period and processing with a 30 calendar day target. Cookie preferences: footer Cookies or Manage preferences on this page.

Other channels: Email privacy@propertybin.ca. We respond within 30 calendar days without charge unless a statutory extension applies.

Categories match the preference centre: Essential, Functional, Analytics, and Marketing.

• Essential — Login, security, consent storage. Always on.
• Functional — Favourites, compare, recent, maps (Mapbox gated).
• Analytics — First-party Core Web Vitals; no third-party ad trackers in this category today.
• Marketing — Optional tags; off by default.

Detailed classification table (session cookie, pb_consent, localStorage keys, Mapbox, marketing tags) is also on the dedicated cookies page.

• Public profile: Published bio, headshot, and listings are visible to users.
• CRM: Inquiries must be handled under PIPEDA and applicable real-estate council rules.
• No lead resale: Professionals may not resell PropertyBin-sourced consumer personal information.
• OAuth tokens: Encrypted at rest; purged on disconnect or account deletion wipe.

PropertyBin is for individuals who have reached the age of majority in their province or territory. We do not knowingly collect minors’ personal information.

Material revisions are posted here with an updated date. Contact our Privacy Officer first; unresolved matters may be raised with the OPC (priv.gc.ca), BC OIPC, Alberta OIPC, or Québec CAI as applicable.