Privacy Policy

Mass Realty Inc. ("Mass Realty," "we," "us," or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have. This policy applies to all visitors and users of massrealtyinc.ca and its subpages.

1. Information We Collect

We collect information in the following ways:

• Contact and inquiry forms: When you fill out a contact, booking, or listing inquiry form, we collect your name, email address, phone number, and the message you submit.
• Home valuation requests: If you use our valuation tool, we collect property details you enter, including address, property type, size, and reported upgrades. If you are signed in, completed valuation results are stored locally on your device (browser localStorage) and are not transmitted to our servers.
• Property search: When you use the address search, the address or neighbourhood you enter is sent to Google Maps Platform (autocomplete and geocoding) and to our servers to retrieve nearby listings. We do not permanently store individual search queries.
• Member accounts: When you create a member account, we collect your full name, email address, and a password (stored as a bcrypt cryptographic hash — never in plain text). We also record the date and time you agreed to our Terms of Service, Privacy Policy, and VOW agreement. This information is stored in a private PostgreSQL database hosted by Neon.
• Email verification: Upon registration, we send a verification email via Resend. A one-time verification token is stored temporarily in our database and is deleted upon use or expiry (24 hours).
• Session data: When you sign in, an encrypted session token is stored in an httpOnly cookie on your browser. This cookie is used solely to authenticate your session and expires after 7 days.
• Agent accounts: Agents registered through the admin portal provide their name, email address, and a password (stored as a cryptographic hash). Agents may optionally upload a profile photo.
• Uploaded photos: Photos uploaded by agents or administrators are stored in Vercel Blob storage.
• Usage data: Our hosting provider, Vercel, may automatically collect standard server logs including IP addresses, browser type, and pages visited. We do not use third-party analytics tracking (such as Google Analytics).

2. How We Use Your Information

• To respond to your inquiries, booking requests, and contact form submissions.
• To provide property search results and AI-assisted property information.
• To generate home valuation estimates (for illustrative purposes only).
• To create and manage your member account, authenticate your sessions, and provide access to your personal portal.
• To send transactional emails, including account verification and account-related notifications.
• To manage agent and administrator accounts on our portals.
• To improve the functionality and content of our website.
• To comply with applicable law, regulatory requirements, and our obligations under the PropTX Virtual Office Website (VOW) agreement.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

3. Third-Party Services

We use the following third-party services that may process your data as part of delivering our platform:

• Vercel Inc.: Our hosting provider and serverless infrastructure. Vercel processes all web requests and stores blob data (uploaded images, cached listing data) on our behalf. See Vercel's Privacy Policy.
• Neon (Neon Inc.): Member account information — including names, email addresses, and hashed passwords — is stored in a PostgreSQL database hosted by Neon. See Neon's Privacy Policy.
• Resend: Transactional emails (account verification) are delivered via Resend. Your email address is transmitted to Resend solely for the purpose of delivering these messages. See Resend's Privacy Policy.
• Anthropic, PBC: Our AI-powered home valuation tool is processed using Anthropic's Claude API. Anthropic may retain data in accordance with their own data retention policies. See Anthropic's Privacy Policy.
• Google Maps Platform: Address autocomplete and geocoding in the member portal are powered by Google Maps Platform. Google may process the address queries you enter in accordance with their own policies. See Google's Privacy Policy.
• Pinecone: We use Pinecone for vector-based property search. Property listing data (not personal information) is stored as vector embeddings. See Pinecone's Privacy Policy.
• OpenStreetMap / Nominatim: Some address inputs are geocoded using the Nominatim API operated by the OpenStreetMap Foundation. No account or personal identifier is transmitted. See OSMF's Privacy Policy.

4. Cookies and Session Storage

We do not use advertising cookies or cross-site tracking technologies. The following are the only browser storage mechanisms we use:

• Authentication cookie: When you sign in to your member account, an encrypted httpOnly session cookie (mr_session) is set on your browser. This cookie is Secure, SameSite=Lax, and expires after 7 days. It is used solely to authenticate your session and is never accessible to client-side scripts.
• localStorage: Your saved listings and saved valuation results are stored in your browser's localStorage on your device. This data is never transmitted to our servers and is cleared if you clear your browser data.
• sessionStorage: Listing data may be temporarily cached in sessionStorage to improve navigation performance within a single browser session. This data is cleared when you close your browser tab.

5. Data Retention

Contact form submissions and inquiry messages are retained only as long as necessary to respond to your request. Member account data (name, email, hashed password, VOW agreement timestamp) is retained until you request deletion of your account. Email verification tokens are automatically deleted after use or after 24 hours, whichever comes first. Agent account data is retained until the account is removed by an administrator. Uploaded photos remain in storage until explicitly deleted. AI chat messages are not stored on our servers beyond the duration of a single session.

To request deletion of your member account and associated data, contact us at shahidg.homes@gmail.com.

6. Data Security

We take reasonable technical measures to protect the data we hold. Agent and administrator passwords are stored as bcrypt hashes and are never accessible in plain text. All data is transmitted over HTTPS. However, no system is completely secure, and we cannot guarantee absolute security of information transmitted over the internet.

7. Your Rights

If you are a resident of Ontario or Canada, you have rights under PIPEDA (Personal Information Protection and Electronic Documents Act) and applicable provincial privacy legislation, including the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal information, subject to legal retention requirements.
• Withdraw consent for certain uses of your data.

To exercise any of these rights, contact us at shahidg.homes@gmail.com.

8. Children's Privacy

Our website is not directed at children under the age of 18. We do not knowingly collect personal information from minors.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions or concerns about this Privacy Policy, please reach us at:

Mass Realty Inc.
shahidg.homes@gmail.com
(647) 824-8717