Privacy Policy

This Privacy Policy applies to the Proprytor mobile application, the Proprytor website at proprytor.com, and the Proprytor CRM web platform used by licensed realtors who invite clients to the service (together, the "Service").

Proprytor is operated by Asteron Tech ("we," "us," "our"). We are the organization responsible for personal information processed through the Service under the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada.

We collect only what we need to operate the Service.

Information you provide directly:

• Account details — name, email address, phone number, profile photo
• Sign-in credentials — email and password, phone number for SMS verification, or an authentication token from Apple Sign In or Google Sign In
• Realtor connection — the realtor who invited you and your messaging history with them
• Property preferences — saved listings, search filters, favourited properties
• Communications — messages, voice notes, attachments, and audio call metadata you exchange in-app
• Shared media — photos, videos, and files you choose to send through chat
• Contacts (optional) — if you enable contact sync, names, phone numbers, and email addresses from your device address book
• Support requests — any information you provide when contacting our support team

Information collected automatically:

• Device information — device model, operating system version, app version, language settings
• Usage data — features used, screens viewed, listings opened, session duration
• Approximate location — city-level location derived from IP address, used to default the map view
• Precise location — only with your explicit permission, used to show nearby listings on the map
• Diagnostic data — crash reports and error logs to help us fix bugs

Proprytor supports four ways to sign in, all activated only after you accept an invitation from a licensed realtor:

• Email and password — your password is hashed and stored securely; we never store your password in plain text
• Phone number — you receive a one-time SMS verification code; we store your phone number to identify your account but do not store the code itself
• Apple Sign In — Apple shares a unique identifier and, at your discretion, your name and email. We never receive your Apple ID password
• Google Sign In — Google shares a unique identifier, your name, and your email address after you grant permission. We never receive your Google password

You can change your sign-in method at any time from Profile → Settings → Account. Removing one method does not affect the others, provided at least one remains active.

Proprytor requests access to device features only when needed, and only with your explicit consent. You can grant or revoke each permission at any time in your device settings.

• Push notifications — alerts for new messages, incoming calls, listing matches, price changes, and account updates. Delivered via Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android)
• Alarm and scheduled notifications — local reminders for viewings, open houses, or follow-ups. Stored and triggered on your device only; not sent to our servers
• Contact sync (optional) — reads names, phone numbers, and emails from your address book to help you find people on Proprytor. Data is matched using one-way hashing where possible and deleted from our servers within 30 days of your revocation request
• Photos, videos, and files — lets you attach media to chat messages. We only access files you specifically select and do not scan your entire library
• Camera — lets you take photos or videos inside chat, or update your profile picture
• Microphone — enables in-app audio calls and voice note recording
• Location — shows listings near you on the map. We do not track your location in the background

We use the information described above for the following purposes, and only these purposes:

• To create and maintain your account once a realtor invites you
• To authenticate you securely using your chosen sign-in method
• To connect you to your realtor and facilitate communication between you
• To display live MLS® listings, your saved properties, and personalized search results
• To send in-app and push notifications about messages, price changes, and listing matches
• To schedule reminders and alarms on your device when you request them
• To match your contacts (if enabled) to help you find people on Proprytor
• To allow you to share photos, videos, and files with your realtor inside chat
• To provide audio calls, messaging, and listing-sharing features
• To diagnose technical issues, improve app performance, and prevent abuse
• To respond to support requests and communicate important service updates
• To comply with legal obligations under Canadian law

Under PIPEDA, we collect, use, and disclose personal information only with your knowledge and consent, except where the law permits otherwise. By accepting your realtor's invitation and creating an account, you provide express consent to the processing described in this policy.

For features that require device access — location, camera, microphone, photo library, files, contacts, and notifications — we request your additional consent through your device's standard permission prompts.

With your realtor: Your assigned realtor can see your name, profile photo, contact information, messages, saved listings, and media you send in chat. This is the core function of the Service.

With service providers bound by contract to use your data only as needed:

• Cloud hosting providers — secure storage of account data, messages, and shared media
• MLS® / IDX data partners — supply listing data to us; we do not share your personal information with them
• Authentication providers — Apple and Google, when you use those sign-in methods
• SMS gateway providers — to deliver one-time verification codes
• Push notification services — Apple Push Notification service and Firebase Cloud Messaging
• Crash and analytics providers — anonymized diagnostic data only

For legal reasons: We may disclose information if required by a valid court order or legal process under Canadian law. We will challenge overly broad requests and notify you when permitted.

In a business transfer: If Proprytor is involved in a merger, acquisition, or sale of assets, you will be notified before your information becomes subject to a different privacy policy.

Your personal information is stored on servers located in Canada. We have chosen Canadian-resident infrastructure to keep your data subject to Canadian law wherever possible.

Some service providers (for example, Apple Push Notification service, Firebase Cloud Messaging, Apple Sign In, and Google Sign In) may transmit limited data through infrastructure located outside Canada. In those cases, the data is minimal and protected by industry-standard encryption in transit.

• End-to-end encryption for in-app messages — even we cannot read the contents
• Encryption in transit using TLS 1.2 or higher for all data between your device and our servers
• Encryption at rest for personal information stored in our databases
• Password hashing using industry-standard algorithms; we never store plaintext passwords
• One-way hashing of contact data where possible, to reduce exposure of your address book
• Access controls limiting employee access to personal information on a need-to-know basis, with logging and regular review
• Secure development practices including code review, dependency scanning, and regular security audits
• Incident response procedures in accordance with PIPEDA's mandatory breach reporting requirements

• Account information — retained while your account is active
• Messages, call metadata, and shared media — retained while your account is active
• Synced contact data — deleted within 30 days of disabling contact sync
• Scheduled reminders and alarms — stored on your device only; deleted when fired or removed
• Diagnostic and crash data — retained for up to 12 months, then deleted or anonymized
• Records required by law — retained for the legally required period, then deleted

When you delete your account, we permanently remove your personal information within 30 days, except where required by law.

• Right to access — request a copy of the personal information we hold about you
• Right to correction — ask us to correct inaccurate or incomplete information
• Right to withdraw consent — withdraw consent to our processing at any time
• Right to delete — request deletion of your account and associated personal information
• Right to challenge compliance — file a complaint with us, and if unresolved, with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email support@proprytor.com. We will respond within 30 days at no charge for routine requests.

You can delete your Proprytor account directly inside the app at any time:

1. 1
   Open Proprytor and sign in
2. 2
   Go to Profile → Settings → Account
3. 3
   Tap Delete Account and confirm

You can also request deletion by emailing support@proprytor.com from your registered address.

Once confirmed, your account is immediately deactivated. We permanently remove your personal information from active systems within 30 days. Backup copies are overwritten on our standard rotation, typically within 90 days.

If you signed in using Apple Sign In or Google Sign In, revoking access from those accounts does not delete your Proprytor account — use the in-app deletion flow above to fully remove your data.

Proprytor is not directed to children under the age of 13, and we do not knowingly collect personal information from children. Because the Service is invitation-based and used in the context of real estate transactions, our users are overwhelmingly adults.

If you believe a child has provided us with personal information, contact us immediately at support@proprytor.com and we will delete it promptly.

The Service incorporates a small number of third-party technologies, named here for transparency:

• Apple Sign In — optional sign-in method that respects Apple's private email relay
• Google Sign In — optional sign-in method using your Google account
• SMS gateway provider — delivers one-time verification codes when you sign in by phone number
• Apple Push Notification service — delivers push notifications to iOS devices
• Firebase Cloud Messaging (Google) — delivers push notifications to Android devices
• Jitsi — open-source WebRTC engine powering in-app audio calls; call media is peer-to-peer where possible and does not pass through our servers in plaintext

Links from the Service to external websites are governed by the privacy policies of those sites, not by this policy.

We may update this Privacy Policy from time to time as our practices change or as required by law. The "Effective" date at the top of this page tells you when it was last updated. We keep an archive of previous versions and will provide it on request.

For material changes, we will notify you in advance by email and through an in-app notice, and where required by law, we will request your renewed consent before the changes take effect.

If you have questions about this policy, want to exercise your rights, or wish to file a privacy complaint, get in touch. We take privacy seriously and respond to every inquiry.