Privacy Policy

Scope

This policy applies to information we collect through summitly.ca and related services (including accounts, forms, and communications you send us). It does not govern third-party sites or services that we link to; their policies apply instead.

Information we collect

• Account and profile: name, email address, and similar details you provide when you register or sign in (including through a social login provider where you choose that option).
• Usage and device: IP address, browser type, general location derived from IP, pages viewed, and similar technical data collected through cookies and similar technologies.
• Communications: content of messages you send us (for example through contact forms, email, or in-product messaging), and related metadata needed to respond.
• Transactions and listings: information you submit in connection with property searches, valuations, rental management, or other real-estate-related features we offer.

How we use information

We use personal information to:

• Provide, maintain, and improve our services and website;
• Create and manage your account and authenticate you;
• Respond to inquiries and provide customer support;
• Send service-related notices and, where permitted, marketing (you may opt out of marketing where applicable);
• Detect, prevent, and address fraud, abuse, or security issues;
• Comply with law and enforce our terms.

Canadian privacy law

We operate in Canada and aim to handle personal information in line with applicable Canadian privacy laws, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA), where it applies. Depending on your province, other statutes may also apply. This policy is not legal advice; consult a professional if you need guidance specific to your situation.

Sharing and service providers

We do not sell your personal information. We may share information with:

• Service providers who assist us (for example hosting, analytics, email delivery, maps, or payment processing), subject to contractual protections;
• An error monitoring service, which receives technical reports when something on the site breaks so we can fix it. Before a report is sent we remove names, email addresses, phone numbers, the contents of messages and forms, cookies and sign-in details;
• Professional advisors when required (for example lawyers or accountants);
• Law enforcement or regulators when we believe disclosure is required by law or to protect rights, safety, or property.

Ads and measurement

We advertise on platforms such as Google and Meta (Facebook and Instagram). Their ad and measurement tags load on our site only after you allow Marketing cookies, and we honour the Global Privacy Control signal. If you allow Marketing cookies and send us a form, we may share a scrambled (hashed) copy of your email address or phone number with those platforms so they can tell us whether an ad led to your enquiry. We never share sold prices, the listings you view, or anything about your finances for advertising. Change your choice any time inCookie preferences.

Identity checks (FINTRAC)

As a real estate brokerage, we must follow Canada’s anti-money-laundering law, theProceeds of Crime (Money Laundering) and Terrorist Financing Act. When you buy or sell through us, we must check your identity, keep records for at least five years, and in some cases report to FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada. The law does not let us ask for your consent to these reports or tell you whether one was made.

Summitly Property Management

Property management and leasing under a property management agreement are provided by Summitly Property Management, a separate company from our brokerage. When you deal with it, it handles your personal information under its own agreement with you. Where we share information between the two companies (for example, to pass on a rental enquiry you sent us), we share only what is needed and tell you first.

Artificial intelligence and automated features

Some features use artificial intelligence and automated processing, including Zara, our AI assistant; automated home value estimates (AVMs); and personalization such as recommended listings and neighbourhood insights. When you use these features:

• Your inputs (such as questions you ask Zara, or a property you value) and related data may be processed by us and by third-party AI service providers acting on our behalf — under contractual confidentiality and security protections — to generate a response and to operate, secure, and improve the features.
• Outputs are generated automatically and are for general information only; they are not appraisals and not professional, legal, financial, or real estate advice. Please do not enter sensitive personal information you would not want processed this way.
• We do not use these features to make decisions producing legal or similarly significant effects about you without human involvement, and we do not sell your information or use your private inputs for third-party advertising.

See our Terms of Use for more on how AI features and estimates may be used.

Cookies and similar technologies

We use cookies and similar technologies to remember preferences, keep you signed in where applicable, measure traffic, and improve the site. You can control cookies through your browser settings; disabling some cookies may limit certain features.

Site activity we record ourselves

When you're signed in, we record what you do on Summitly as part of your account: the listings and new-homes projects you view and how long you spend on them, what you share (how you shared it, not who with), the searches you run (the area, type, price range and bedrooms, not what you type), the homes you save or remove, the alerts you set, which calculators you use (not your numbers), the monthly reports you open, the tours and consultations you book, the forms you send, the topics you ask Zara about (not your messages), and whether you used the app or a computer. The agent helping you also sees your own reactions and comments on homes on your family board, and your family members' reactions by first name. This happens whether or not you accept analytics cookies, because it is part of the account you signed up for. It is kept as a record of your file with us and is deleted when you delete your account.

When you're not signed in, our own servers (no third-party ad pixels) record the same kind of activity only if you accept analytics cookies, under a random identifier stored in a first-party cookie. If you reject analytics cookies, nothing is recorded; if you later withdraw, recording stops and the activity not yet linked to you is deleted. Browsers that send a Global Privacy Control or Do Not Track signal are never recorded while signed out.

We link that activity to you only after you sign in or send us a form that shows this notice. We use it so the agent helping you can follow up on the homes you care about. Only that agent, their team lead and the brokerage's broker of record and privacy staff can see it, every view is logged, and we never infer or record anything about race, religion, family status, disability, age or any other ground protected by the Human Rights Code.

Retention

We retain personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law (for example records needed for tax, accounting, or dispute resolution). When retention ends, we delete or anonymize information where feasible.

Site activity that was never linked to a person is deleted after 13 months at most. The detailed page, listing and search activity of a known contact is deleted after 24 months; a short day-by-day summary (for example "viewed 3 condos in Leslieville") is kept as part of your file until you delete your account. Inquiries, messages and consent records are kept while we have a relationship with you; transaction files are kept as long as real estate and anti-money-laundering rules require.

Security

We use reasonable administrative, technical, and organizational measures to protect personal information. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If there’s a breach

If a breach of our security safeguards creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner of Canada as soon as we can, and tell any other organization that can reduce the harm. We keep a record of every breach for at least two years.

Your choices and rights

Subject to applicable law, you may have the right to request access to, correction of, or deletion of your personal information, and to withdraw consent where processing is consent-based. To exercise these rights, contact us using the details at the top of this page. We may need to verify your identity before acting on a request.

You can also use our online privacy request form. We confirm requests by email before acting on them and reply within 30 days. Signed-in users can download their data at any time from Settings.

Our Privacy Officer

The Privacy Officer, Summitly is accountable for how we handle personal information and for this policy, and answers requests to see, fix or delete information and privacy complaints. Reach the Privacy Officer through ourprivacy request form, by phone at (905) 553-8500, or by mail at the address below. We reply within 30 days. If you’re not satisfied with our answer, you can complain to thePrivacy Commissioner of Canada.

If you live in Quebec

Quebec’s privacy law (Law 25) gives you extra rights. Tracking cookies stay off unless you turn them on. You can ask to be told when a decision about you is made only by automated processing, and to have it reviewed by a person; ask us to give you your information in a commonly used format; and ask us to stop spreading or to de-index information about you where the law allows. Before we send personal information outside Quebec, we assess whether it will be properly protected. You can complain to the Commission d’accès à l’information du Québec.

British Columbia and Alberta

Where a Summitly office serves you in British Columbia or Alberta, that province’s private-sector privacy law (the Personal Information Protection Act, PIPA) also applies, and you can complain to that province’s Information and Privacy Commissioner.

Children

Our services are not directed to children under the age where parental consent is required in their jurisdiction. If you believe we have collected information from a child inappropriately, please contact us and we will take appropriate steps.

Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Where changes are material and required by law, we will provide additional notice as appropriate.

Contact

For privacy-related questions or requests (including access, correction, or deletion), use our privacy request form, call (905) 553-8500, or write to: