Privacy Notice

PIPEDA (Personal Information Protection and Electronic Documents Act):PIPEDA applies to the collection, use, and disclosure of personal information in the course of commercial activities across Canada. As a commercial service provider, we are subject to PIPEDA's requirements, including obtaining meaningful consent, limiting collection to what is necessary, and safeguarding personal information.

Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25):Quebec's privacy legislation imposes additional requirements, including stricter consent requirements, mandatory privacy impact assessments for certain processing activities, the right to data portability, mandatory breach notification to the Commission d'accès à l'information du Québec, and the requirement to designate a privacy officer.

Alberta's Personal Information Protection Act (PIPA):Alberta's PIPA governs the collection, use, and disclosure of personal information by private-sector organizations operating in Alberta.

British Columbia's Personal Information Protection Act (PIPA):British Columbia's PIPA establishes requirements for private-sector organizations regarding the handling of personal information in British Columbia.

California's CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act): The CCPA, as amended by the CPRA, grants California residents specific rights regarding their personal information, including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information.

Other US State Privacy Laws: We also comply with other applicable state privacy laws, including the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), and other state privacy laws as they become applicable.

We collect the following information directly from Subscribers when they create an account and subscribe to the Service:

• Full name
• Email address
• Phone number
• Brokerage name and address
• Billing information (processed by our third-party payment processor; we do not store full payment card numbers)
• Professional license information (if applicable)

We collect information that Subscribers provide to customize their experience and presence within the Service:

• Professional headshot photographs
• Brokerage logos and branding materials
• Brand colors and styling preferences
• Communication style preferences (tone, language, and format preferences for AI-generated content)
• Biographical information (professional background, areas of expertise, service areas)

We collect voice samples and facial photographs only with your explicit, informed consent. This data is used solely for generating content on your behalf and is not shared with other subscribers, used for AI model training, or disclosed to third parties except as necessary to provide the content generation service.

The biometric and likeness data we may collect includes:

• Voice samples — audio recordings of your voice used for voice synthesis and content generation
• Facial photographs — images of your face used for content generation

You may withdraw your consent for the collection and use of biometric and likeness data at any time by contacting our Privacy Officer. Upon withdrawal of consent or account termination, this data will be deleted in accordance with our retention practices described in Section 8.

We collect data related to your use of the Service:

• Usage and billing metrics (credit consumption, cost tracking, and remaining balance)
• AI conversation logs (stored on the Subscriber's dedicated infrastructure, not on shared systems)
• Service access logs (login times, IP addresses, feature usage, and session duration)
• Infrastructure access metadata (connection timestamps and session duration; we do not record screen content)

When Subscribers connect third-party services to the Service, we may process the following data at the Subscriber's direction:

• API keys and integration credentials (stored on the Subscriber's dedicated infrastructure)
• Communications content created or managed through the Service
• Data accessed via integrated third-party platforms (such as CRM records, listing data, and social media content)

The scope of data accessed through third-party integrations depends on the permissions the Subscriber grants when connecting each service.

We collect the following information from visitors to websites operated as part of the Service on behalf of Subscribers:

• Name, email address, and phone number (submitted through contact or lead capture forms)
• Browsing behavior on the Subscriber's website (pages viewed, searches performed)
• Device and browser information (device type, screen resolution, browser version)

This data is collected on behalf of the Subscriber and is subject to Section 10 (Data Controller vs. Data Processor Roles) of this Policy.

We automatically collect certain technical data when you access the Service:

• IP addresses
• Browser type and version
• Operating system
• Cookies and similar tracking technologies (see Section 12)
• Referring URLs
• Date and time of access

A limited number of authorized Homies developers and quality personnel may access a limited sample of ordinary Conversation Content only to reproduce, diagnose, and fix bugs or conduct controlled product-improvement testing. They may not review conversations for advertising, sale, personal curiosity, competitive intelligence, unrelated employee monitoring, or training a shared model.

• Access is role-based and limited to people with a genuine need to know
• Access is limited in purpose, scope, and time and is subject to confidentiality obligations
• Access is logged where the applicable system supports access logging
• Synthetic, redacted, or de-identified content is used where reasonably practicable

“Private Details” include personal or confidential information concerning a client, lead, transaction party, property occupant, or other third party; draft or executed transaction documents; signatures; government identifiers; financial-account details; authentication secrets; legal advice or privileged content; biometric identifiers; precise non-public location; health information; and other information a reasonable real estate professional would treat as private or highly confidential.

Accepting the Terms or this Notice does not authorize a person to intentionally inspect Private Details during routine debugging or product testing. We may intentionally inspect identified Private Details only when an authorized Subscriber gives express written permission in an authenticated support ticket submitted through Homies Support.

The ticket must reasonably identify:

• The affected conversation, file, tool result, or time range
• The issue and permitted purpose
• The categories of Private Details that may be viewed
• The Homies team or role permitted to view them
• The permission period, limited to what is reasonably necessary

Permission is limited to the stated ticket, purpose, scope, and period. It does not authorize shared-model training or unrelated product analysis, may be withdrawn prospectively in the ticket, and ends when the work is complete.

If authorized personnel incidentally encounter apparent Private Details during otherwise permitted review, they must avoid further substantive inspection, restrict disclosure, and follow the applicable privacy or security process. Ticket permission is not required for automated processing necessary to provide or secure the Service. Narrowly scoped human access may also occur when reasonably necessary to respond to an active incident posing an imminent security risk, prevent serious harm or abuse, or comply with a valid binding legal demand. Where legally permitted and operationally safe, we will notify the affected Subscriber. These exceptions will not be used for routine debugging or product-improvement access.

To generate responses, the Service may transmit selected prompts, conversation context, files, and tool results to one or more AI model providers. Where a provider offers an applicable business-data control, Homies configures Homies-controlled provider accounts not to permit the provider to use Subscriber Content to train or improve its general models. Subscribers who connect their own model accounts are responsible for selecting and maintaining equivalent settings.

No-training controls and data retention are different. A provider may retain data for a limited period for service delivery, security, abuse monitoring, legal compliance, or account administration. Homies will describe a provider as offering zero data retention only where the contract, endpoint, Subscriber tier, and production configuration in use support that statement.

Homies will not use identifiable Subscriber Content, client or lead data, transaction documents, licensed property data, or Private Details to train or improve a shared or general model without a separate optional consent that clearly describes the proposed use and is permitted by applicable law.

Homies may offer an optional, user-isolated small language model or similar personalization feature. It is off by default and requires a separate affirmative opt-in identifying the eligible conversations or sources, purpose, provider, categories excluded by default, location, expected retention, deletion behaviour, whether humans review a training sample, and how to disable future use and request deletion.

Client or lead information, Private Details, transaction documents, bulk connected-service data, licensed property data, biometric data, and privileged content are excluded unless a separate lawful workflow and permission cover that category. One Subscriber's content or personalized model will not be used to train or serve another Subscriber or a shared model.

• Conversation history is stored on the Subscriber's dedicated infrastructure or other disclosed Service infrastructure
• Conversation history, saved memory, connected-source data, embeddings, and personalized models are distinct stores with different deletion behaviour
• De-identified, aggregate usage statistics (such as average credit consumption and general usage patterns) may be used to improve the Service
• Aggregate data does not identify individual Subscribers or their clients

• Conversation content and instructions are transmitted to third-party AI model providers to generate AI responses
• Provider training and retention practices vary by provider, endpoint, account tier, and production configuration
• Where an applicable control is available, Homies-controlled accounts are configured not to permit provider training on Subscriber Content
• Providers are subject to applicable contractual confidentiality, use, and data-protection restrictions
• We select providers that maintain appropriate security certifications and data protection standards

• Dedicated infrastructure is hosted by third-party data center providers in the United States
• Database hosting is provided by a third-party cloud database provider in Canada
• File storage (images, documents, and generated content) is provided by third-party cloud storage providers
• All hosting providers are subject to data processing agreements that require appropriate security measures

• Payment and billing information is processed by our third-party payment processor
• We do not store full credit card numbers on our systems
• Our payment processor is compliant with the Payment Card Industry Data Security Standard (PCI DSS)

• When the Subscriber connects third-party services, data flows to those services as directed by the Subscriber
• These data flows are initiated by the Subscriber and are subject to the third-party services' own privacy policies and terms of service
• We do not control and are not responsible for third-party data handling practices
• Subscribers are encouraged to review the privacy policies of all third-party services they connect

• We may share information with service providers who assist us in operating the Service, including providers of analytics, monitoring, communication, and support tools
• All service providers are bound by data processing agreements that restrict their use of personal information to the purposes specified by us
• Service providers are required to implement appropriate technical and organizational security measures

We may disclose personal information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, subpoena, court order, or government request
• Protect the rights, safety, or property of Valery Technologies Inc., our Subscribers, or the public
• Investigate potential violations of our Terms of Service
• Detect, prevent, or address fraud, security, or technical issues

• In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be transferred as part of the transaction
• We will provide notice to affected individuals before personal information becomes subject to a different privacy policy
• We will require the acquiring entity to honor the commitments made in this Privacy Notice or provide notice of any changes

We share limited information from our public-facing websites and sign-up pages with third-party advertising and analytics partners to measure the performance of our marketing campaigns, as described in Section 12.3. This never includes your conversations, files, or other content from within the Service.

• Dedicated infrastructure: Located in the United States. Each Subscriber is assigned dedicated infrastructure that is not shared with other Subscribers.
• Database (account data, billing, and configuration): Hosted in Canada.
• File storage (images, documents, and generated content): Stored using cloud-based storage services.
• AI processing: Data is transmitted to third-party AI model providers whose servers may be located in various countries.

Your dedicated infrastructure is located in the United States. Your account and billing data is stored in Canada. When you interact with the AI assistant, your instructions and conversation data are transmitted to third-party AI model providers, which may process this data in jurisdictions outside of Canada and the United States. We ensure that appropriate safeguards are in place to protect your information during these transfers.

Specifically:

• Personal information of Canadian subscribers may be processed in the United States and other jurisdictions where our service providers operate
• Personal information of US subscribers may be processed in Canada and other jurisdictions where our service providers operate
• PIPEDA cross-border requirements: We ensure a comparable level of protection through contractual safeguards with all service providers that process personal information outside of Canada. Our contracts require service providers to implement security measures that are consistent with Canadian privacy standards.
• Quebec Law 25 requirements: We conduct privacy impact assessments for cross-border transfers of personal information of Quebec residents. We ensure that equivalent protection is provided through contractual and organizational safeguards in accordance with Quebec privacy legislation.

We implement a range of technical and organizational measures to protect your personal information, including:

• Encryption in transit and at rest — all data transmitted between your browser and our systems is encrypted using TLS/HTTPS; data stored on our infrastructure and in our databases is encrypted at rest
• Isolated dedicated infrastructure — each Subscriber is assigned dedicated infrastructure that is not shared with other Subscribers, providing physical and logical isolation of AI conversation data, integration credentials, and local memory
• Per-user credential isolation with spending caps — each Subscriber's usage is metered through individual credentials with configurable spending limits
• Access controls — access to the Service and administrative functions is protected by authentication controls
• Credential storage — integration credentials and API keys are stored using encrypted credential management on the Subscriber's dedicated infrastructure
• Regular security monitoring — we conduct ongoing health checks, vulnerability assessments, and security monitoring of our infrastructure
• Employee access limitations — access to personal information is limited to employees and contractors who have a legitimate business need and are bound by confidentiality obligations

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

In the event of a data breach involving personal information, we will notify affected individuals and applicable regulatory authorities within the timeframes required by law:

• Canada (PIPEDA): As soon as feasible after determining that a breach poses a real risk of significant harm to an individual
• Quebec (Law 25): Within seventy-two (72) hours to the Commission d'accès à l'information du Québec
• United States (CCPA/CPRA and state laws): As required by applicable state breach notification laws

Breach notifications will include:

• The nature of the breach
• The types of personal information affected
• Steps we have taken in response to the breach
• Recommended protective measures for affected individuals
• Contact information for our Privacy Officer

If you are a Canadian subscriber, you have the following rights under PIPEDA:

• Right to access — You may request access to the personal information we hold about you
• Right to correction — You may request correction of inaccurate or incomplete personal information
• Right to withdraw consent — You may withdraw your consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions. We will inform you of the consequences of withdrawing consent.
• Right to challenge compliance — You may challenge our compliance with PIPEDA and file a complaint with the Office of the Privacy Commissioner of Canada

If you are a resident of Quebec, you have the following additional rights under Quebec's privacy legislation:

• Right to data portability — You may request to receive your personal information in a structured, commonly used, machine-readable format, or to have it transferred to another organization where technically feasible
• Right to de-indexation — You may request the removal of your personal information from search results or other dissemination mechanisms operated by us
• Right to information about automated decision-making — You have the right to be informed about any automated decision-making processes that use your personal information and to contest decisions made solely by automated means
• Right to be informed of privacy incidents — You have the right to be notified of any privacy incidents (data breaches) that affect your personal information

If you are a resident of Alberta or British Columbia, you have the following rights under your province's Personal Information Protection Act:

• Right to access and correct — You may request access to and correction of your personal information
• Right to file a complaint— You may file a complaint with the applicable provincial privacy commissioner:
  • Alberta: Office of the Information and Privacy Commissioner of Alberta
  • British Columbia: Office of the Information and Privacy Commissioner for British Columbia

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to know — You may request that we disclose what personal information we have collected, used, disclosed, and sold about you
• Right to delete — You may request that we delete the personal information we have collected about you, subject to certain exceptions
• Right to opt out of sale or sharing — You have the right to opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising. We do not sell your personal information for money. Our use of advertising cookies and similar technologies on our public websites (described in Section 12.3) may constitute “sharing” under the CCPA/CPRA; you may opt out of these technologies as described in Section 12.
• Right to non-discrimination — We will not discriminate against you for exercising any of your privacy rights
• Right to correct — You may request correction of inaccurate personal information
• Right to limit use of sensitive personal information — You may request that we limit the use and disclosure of your sensitive personal information to what is necessary to provide the Service

If you are a resident of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, or another state with an applicable privacy law, you may have similar rights, including:

• Right to access your personal information
• Right to correct inaccurate personal information
• Right to delete your personal information
• Right to opt out of certain processing activities
• Right to data portability

We will comply with all applicable state privacy laws and process your requests in accordance with the requirements of your jurisdiction.

You may exercise any of the rights described above by contacting us at privacy@homiesai.com. We will respond to your request within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.

• Response times: We will respond to your request within thirty (30) days under PIPEDA, or forty-five (45) days under the CCPA/CPRA, as applicable. If we require additional time, we will notify you of the extension and the reason.
• Identity verification: We may need to verify your identity before processing your request to protect against unauthorized access to personal information.
• Authorized agents: If you wish to designate an authorized agent to make a request on your behalf, the agent must provide proof of authorization.
• Appeals: If we deny your request, we will provide you with the reason and information about how to appeal the decision, where applicable.

We are the data controller for the following categories of personal information, meaning we determine the purposes and means of processing:

• Subscriber account information (name, email, phone, brokerage details)
• Billing and payment data
• Service usage data (login activity, feature usage, credit consumption)
• Technical data collected automatically (IP addresses, browser information, cookies)

We act as a data processor on behalf of the Subscriber for the following categories of personal information, meaning we process this data only at the Subscriber's direction and in accordance with their instructions:

• Data accessed through integrated third-party platforms at the Subscriber's direction
• Communications content created or managed through the Service
• Client contact information processed through the Service
• Visitor data collected through websites operated as part of the Service on behalf of the Subscriber

When you use the Service to process your clients' personal information (such as contact details, property preferences, communication history, and financial information), you are the data controller for that information and we are your data processor. You are responsible for ensuring you have the appropriate legal basis (such as consent) to process your clients' information through the Service.

As a data controller, Subscribers are responsible for:

• Obtaining all necessary consents from their clients before processing their personal information through the Service
• Providing appropriate privacy notices to their clients about how their information will be used
• Ensuring compliance with all applicable privacy laws regarding the processing of their clients' personal information
• Responding to privacy rights requests from their clients (we will assist you in fulfilling such requests upon your instruction)

We use essential cookies that are necessary for the Service to function properly. These include:

• Authentication cookies — to verify your identity and keep you logged in during your session
• Session management cookies — to maintain your session state and preferences
• Security cookies — to support security features and detect unauthorized access

These cookies are strictly necessary and cannot be disabled without affecting Service functionality.

We may use analytics cookies to understand how the Service is used and to improve the user experience. These cookies collect information in aggregate form and do not identify individual users.

On our public-facing websites and sign-up pages, we and our third-party advertising partners use cookies, pixels, and similar technologies to measure the effectiveness of our marketing campaigns — for example, to understand whether a visitor who signed up first arrived from one of our advertisements.

In connection with this measurement, we may share limited information with advertising partners, such as: device and browser information, the public pages you visited before signing up, advertising identifiers (such as click identifiers from an advertisement you interacted with), and — where you sign up — contact details in hashed (obfuscated) form used solely to match a sign-up to an advertising campaign.

These technologies operate on our public marketing and sign-up surfaces only. We do not use advertising or cross-site tracking technologies inside the logged-in workspace, and we never share your conversations, files, client information, or other workspace content with advertising partners.

Where required by applicable law, these technologies are used only with your consent (see Section 12.4). You can also limit them through your browser settings (Section 12.5) and through the opt-out rights described in Section 9.

Where required by applicable law (including Quebec Law 25 and certain US state privacy laws), we will obtain your consent before placing non-essential cookies on your device. You may manage your cookie preferences through the consent mechanism provided or through your browser settings.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies may affect the functionality of the Service.

Privacy Officer — Valery Technologies Inc.

• Email: privacy@homiesai.com
• Mailing Address: 390 Edgeley Blvd #18, Vaughan, ON L4K 3Z6

We will acknowledge receipt of your inquiry or request and respond within the timeframe required by applicable law.

If you are not satisfied with our response to your privacy inquiry or complaint, you may escalate your complaint to the applicable regulatory authority:

Canada:

• Federal: Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• Ontario: Information and Privacy Commissioner of Ontario — www.ipc.on.ca
• Quebec: Commission d'accès à l'information du Québec — www.cai.gouv.qc.ca
• Alberta: Office of the Information and Privacy Commissioner of Alberta — www.oipc.ab.ca
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia — www.oipc.bc.ca

United States:

• California: California Attorney General — oag.ca.gov
• Other US States: Your state's Attorney General or applicable regulatory authority