Privacy policy

Hously Technologies Inc. ("Hously," "we") operates the Hously website and mobile applications (the "Service"). This policy explains what personal information we collect, why we collect it, how we use it, and your rights under Canadian privacy law — primarily the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and substantially similar provincial laws in Québec, BC and Alberta.

1. Information we collect

We collect personal information in three ways:

1.1 Information you provide directly

Account information: full name, email address, phone number, postal code, password (stored as a bcrypt hash).
Profile preferences: saved searches, favourited listings, alert frequency, agent contact preferences.
Listing submissions (sellers): property details, photos, ownership documents, agent or brokerage credentials.
Calculator inputs (income, debt, down payment): used only locally and to render results — not stored on our servers unless you save a scenario.
Messages and notes you write to agents through the platform.

1.2 Information collected automatically

Device data: IP address, browser type, operating system, device identifier, language preference.
Usage data: pages visited, listings viewed, search queries, time spent per page, referrer URL.
Approximate location derived from IP (city-level only). We do not collect precise GPS coordinates unless you explicitly grant permission for an "open houses near me" feature.

1.3 Information from third parties

Listing data from CREA’s Data Distribution Facility (DDF), provincial real-estate boards, and direct broker feeds.
Public assessment data from MPAC (Ontario), BC Assessment, Stats Canada census tables.
Identity verification data from our verification provider (Onfido) for agents and high-value transactions, including a hash of government-issued ID.

2. How we use your information

We use personal information for the following purposes, all of which have a legitimate Canadian business basis:

Operate the Service: render search results, save your favourites, send transactional emails (account verification, password reset, listing alerts).
Personalize: surface listings that match your saved searches; suggest neighbourhoods similar to areas you’ve shown interest in.
Communicate: respond to questions you send through the contact form; deliver agent introductions if you request one.
Improve the Service: aggregate, anonymized analytics to understand which features people use and where the experience is broken.
Comply with law: respond to lawful production orders, court orders, or regulatory requests (e.g. FINTRAC obligations for high-value transactions).

We do not engage in automated decision-making that produces legal effects. Pricing recommendations and AVM ranges are advisory only — a human (you) makes the decision.

We share personal information only in the following narrow circumstances:

With agents you contact: when you submit an enquiry, we share your name, email and message with the listing agent or their brokerage. We never share your phone number unless you explicitly include it.
With service providers under contract: our cloud host (AWS Canada Central, Montréal), email provider (Postmark), analytics (Plausible — privacy-respecting, no cross-site cookies), error monitoring (Sentry self-hosted). All bound by written data-processing agreements.
For legal compliance: if required by a Canadian court order, subpoena, or regulator. We attempt to notify you unless legally prohibited.
In a corporate transaction: if Hously is acquired or merges, personal information may transfer as a business asset. We will notify you and you may delete your account before completion.

We do not sell personal information. We do not share it with advertising networks. We do not allow third-party advertising trackers on the Service.

4. Your PIPEDA rights

Under Canadian privacy law you have the right to:

Access the personal information we hold about you.
Correct information that is inaccurate or incomplete.
Delete your account and associated personal information (subject to legal retention requirements for tax, accounting and regulatory records).
Withdraw consent for marketing communications at any time without affecting your ability to use the core Service.
Port your data — we will provide an export in machine-readable JSON or CSV format within 30 days of a verified request.
File a complaint with the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or with your provincial regulator.

To exercise any right, write to our Data Protection Officer (DPO) at privacy@hously.ca. We will respond within 30 calendar days. Free of charge, except for excessive or repetitive requests.

5. Cookies and tracking

We use cookies and similar technologies sparingly:

Strictly necessary cookies for authentication and CSRF protection.
Functional cookies to remember your search filters and currency preferences.
Analytics via Plausible Analytics, which does not use cross-site cookies and does not collect personally identifiable information.

We do not use third-party advertising cookies, retargeting pixels, or social-network tracking. You can opt out of functional and analytics cookies at any time in your account settings.

6. Marketing communications (CASL)

Canada’s Anti-Spam Legislation requires that we obtain express consent before sending you commercial electronic messages. When you sign up, we will ask whether you’d like to receive our weekly market report. You can unsubscribe at any time via the link in every email — we honour unsubscribes within 10 business days. Transactional emails (account confirmation, listing alerts you set up, password reset) are exempt from CASL and will continue regardless of marketing preference.

7. Data retention

We retain personal information only as long as needed for the purpose collected:

Account data: retained while your account is active and for 24 months after deletion to prevent fraud.
Search and browsing history: retained for 18 months, then deleted or fully anonymized.
Calculator scenarios: retained until you delete them.
Transaction records (regulatory): retained for the period mandated by applicable law, generally 7 years.
Backup snapshots: rotated out within 35 days.

8. Security

We follow industry-standard practices including TLS 1.3 in transit, AES-256 at rest, bcrypt for passwords, role-based access controls, and continuous logging. Our infrastructure is hosted entirely on Canadian soil (AWS Canada Central, Montréal region). Despite reasonable precautions, no system is perfectly secure. If a breach occurs that poses real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner without unreasonable delay.

9. Children’s information

The Service is not directed to children under the age of 14, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.

10. International transfers

All primary processing happens in Canada (Montréal). Limited operational data — for example, customer support tickets — may transit US-based service providers (Postmark, Sentry-hosted, Slack). We rely on contractual safeguards modeled on the OPC’s PIPEDA Guidelines for Processing Personal Data Across Borders. By using the Service, you consent to these transfers.

11. Contact our DPO

Questions, complaints, or requests:

Email: privacy@hously.ca
Mail: Data Protection Officer, Hously Technologies Inc., 215 Spadina Ave, Suite 400, Toronto, ON M5T 2C7
Phone: +1 (416) 555-0148

This document is reviewed at least annually. Material changes will be communicated by email at least 30 days before they take effect. Minor edits (clarifications, formatting) are noted in our public change log.