Privacy policy

What is collected, and why

• Your name and email address, when you create an account. Needed to create the account, to confirm the address is yours, and to keep the registrant record the Toronto Regional Real Estate Board requires of every Virtual Office Website.
• Your password, stored only as a salted hash. Homula cannot read it and cannot tell you what it is.
• What you asked to watch, where you ask to be told about activity in an area — the address or area you named, so the notification can be sent.
• Enquiries you send, including the message, the listing it concerns and the contact details you provide, so that someone can answer.
• A record of sale information shown to you — which listing, and when. The board requires this log and may audit it. It exists to demonstrate that sale data has been shown only to registered users, and to detect bulk extraction.
• Request records — pages requested and a coarse indication of where a request came from, kept briefly to enforce rate limits and detect scraping.
• Your approximate location, only if you ask for it. Choosing “homes near me” asks your device for its position and rounds it to about a hundred metres before it is sent — enough to know which neighbourhood you are in and not which building. It is used to run that one search, it appears in the address of the results page so the search can be repeated or shared, and it is never stored against your account. Declining changes nothing else about the site.
• A notification address for your browser, if you turn on alerts. This is a URL your browser issues that lets a message be delivered to it, together with the keys that encrypt the message. It identifies a browser, not a person, and switching alerts off deletes it.
• Passkeys you register — the public half of the key, a label naming the kind of device, and when it was last used. The private half never leaves your device and is never sent to Homula. What is stored here cannot sign anything or be used to sign in anywhere.

Homula does not ask for financial information, government identifiers, or a date of birth. Do not send them through this site.

Cookies

One cookie is set, and only once you sign in: a session identifier that keeps you signed in. It carries no personal information and is not used for advertising. There is no third-party advertising or cross-site tracking on this site.

Who it is shared with

Personal information is not sold, rented, or given to data brokers. It is shared only:

• with a Homula representative, or a brokerage Homula refers you to, when you send an enquiry — that is the point of sending it;
• with the service that delivers Homula’s email, in order to send you a verification message or a notification you asked for;
• with the Toronto Regional Real Estate Board where its rules or an audit require it, including the registrant and sale-disclosure records described above;
• with the notification service your own browser nominates — Google, Apple, Microsoft or Mozilla, depending on the browser — if you turn alerts on. That service relays the message and cannot read it: alerts are encrypted with keys only your browser holds.
• where the law requires it.

Listing photographs are shown directly from the real estate board’s own servers rather than copied onto Homula’s. That is what the board’s licence requires, and it means that when a page with photographs loads, your browser asks the board’s image service for them directly — so that service sees the request, as it would for any image on any website. Homula sends it nothing about you.

Where it is kept

Information is held on servers Homula controls. Those servers are currently located in the United States, which means the information may be accessible to authorities there under the laws that apply to it.

How long it is kept

Account information is kept while the account exists and for as long afterwards as the board’s rules require the registrant record to be retained. Enquiries are kept as business records. Request records used for rate limiting are kept only briefly. Watch instructions are deleted when you delete the watch.

Seeing it, correcting it, deleting it

Write to info@homula.com to see what is held about you, to correct it, to withdraw consent, or to have your account and its information deleted. Homula will respond within thirty days.

Withdrawing consent means the account closes, because the account cannot be operated without the registrant record the board requires. Records Homula is required to retain — the sale-disclosure log in particular — are kept for as long as that requirement lasts, and are not used for anything else.

If you are not satisfied with how a request was handled, you may complain to the Office of the Privacy Commissioner of Canada.

Security

Passwords are hashed, the site is served over an encrypted connection, and the application can read only the parts of the database it needs. No system is immune. If a breach affects you and creates a real risk of significant harm, Homula will notify you and the Privacy Commissioner as the law requires.

Children

The site is not intended for children, and accounts are not knowingly created for anyone under 18.