Privacy Policy

Effective: April 29, 2026

This Privacy Policy explains how BrokerPath (“BrokerPath”, “we”, “us”) collects, uses, discloses, and safeguards personal information when you use the BrokerPath platform (the “Service”). We comply with the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) and applicable Ontario privacy laws.

1. Who we are

BrokerPath is a software-as-a-service platform that helps Ontario real-estate brokerages manage trust accounting, commission calculations, FINTRAC records, and related compliance workflows. For most personal information we hold, your brokerage is the controller and BrokerPath is the processor. The Data Processing Addendum sets out the parties' respective obligations.

2. Information we collect

We collect the following categories of personal information:

• Account information — name, email address, hashed password, role (Broker of Record, Admin, Agent, Accountant), and optional time-based one-time-password (TOTP) secret used for two-factor authentication.
• Brokerage information — legal name, operating name, RECO registration number, HST number, business address.
• Deal information — property addresses, parties to a transaction (buyers, sellers, lawyers, co-operating brokerages), commission terms, deposit and bank-transaction records, and uploaded supporting documents.
• FINTRAC Receipt of Funds information — payer identity, source of funds, identification document type and number, politically-exposed-person status, and verification method, as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.
• Operational data — IP address, user-agent, session timestamps, and an append-only audit log of privileged actions.
• Billing information — handled by our payment processor (Stripe). We store only a customer identifier and subscription status; we do not store full card numbers.

3. How we use information

• To provide, secure, and maintain the Service.
• To enforce per-brokerage tenant isolation through database row-level security.
• To generate compliance documents (trust reconciliations, payout statements, trade record sheets, FINTRAC receipts).
• To send transactional emails (deposit received, deal closed, password reset).
• To detect and prevent fraud, abuse, and unauthorized access.
• To meet our legal and regulatory obligations.

4. Legal basis

Under PIPEDA, we rely on consent (express where required, implied where reasonable), the necessity of processing to perform the agreement between BrokerPath and the customer brokerage, and our legitimate interest in operating, securing, and improving the Service.

5. Disclosure

We do not sell personal information. We disclose personal information only:

• To other users within the same brokerage tenant, in line with their role.
• To service providers acting on our instructions (Vercel for hosting, Neon for database, Resend for email, Stripe for billing, Mapbox for address search, Vercel Blob for document storage). Each provider is bound by confidentiality and data-protection terms.
• To regulators or law enforcement when compelled by valid Canadian legal process, or where disclosure is required to comply with FINTRAC, RECO, or CRA obligations.
• To a successor entity in the event of a merger, acquisition, or sale of substantially all of BrokerPath's assets, subject to equivalent privacy commitments.

6. Cross-border transfers

BrokerPath strives to keep customer data in Canadian regions where our infrastructure providers offer them. Some providers (notably Stripe and Resend) may process data in the United States or other jurisdictions. By using the Service you acknowledge that personal information may be transferred to and processed outside of Canada, and that foreign governments may have lawful access to it under their own laws.

7. Retention

We retain personal information for as long as your brokerage maintains an active subscription, plus a regulatory tail period consistent with RECO record-keeping rules (currently six years for real-estate trust records). Audit-log entries are retained for the life of the tenant. On request and account closure, we will delete or de-identify personal information that we are not legally required to retain.

8. Your rights

Subject to PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Withdraw consent (subject to legal and contractual restrictions).
• File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise these rights, email privacy@brokerpath.ca from the address associated with your account. We will respond within 30 days.

9. Security

BrokerPath applies reasonable technical and organizational measures including TLS 1.3 transport encryption, argon2id password hashing, two-factor authentication for privileged accounts, database row-level security per tenant, an append-only hash-chained audit log, and least-privilege access controls. See our Trust & Security page for details.

10. Cookies

BrokerPath uses strictly necessary cookies for authentication (session token, CSRF protection). We do not use advertising, analytics, or third-party tracking cookies in the application today. If we add analytics in the future, we will update this policy and provide a clear opt-out before activating them.

11. Children

The Service is not directed to anyone under the age of majority in their province. We do not knowingly collect personal information from children.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated by email and surfaced in-app at least 14 days before they take effect.

13. Contact

Privacy Officer
BrokerPath
privacy@brokerpath.ca