Privacy Policy

1. Who we are

evim.ca ("evim.ca", "we", "us") builds and hosts websites for real estate agents. The legal operator is named in our Terms of Service. This policy explains what personal information we collect, why, who we share it with, how long we keep it and what your rights are. It covers two groups of people: real estate agents who use evim.ca ("agents"), and visitors to agents' websites.

Our Privacy Officer is in charge of privacy at evim.ca. You can reach them at privacy@evim.ca or by mail at the address in section 13.

2. What we collect from agents

• Account details: your name, email address, password (stored only as a secure hash by our authentication provider) or your Google sign-in, and your time zone.
• Your registration details: registered name, registration number, category, title, brokerage and, if you choose to send it, a screenshot or document that helps us check your registration.
• Your site's content: photos, biography, contact details, areas served, listings, services and testimonials.
• Billing details: your plan and the payments you made. Card details go to Paddle, our reseller, and never to us.
• Your choices: whether you accepted our terms and when, and whether you agreed to receive product news.
• Basic security records: when you signed in and what you changed, so we can investigate problems.

3. What we collect from visitors

On evim.ca itself (not on agents' sites), we use Vercel Web Analytics to count visits to our own pages. It works without cookies and does not identify you.

On agents' sites:

• When a visitor sends a message through an agent's site: their name, email address, phone number if given, their answers to the form's questions and their message. We also keep a one-way hash of their IP address to fight spam; we do not store the address itself.
• Visit counting: we count page views per site per day. We don't use cookies for this and we don't store IP addresses or build profiles of visitors.
• Spam protection: Cloudflare Turnstile checks that a form is sent by a person and processes the visitor's IP address and browser details to do so.
• Maps: a map is loaded from Google Maps only after a visitor presses "Show map".

We collect visitors' messages on behalf of the agent who owns the site. The agent decides how to use them and is responsible for answering questions about that use. Each agent's site has its own privacy notice.

4. Why we use personal information

• To run evim.ca: to host agents' sites, deliver visitors' messages to the agent, and send the emails our service needs (sign-in links, receipts, alerts).
• To check that every published site belongs to a registered agent.
• To bill for plans, through Paddle.
• To keep the service secure and prevent spam, fraud and abuse.
• To answer support requests.
• To send product news, only to agents who agreed to receive it. You can unsubscribe at any time with the link in every such email.
• To meet our legal obligations.

We do not sell personal information. We do not use agents' content or visitors' messages to train artificial intelligence models.

5. Who we share it with

We use these service providers. They process personal information only on our instructions:

• Supabase (database, sign-in and file storage), with our database hosted in Canada.
• Vercel (hosting), in the United States.
• Resend (sending email), in the United States.
• Paddle (our reseller and merchant of record for payments).
• Cloudflare (Turnstile spam protection, and encrypted backups stored in Cloudflare R2).
• Google (maps, only after a visitor presses "Show map", and Google sign-in, only if an agent chooses it).
• Anthropic (only the text an agent sends to the writing helper, to suggest wording).
• ImprovMX (forwarding mail sent to evim.ca addresses).

Some of these providers process information outside Canada, mainly in the United States, where it may be accessible to courts and authorities under local law. We remain responsible for information we transfer to them.

6. How long we keep it

• Agent accounts and site content: while the account exists. After a plan ends, we keep the content for 90 days so the agent can publish again, then delete it. An agent who deletes their account has everything deleted within 30 days.
• Visitors' messages: until the agent deletes them, and at most 24 months after the message was last updated.
• Email delivery records: 90 days.
• Spam-protection counters: 2 days.
• Security and change records: 3 years.
• Records of service problems: 1 year (records of security breaches: 2 years).
• Payment records: 7 years, as tax law requires.

7. Security

We protect personal information with safeguards suited to its sensitivity: encrypted connections, access limited to the people who need it, two-factor sign-in for our administrators, private storage for registration documents, and encrypted backups. No system is perfectly secure.

8. Breaches

If a breach of our security safeguards involves personal information, we record it, assess the risk, and, when there is a real risk of significant harm, notify the people affected and the Office of the Privacy Commissioner of Canada. We tell affected agents within 72 hours of discovering a breach that involves their visitors' information.

9. Your rights

You can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, and withdraw a consent you gave (for example, to product news). Agents can download their data and delete their account from Settings, Account. Visitors who sent a message through an agent's site should first contact that agent; you can also write to us. We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

10. Quebec residents

If you live in Quebec, the Act respecting the protection of personal information in the private sector also applies. You have the rights above, and you can complain to the Commission d'accès à l'information du Québec.

11. Cookies

We use only the cookies needed to keep agents signed in and to protect forms from abuse. We don't use advertising or tracking cookies, and visit counting works without cookies.

12. Changes

We may update this policy. The date at the top shows when it last changed. If a change matters to agents, we will email them before it takes effect.

13. Contact

Privacy Officer, evim.ca, privacy@evim.ca, Pendik PTT, 34903 Pendik/İstanbul, Türkiye.