Privacy Policy

1. About This Policy

FlatKey Realty Ltd. (“FlatKey”, “we”, “us”) is a real estate brokerage regulated by the BC Financial Services Authority (BCFSA) under the Real Estate Services Act. This policy explains what personal information this website collects from visitors — people browsing listings, using our property search, or sending us an inquiry — how we use it, and the choices you have.

We handle personal information in accordance with British Columbia's Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Our Managing Broker, Tom Majek, is our Privacy Officer.

If you go on to engage FlatKey as your brokerage, a separate and more extensive set of information is collected under your service agreements — see Section 11.

2. Information We Collect from Visitors

a) Information you choose to send us

You can browse and search this website without providing any personal information. We collect what you submit through our forms:

• Property inquiries and offer requests: your first and last name, email address, phone number, and any message you write, along with the listing you asked about
• Seller inquiry form: your name and contact details, plus any property information you choose to share (address, property type, size, condition, asking price, timeline)
• Recommendation pages: if we invite you by private link, we collect the public display name you choose (or use “Client” if you leave it blank), your publishable recommendation, and any optional confidential improvement feedback you provide

If registered property search is available, we also collect the name, email address, phone number, relationship type and real-estate purpose you provide, the versions of the terms and privacy notice you accept, and account confirmation, access, renewal and revocation records. Passwords are stored only as one-way hashes; we cannot retrieve the password you entered.

b) Information collected automatically

• Server logs: IP address, browser type (user agent), pages requested, and timestamps — standard records kept by web servers
• Security data: short-lived request counters (per IP address and, for form submissions, per email address) and temporary blocklist entries used to detect and stop automated abuse
• Search queries: the text and filters you use in property search (see Section 4), which may appear briefly in our application logs
• Registered-search activity: while signed in, we associate searches, result counts and listing views with your verified account so we can provide the service, maintain an audit trail, understand the properties you are researching and follow up in our contact-management system. We do not describe automated listing matches as your views.

3. How We Use Visitor Information

• Responding to you: when you send an inquiry, we use your contact details to reply, normally through the channel you used
• Providing search: turning your search text into results and showing listings on the map
• Recommendations: after manual review, we may publish the recommendation and public display name submitted under the notice shown on the invitation form
• Service improvement: optional improvement feedback is used internally by the Managing Broker for learning and service improvement; it is not published or used in marketing
• Site security: rate limiting, blocking automated abuse, and troubleshooting problems
• Understanding usage: aggregate, non-identifying counts for anonymous visitors; registered property-search activity is connected to the account as described above

We do not currently send marketing newsletters to website visitors. Any commercial electronic message we send must meet the consent, sender-identification, contact-information, and unsubscribe requirements described in Section 8.

4. AI-Assisted Search

Our property search box accepts plain-language queries (for example, “3 bed townhouse in Squamish under 1.2M”). To interpret a query, we send the text you type — and no account or contact fields — to an AI service provider (Anthropic), which returns structured search filters. Please do not put personal, confidential, or transaction information in a search query.

We do not opt in to using API inputs or outputs to train the provider’s models. Under the provider’s standard commercial API terms, inputs and outputs are normally deleted from its systems within 30 days, subject to limited exceptions such as legal requirements, usage-policy enforcement, or different contractual retention controls. We use the query only to produce your search results.

5. Cookies & Third-Party Content

We use cookies strictly for functional purposes:

• Session cookie: supports site security, including protection of our forms against cross-site request forgery (CSRF)

We do not currently use advertising cookies, third-party analytics services, or anything that tracks individual visitors across websites.

Some page resources load directly from third parties: web fonts (Google Fonts), open-source script libraries (the unpkg content delivery network), and the interactive map on our search page (Mapbox). When your browser fetches these, the provider receives your IP address and standard request details, under its own privacy policy. Links to external websites (for example, BCFSA consumer resources) lead to sites we do not operate and are covered by those sites’ policies.

6. Storage & Security

• Location: information you submit through this website is stored on servers located in Canada
• Encryption in transit: all traffic to and from the site uses HTTPS/TLS
• Access controls: visitor information is accessible only to our Managing Broker and the systems needed to operate the site
• Application security: security headers, form protections, and rate limiting on all public endpoints

No website can guarantee absolute security, but we take reasonable safeguards appropriate to the sensitivity of the information we hold.

7. How Long We Keep Visitor Information

• Inquiries and contact records: retained while they reasonably serve the purposes described in Section 8 or remain necessary for legal or business purposes; they are not subject to an automatic expiry rule, but they are reviewed and may be deleted or de-identified when no longer needed
• Recommendations and private feedback: retained while needed for publication, service improvement, brokerage records, or another legal or business purpose; you may ask us to remove a published recommendation or review the information we retain, subject to applicable record-keeping requirements
• Registered property-search records: account identity, accepted terms, access evidence and associated search activity are kept for the period required by the applicable MLS agreement and for at least 180 days after access expires, and longer where reasonably needed for security, an ongoing relationship, legal compliance or dispute resolution
• Server and application logs: kept for a short period — currently about two weeks — then deleted automatically
• Security counters and blocklists: expire automatically, typically within minutes for rate-limit counters and within 24 hours to 7 days for blocklist entries
• Email delivery records: if an email address bounces, complains, or unsubscribes, we keep a minimal suppression record so we do not contact that address again

This section describes visitor data. Records for brokerage clients are subject to longer, legally mandated retention periods — see Section 11.

8. If You Contact Us or Ask to Hear From Us

When you send an inquiry, request information about a property, ask for a home evaluation, or otherwise give us your contact details, we create a contact record in our brokerage’s contact-management system. This is how a real estate brokerage keeps track of the people it is helping. That record can include your name and contact details, what you asked about, the source of the inquiry, and notes of our conversations with you.

How long we keep it. Real estate decisions often unfold over years, so a contact record may be useful for an ongoing relationship and ordinary business record-keeping. We retain it only while those purposes continue or it is otherwise necessary for legal or business purposes. Our system does not automatically purge contact records on a fixed date; the Privacy Officer reviews them and deletes or de-identifies personal information when its purpose and any legal or business need have ended. You can ask us to review and delete your non-client contact record at any time. We may have to preserve information used to make a decision affecting you for at least one year, brokerage or transaction records described in Section 11, information subject to a legal hold, and a minimal suppression record needed to honour a do-not-contact request.

Commercial messages and your consent. We send commercial electronic messages only where Canada’s Anti-Spam Legislation (CASL) permits it. Express consent does not expire unless you withdraw it. Where the statutory conditions are met, implied consent generally lasts six months after your inquiry or application, or two years after a purchase, lease, or other qualifying existing business relationship. We track the basis and expiry of any implied consent and do not assume that merely receiving an address permits marketing.

Every commercial electronic message identifies FlatKey Realty Ltd., provides current contact information, and includes a no-cost unsubscribe mechanism that can be readily performed. The contact information and unsubscribe mechanism remain valid for at least 60 days after the message. Unsubscribing is always honoured without further action from you, promptly and no later than 10 business days after your request. We may keep a minimal suppression record so we do not contact you again. Unsubscribing from commercial messages does not prevent us from responding when you contact us about a property or transaction.

We do not sell, rent, or trade contact records, and we do not share them with anyone for their own marketing.

9. When We Share Information

We do not sell personal information, and we do not share visitor information with anyone for their marketing purposes. We disclose it only:

• When you submit a recommendation for possible publication: after the Managing Broker approves it, we may publish the recommendation and only the public display name you chose (or “Client”); confidential improvement feedback is never included
• With service providers that help us operate the website — hosting and email delivery (Amazon Web Services, Canadian region), AI query interpretation (Anthropic), the search map (Mapbox), and address lookup (the BC Geocoder, a Province of British Columbia service) — each processing only what its function requires
• For registered property search: with the applicable real estate board and its authorized representatives where required to audit the Virtual Office Website, verify compliance, investigate misuse, or enforce the governing MLS agreement or legal rights
• When the law requires it — for example, in response to a court order or other lawful demand, or to our regulator, BCFSA

10. Your Privacy Rights

Under PIPA (and PIPEDA where it applies), you may:

• Access: make a written request for the personal information we hold about you and information about its use and disclosure — we respond within 30 days, subject to any extension permitted by PIPA
• Correction: ask us to correct inaccurate or incomplete information
• Withdrawal and deletion review: withdraw consent on reasonable notice, or ask us to review and delete your information; we stop consent-based use and delete or de-identify information when required, subject to legal, contractual, regulatory, and legitimate business requirements to preserve it
• Complain: contact our Privacy Officer (Section 12), and if you are not satisfied, file a complaint with BC’s Office of the Information and Privacy Commissioner (OIPC)

If a privacy breach involving your personal information creates a real risk of significant harm, we will notify you and the appropriate privacy regulator as required by law.

11. If You Become a FlatKey Client

This policy covers your use of the website. When you engage FlatKey Realty Ltd. as your brokerage, we collect further information that this policy does not govern: identity verification required by federal anti-money-laundering law (administered by FINTRAC), transaction and trust-accounting records required by BCFSA (generally retained for at least seven years after their creation), and the documents in your transaction file. That information is collected under your written service agreements and the disclosures provided to you at engagement, and its handling is governed by those agreements and applicable law. At engagement, FlatKey uses the current BCREA Privacy Notice and Consent form (Form #585 or its successor) to explain primary uses needed to provide real estate services and optional secondary uses such as future marketing. Optional secondary uses can be declined. That form complements this website policy and does not replace CASL’s separate requirements for commercial electronic messages. Client transaction records are maintained in British Columbia in accordance with BCFSA requirements.

12. Changes to This Policy

We may update this policy as our practices or the law change. The “Last updated” date at the top of this page shows the most recent revision, and material changes will be posted here.

13. Contact Us