Privacy Policy

1. About This Policy

FlatKey Realty Ltd. (“FlatKey”, “we”, “us”) is a real estate brokerage regulated by the BC Financial Services Authority (BCFSA) under the Real Estate Services Act. This policy explains what personal information this website collects from visitors — people browsing listings, using our property search, or sending us an inquiry — how we use it, and the choices you have.

We handle personal information in accordance with British Columbia's Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Our Managing Broker, Tom Majek, is our Privacy Officer.

If you go on to engage FlatKey as your brokerage, a separate and more extensive set of information is collected under your service agreements — see Section 11.

2. Information We Collect from Visitors

a) Information you choose to send us

You can browse and search this website without providing any personal information. We collect what you submit through our forms:

• Property inquiries and offer requests: your first and last name, email address, phone number, and any message you write, along with the listing you asked about
• Seller inquiry form: your name and contact details, plus any property information you choose to share (address, property type, size, condition, asking price, timeline)
• Recommendation pages: if we invite you by private link, we collect the public display name you choose (or use “Client” if you leave it blank), your publishable recommendation, and any optional confidential improvement feedback you provide

If you create an ordinary saved-search account, we collect your name and email address, a one-way password hash, the terms and privacy-notice versions you accepted, account-confirmation records, and the search names and filters you choose to save. This account only saves active-listing filters; it does not create a brokerage relationship or grant access to protected sold data.

If the separately governed registered Virtual Office Website (VOW) search becomes available and you apply for it, we also collect the phone number, relationship type and real-estate purpose you provide, along with the required agreement, confirmation, access, renewal and revocation records. Passwords are stored only as one-way hashes; we cannot retrieve the password you entered.

b) Information collected automatically

• Server logs: IP address, browser type (user agent), pages requested, and timestamps — standard records kept by web servers
• Security data: short-lived request counters (per IP address and, for form submissions, per email address) and temporary blocklist entries used to detect and stop automated abuse
• Search queries: the text and filters you use in property search (see Section 4), which may appear briefly in our application logs
• Registered-search activity: while signed in, we associate searches, result counts and listing views with your verified account so we can provide the service, maintain an audit trail, understand the properties you are researching and follow up in our contact-management system. We do not describe automated listing matches as your views.
• Optional saved-search alerts: if you separately turn on email for a saved search, we keep the selected frequency, consent-notice version and timestamp, matching windows, listing identifiers and snapshots used in each alert, delivery-attempt status, provider message identifier, and pause or unsubscribe evidence

3. How We Use Visitor Information

• Responding to you: when you send an inquiry, we use your contact details to reply, normally through the channel you used
• Providing search: turning your search text into results and showing listings on the map
• Saved searches and requested alerts: saving your chosen filters and, only after a separate per-search opt-in, checking for new active listings and sending the daily or weekly email you requested
• Recommendations: after manual review, we may publish the recommendation and public display name submitted under the notice shown on the invitation form
• Service improvement: optional improvement feedback is used internally by the Managing Broker for learning and service improvement; it is not published or used in marketing
• Site security: rate limiting, blocking automated abuse, and troubleshooting problems
• Understanding usage: bot-filtered aggregate counts from short-lived security logs, plus optional consented first-party funnel measurement as described below; analytics sessions are not connected to an account

We do not currently send marketing newsletters to website visitors. Any commercial electronic message we send must meet the consent, sender-identification, contact-information, and unsubscribe requirements described in Section 8.

4. AI-Assisted Search

Our property search box accepts plain-language queries (for example, “3 bed townhouse in Squamish under 1.2M”). To interpret a query, we send the text you type — and no account or contact fields — to an AI service provider (Anthropic), which returns structured search filters. Please do not put personal, confidential, or transaction information in a search query.

We do not opt in to using API inputs or outputs to train the provider’s models. Under the provider’s standard commercial API terms, inputs and outputs are normally deleted from its systems within 30 days, subject to limited exceptions such as legal requirements, usage-policy enforcement, or different contractual retention controls. We use the query only to produce your search results.

5. Cookies & Third-Party Content

Necessary cookies support the site whether or not you allow optional measurement:

• Session cookie: supports site security, including protection of our forms against cross-site request forgery (CSRF)

Optional choices start off. Privacy-preserving first-party analytics and advertising measurement are separate choices. If the controls are not displayed, both optional systems are disabled. Rejecting optional measurement is as easy as accepting it, and necessary site functions remain available either way.

First-party analytics, if you allow it and we enable it, uses a random, short-lived session number plus coarse source, campaign and page-category labels. We use those aggregates to compare ad-platform claims with verified landing sessions and trusted outcomes. The analytics store does not contain IP addresses, user agents, names, contact details, account or lead identifiers, exact page paths, listing identifiers or addresses, search criteria, saved-search contents, VOW or sold-data activity, or inquiry text. It does not connect an anonymous session to a later login. Rows expire within 30 days.

Google Ads measurement, when enabled and you allow advertising, helps us understand whether our ads lead to a successfully submitted seller or buyer enquiry. The Google tag can use cookies and ad-click identifiers. Google receives technical request information, including your IP address and browser information, and the permitted marketing-page URL and validated ad-click parameters. A successful submission sends a conversion event with a random deduplication number, not your form contents or contact details. Our integration does not run on property-detail, search, VOW, account or staff pages. After advertising opt-in, we may retain validated ad-click identifiers from a search landing in our signed first-party session for up to one day and pass them to Google on a clean enquiry-confirmation page. Search terms, property identifiers and enquiry contents are not included. Ad personalization is disabled, and a Global Privacy Control signal keeps this measurement off. See how Google uses information from partner sites and Google’s Privacy Policy.

Meta measurement, if you separately allow advertising and we later enable and arm that integration, is limited to coarse server-side event and page-category labels. FlatKey does not load a Meta browser Pixel. We do not send or store for Meta an email address, phone number or hash, a browser advertising identifier, a lead, user or client identifier, an exact URL or query, a listing identifier or address, price or search criteria, authenticated, VOW, sold or saved-search behaviour, or inquiry content. The advertising path remains off unless consent, configuration, an exact public-host check and a separate operator arm all pass. A Global Privacy Control signal always keeps advertising off.

You can change your mind at any time. The controls below use ordinary HTML forms, so declining and withdrawing work with JavaScript disabled. Withdrawal prevents new optional events from our integration; it does not undo information already sent to a provider. You can also clear existing cookies through your browser. Our short-lived first-party analytics rows expire on their retention clock; Google handles information it received under its policy.

Some page resources load directly from third parties: web fonts (Google Fonts), open-source script libraries (the unpkg content delivery network), and the interactive map on our search page (Mapbox). When your browser fetches these, the provider receives your IP address and standard request details, under its own privacy policy. Links to external websites (for example, BCFSA consumer resources) lead to sites we do not operate and are covered by those sites’ policies. The site does not load a Meta browser Pixel.

6. Storage & Security

• Location: information you submit through this website is stored on servers located in Canada
• Encryption in transit: all traffic to and from the site uses HTTPS/TLS
• Access controls: visitor information is accessible only to our Managing Broker and the systems needed to operate the site
• Application security: security headers, form protections, and rate limiting on defended public endpoints

No website can guarantee absolute security, but we take reasonable safeguards appropriate to the sensitivity of the information we hold.

7. How Long We Keep Visitor Information

• Inquiries and contact records: retained while they reasonably serve the purposes described in Section 8 or remain necessary for legal or business purposes; they are not subject to an automatic expiry rule, but they are reviewed and may be deleted or de-identified when no longer needed
• Recommendations and private feedback: retained while needed for publication, service improvement, brokerage records, or another legal or business purpose; you may ask us to remove a published recommendation or review the information we retain, subject to applicable record-keeping requirements
• Ordinary saved-search accounts: kept while the account is active or reasonably needed to provide and secure the service; you can delete individual saved searches and may ask the Privacy Officer to review deletion of the account, subject to legal, security, dispute and suppression-record requirements
• Optional alert evidence: consent, matching-window, delivery-attempt and unsubscribe records are retained while needed to provide the requested alert and demonstrate that consent and unsubscribe choices were honoured, and longer where reasonably required for legal compliance or dispute resolution
• VOW records, if that separate service is activated: account identity, accepted VOW terms, access evidence and associated search activity are kept for the period required by the applicable MLS agreement and for at least 180 days after access expires, and longer where reasonably needed for security, an ongoing relationship, legal compliance or dispute resolution
• Server and application logs: kept for a short period — currently about two weeks — then deleted automatically
• Optional first-party analytics: random-session, coarse attribution and funnel rows expire within 30 days; small groups are suppressed in staff reports
• Optional advertising outbox: if the separately consented and armed aggregate-only integration is ever enabled, identifier-free rows expire within 30 days
• Security counters and blocklists: expire automatically, typically within minutes for rate-limit counters and within 24 hours to 7 days for blocklist entries
• Email delivery records: if an email address bounces, complains, or unsubscribes, we keep a minimal suppression record so we do not contact that address again

This section describes visitor data. Records for brokerage clients are subject to longer, legally mandated retention periods — see Section 11.

8. If You Contact Us or Ask to Hear From Us

When you send an inquiry, request information about a property, ask for a home evaluation, or otherwise give us your contact details, we create a contact record in our brokerage’s contact-management system. This is how a real estate brokerage keeps track of the people it is helping. That record can include your name and contact details, what you asked about, the source of the inquiry, and notes of our conversations with you.

How long we keep it. Real estate decisions often unfold over years, so a contact record may be useful for an ongoing relationship and ordinary business record-keeping. We retain it only while those purposes continue or it is otherwise necessary for legal or business purposes. Our system does not automatically purge contact records on a fixed date; the Privacy Officer reviews them and deletes or de-identifies personal information when its purpose and any legal or business need have ended. You can ask us to review and delete your non-client contact record at any time. We may have to preserve information used to make a decision affecting you for at least one year, brokerage or transaction records described in Section 11, information subject to a legal hold, and a minimal suppression record needed to honour a do-not-contact request.

Commercial messages and your consent. We send commercial electronic messages only where Canada’s Anti-Spam Legislation (CASL) permits it. Express consent does not expire unless you withdraw it. Where the statutory conditions are met, implied consent generally lasts six months after your inquiry or application, or two years after a purchase, lease, or other qualifying existing business relationship. We track the basis and expiry of any implied consent and do not assume that merely receiving an address permits marketing.

Every commercial electronic message identifies FlatKey Realty Ltd., provides current contact information, and includes a no-cost unsubscribe mechanism that can be readily performed. The contact information and unsubscribe mechanism remain valid for at least 60 days after the message. Unsubscribing is always honoured without further action from you, promptly and no later than 10 business days after your request. We may keep a minimal suppression record so we do not contact you again. Unsubscribing from commercial messages does not prevent us from responding when you contact us about a property or transaction.

Saved-search alerts are optional. Saving a search does not start email. If alerts are available, you must make a separate choice for each saved search and select daily or weekly delivery. The consent notice identifies FlatKey, the purpose and frequency, our contact details, and how to stop the messages. You may pause an alert in your account or use the no-cost unsubscribe link in an alert. We record the notice version and time of that choice so we can apply and demonstrate your instructions.

We do not sell, rent, or trade contact records, and we do not share them with anyone for their own marketing.

9. When We Share Information

We do not sell personal information, and we do not share visitor information with anyone for their marketing purposes. We disclose it only:

• When you submit a recommendation for possible publication: after the Managing Broker approves it, we may publish the recommendation and only the public display name you chose (or “Client”); confidential improvement feedback is never included
• With service providers that help us operate the website — hosting and email delivery and delivery-event reporting (Amazon Web Services, Canadian region), bot detection for account creation (Cloudflare Turnstile), AI query interpretation (Anthropic), the search map (Mapbox), and address lookup (the BC Geocoder, a Province of British Columbia service) — each processing only what its function requires
• For registered property search: with the applicable real estate board and its authorized representatives where required to audit the Virtual Office Website, verify compliance, investigate misuse, or enforce the governing MLS agreement or legal rights
• With Google for Ads measurement: only when that integration is enabled and you allow advertising, as described in Section 5. We do not send your enquiry content or contact details through this integration
• With Meta Platforms, Inc. — only if you have affirmatively allowed advertising measurement and the separately controlled integration is later activated, and only the coarse, identifier-free information described in Section 5. We receive no payment for this and we do not provide Meta with your identity, enquiries, messages, searches, listing interests, or documents
• When the law requires it — for example, in response to a court order or other lawful demand, or to our regulator, BCFSA

10. Your Privacy Rights

Under PIPA (and PIPEDA where it applies), you may:

• Access: make a written request for the personal information we hold about you and information about its use and disclosure — we respond within 30 days, subject to any extension permitted by PIPA
• Correction: ask us to correct inaccurate or incomplete information
• Withdrawal and deletion review: withdraw consent on reasonable notice, or ask us to review and delete your information; we stop consent-based use and delete or de-identify information when required, subject to legal, contractual, regulatory, and legitimate business requirements to preserve it
• Complain: contact our Privacy Officer (Section 12), and if you are not satisfied, file a complaint with BC’s Office of the Information and Privacy Commissioner (OIPC)

If a privacy breach involving your personal information creates a real risk of significant harm, we will notify you and the appropriate privacy regulator as required by law.

11. If You Become a FlatKey Client

This policy covers your use of the website. When you engage FlatKey Realty Ltd. as your brokerage, we collect further information that this policy does not govern: identity verification required by federal anti-money-laundering law (administered by FINTRAC), transaction and trust-accounting records required by BCFSA (generally retained for at least seven years after their creation), and the documents in your transaction file. That information is collected under your written service agreements and the disclosures provided to you at engagement, and its handling is governed by those agreements and applicable law. At engagement, FlatKey uses the current BCREA Privacy Notice and Consent form (Form #585 or its successor) to explain primary uses needed to provide real estate services and optional secondary uses such as future marketing. Optional secondary uses can be declined. That form complements this website policy and does not replace CASL’s separate requirements for commercial electronic messages. Client transaction records are maintained in British Columbia in accordance with BCFSA requirements.

12. Changes to This Policy

We may update this policy as our practices or the law change. The “Last updated” date at the top of this page shows the most recent revision, and material changes will be posted here.

13. Contact Us