Privacy Policy.

1. About this Policy

Capresta Corporation ("Capresta," "we," "us," or "our") operates a listing-infrastructure platform that coordinates pre-listing vendor services for real estate professionals. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our services across all platforms, including:

• our websites at capresta.ca, app.capresta.ca, and admin.capresta.ca;
• our mobile applications for iOS and Android (the "App"); and
• any related features, including our in-product assistant Scout and market-intelligence tools.

We refer to all of the above collectively as the "Services." This Policy applies regardless of whether you access the Services through a browser or the App. Where a practice applies only to the web or only to the App, we say so.

By using the Services, you acknowledge the practices described in this Policy. Where the law requires consent, we obtain it as described in Section 8.

We are committed to handling personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), the Accessibility for Ontarians with Disabilities Act (AODA), and other applicable Canadian privacy laws.

2. Who this Policy covers

The Services are used primarily by two groups:

• Realtors: real estate professionals who use the Services to book and coordinate pre-listing preparation and who are invoiced by Capresta for that work.
• Vendors: independent service providers (e.g., cleaning, photography, handyman, painting, landscaping, carpet cleaning, window cleaning, junk removal, and pressure washing) engaged by Capresta and coordinated through the Services.

This Policy also covers visitors to our websites, recipients of our communications, and individuals who contact us. The Services are intended for businesses and professionals and are not directed to children (see Section 14).

3. Information we collect

3.1 Information you provide directly

• Account and profile information: name, business name, email address, phone number, mailing or service address, brokerage or company affiliation, role, password, and similar registration details.
• Vendor onboarding information: trade categories, service areas, pricing you set, availability, business documentation, and other details needed to list and coordinate your services.
• Booking and service information: property addresses, scope of work, scheduling details, notes, and uploaded photos or files relating to a listing or job.
• Payment information: billing details processed through our payment processor. Card numbers and full financial account details are collected and stored by our payment processor (Stripe), not by Capresta. We receive limited transaction information such as confirmation, amount, and the last four digits of a card.
• Communications: the content of messages, support requests, survey responses, and correspondence you send to us or through the Services, including interactions with Scout and with our inbound voice agent.

3.2 Information collected automatically

When you use the Services, we and our service providers automatically collect certain technical information:

• Device and connection data: IP address, browser type, operating system, device type, device identifiers, language settings, and (on mobile) app version and build profile.
• Usage data: pages or screens viewed, features used, actions taken, timestamps, referring pages, and diagnostic and crash data.
• Cookies and similar technologies on the web (see Section 13).

3.3 Mobile-specific information and permissions

The App may request certain device permissions. We only access these after you grant permission, and only for the stated purpose. You can change permissions at any time in your device settings.

• Camera and photo library: to let you upload photos relating to a listing or job. We access only the images you choose to upload.
• Push notifications: to send booking updates, reminders, and operational alerts. You can disable these in your device settings.
• Location: if and where you enable it, to support address entry and service-area features. We do not continuously track your location in the background.
• Mobile identifiers and diagnostics: device identifiers and crash/performance data for security, fraud prevention, and reliability.

We do not use the App to serve third-party targeted advertising, and we do not currently collect device advertising identifiers (such as Apple's IDFA) for advertising purposes. If this changes, we will update this Policy and, on iOS, request your permission through Apple's App Tracking Transparency framework before any such tracking.

3.4 Information from third parties

We may receive information about you from sources such as a Realtor or Vendor you transact with through the Services, business contact and lead sources, payment and fraud-prevention partners, and analytics providers.

4. How we use information

We use personal information to:

• create and manage accounts and authenticate users;
• provide, operate, and coordinate the Services, including matching, scheduling, and fulfilling vendor bookings;
• process payments and billing, including invoicing Realtors for coordinated pre-listing work;
• power product features such as Scout (an in-product assistant) and our market-intelligence tools (see Section 5);
• communicate with you about bookings, service updates, security, and support;
• send marketing or promotional messages where permitted, subject to your consent and CASL (see Sections 8 and 12);
• maintain the security and integrity of the Services, prevent fraud, and enforce our terms;
• understand usage, troubleshoot, and improve the Services; and
• comply with legal obligations and exercise or defend legal claims.

We will not use your personal information for a materially new purpose without your knowledge and, where required, your consent.

5. AI and automated processing

Some features rely on artificial-intelligence services:

• Scout is an in-product assistant that helps users navigate the Services and answer questions.
• Our market-intelligence features (including the AI strategist and comparative market analysis tools) generate insights to support listing decisions.
• Our inbound voice agent may handle and route phone enquiries.

5.1 What data is sent to AI providers

When you use an AI feature, the following information may be transmitted to the third-party AI providers identified in Section 5.2 for processing:

• the content of your messages or questions submitted to Scout or spoken to the voice agent;
• conversation history within the same session, so the assistant can maintain context;
• limited contextual data needed to answer your request, such as the property address or listing details of a booking you are asking about, relevant service or scheduling information, publicly available market data, and your role on the platform (Realtor or Vendor); and
• basic technical metadata associated with the request.

We do not send AI providers your password, payment card details, or your full account profile. Only information relevant to the request is transmitted.

5.2 Who the data is sent to

Depending on the feature, this data is processed by one or more of the following providers acting as our service providers:

• Anthropic, PBC (United States): AI model provider for Scout and market-intelligence features;
• OpenAI, LLC (United States): AI model provider for certain Scout and AI features; and
• Retell AI (United States): inbound voice-agent handling (see Section 6.2).

These providers process data on our behalf under contractual terms that prohibit them from using your data for their own unrelated purposes, and they provide protection for your personal information that is the same as or equivalent to the protections described in this Policy. Under the commercial API terms we operate under, Anthropic and OpenAI do not use data submitted through our Services to train their models, and retain it only for limited periods for purposes such as abuse and safety monitoring before deletion.

5.3 How this data is used

Data sent to AI providers is used only to generate the response or output you requested, to maintain conversation context, and to support the safety, security, and reliability of the AI features. We may also review AI interactions to improve the quality of the Services.

5.4 Your permission

In the App, before you use an AI feature for the first time, we present an in-app disclosure describing what data is sent and to whom, and we ask for your express consent before any personal data is shared with an AI provider. If you decline, you can continue using the Services, but AI features will be unavailable. You can withdraw your consent at any time in the App's settings or by contacting our Privacy Officer (Section 18); withdrawal does not affect processing that occurred before withdrawal.

These tools are designed to assist users; they do not make decisions that produce legal or similarly significant effects about you without human involvement. Do not enter information into Scout or the voice agent that you do not wish to be processed for these purposes.

6. How we disclose information

We do not sell your personal information. We disclose personal information only as described below.

6.1 Between Realtors and Vendors

To fulfill a booking, certain information is necessarily shared between the Realtor and the assigned Vendor: for example, the property address, scope of work, scheduling details, and relevant contact information. This sharing is essential to providing the Services you request.

6.2 Service providers (processors)

We share information with vendors and partners who process it on our behalf, under contractual confidentiality and data-protection obligations, including:

• Supabase: authentication, database, and file storage;
• Stripe: payment processing and billing;
• Resend: transactional and operational email delivery;
• Vercel: web application hosting and delivery;
• Anthropic and OpenAI: AI model providers for Scout and market-intelligence features (see Section 5 for what data is sent, how it is used, and how we obtain your permission);
• Retell AI: inbound voice-agent handling (see Section 5);

and similar providers for analytics, security, and infrastructure. These providers may access personal information only as needed to perform services for us.

6.3 Legal and protective disclosures

We may disclose information where we reasonably believe it is required to comply with law, legal process, or a lawful government request; to enforce our agreements; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Capresta, our users, or the public.

6.4 Business transfers

If Capresta is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections. We will provide notice if your information becomes subject to a different privacy policy.

7. International data transfers

Capresta is based in Canada, and some of our service providers store or process information in the United States or other countries. When personal information is transferred outside Canada, it may be subject to the laws of the jurisdiction where it is held, including lawful access by courts, law enforcement, and national-security authorities. We use service providers that maintain appropriate safeguards and we remain accountable for personal information that we transfer to them for processing.

8. Consent

Under PIPEDA, we collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise.

• By providing information and using the Services, you consent to the practices described in this Policy.
• The form of consent may vary with the sensitivity of the information and may be express or implied.
• For certain features we obtain express consent in the product itself: for example, before your data is shared with a third-party AI provider for the first time in the App (see Section 5.4).
• You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide some or all of the Services. To withdraw consent, use the relevant in-app setting or contact our Privacy Officer (Section 18).

9. Data retention

We retain personal information only as long as necessary for the purposes described in this Policy, including providing the Services, meeting our legal, tax, and accounting obligations, resolving disputes, and enforcing our agreements. When information is no longer required, we take reasonable steps to securely delete or de-identify it.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls and row-level security on our database, authenticated access, and restricted internal access on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

If we become aware of a breach of security safeguards involving your personal information that poses a real risk of significant harm, we will notify you and the appropriate authorities as required by law.

11. Your privacy rights

Subject to applicable law, you may:

• Access the personal information we hold about you and request information about how it has been used and disclosed;
• Correct inaccurate or incomplete information;
• Withdraw consent as described in Section 8; and
• Make a complaint about our handling of your personal information.

To exercise these rights, contact our Privacy Officer (Section 18). We may need to verify your identity before responding. We will respond within the timelines required by applicable law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

12. Electronic communications (CASL)

We send commercial electronic messages only in compliance with CASL. This means we send marketing messages where we have your consent or another lawful basis, we identify ourselves, and we include a working unsubscribe mechanism in every commercial message. You can unsubscribe at any time using the link in the message or by contacting us. Even if you opt out of marketing, we may still send you non-marketing transactional and service-related messages (for example, booking confirmations, billing notices, and security alerts).

13. Cookies and similar technologies (web)

On our websites we use only cookies and similar technologies that are strictly necessary for the site to function and to keep it secure. We do not currently set analytics, advertising, or conversion-measurement cookies on this website.

If that changes, we will ask for your consent before setting any non-essential cookie and provide controls for managing it. You can also block or delete cookies through your browser settings, though disabling some cookies may affect how the Services function. This section applies to our websites; the App does not use browser cookies, though it does collect the mobile information described in Section 3.3.

14. Children's privacy

The Services are intended for professionals and are not directed to individuals under the age of majority in their province (18 in Ontario). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

15. Accessibility (AODA)

We are committed to providing our Services in a way that respects the dignity and independence of people with disabilities, consistent with the Accessibility for Ontarians with Disabilities Act. If you require this Privacy Policy or any part of the Services in an accessible format, or if you encounter an accessibility barrier, please contact us using the details in Section 18 and we will work with you to provide the information in a suitable format.

16. Third-party links and services

The Services may contain links to third-party websites, products, or services that we do not operate or control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party you interact with.

17. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice through the Services or by email. Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy.

18. Contact us

If you have questions, requests, or complaints about this Policy or our handling of personal information, contact our Privacy Officer. We will respond to your enquiry within a reasonable time and in accordance with applicable law.

Capresta Corporation is a federally incorporated Canadian corporation (CBCA) registered extra-provincially in Ontario.