Privacy Policy

This policy describes how Kourtia (the "organization") collects, uses, discloses and protects the personal information processed in its customer relationship management software for real estate brokers (the "service").

In accordance with Quebec's Act respecting the protection of personal information in the private sector ("Law 25"), the organization has appointed a privacy officer. You may contact the officer for any question, request or complaint at confidentialite@kourtia.ca.

The service processes three categories of information.

• Broker users. Name, email address, phone number, sign in credentials (password stored as an encrypted value), preferences and service usage logs.
• Contacts and clients entered in the service. Name, contact details (phone, email), property address, communication history (calls, text messages, emails), notes, appointments and follow up stages recorded by the broker.
• Data from connected services. When the broker connects an external account, the service may receive reviews posted on their Google Business Profile, appointments booked online, and inquiries or leads from advertising platforms or forms.

We use this information only for the following purposes.

• Provide and operate the service (contact management, calendar, communications, deal tracking).
• Allow the broker to communicate with their contacts by phone, text message and email.
• Display and consolidate reviews, bookings and leads from the services the broker has connected.
• Ensure security, prevent fraud and meet our legal obligations.

We never sell personal information and we do not use it for third party targeted advertising.

Processing is based on the consent of the individual and on the broker's legitimate interest in managing their business relationship. Consent is obtained when the person provides their information (for example by completing a form, booking an appointment, or giving verbal agreement recorded by the broker).

An individual may withdraw consent at any time, at no cost, by writing to the officer at confidentialite@kourtia.ca. Withdrawal may limit the broker's ability to communicate with them. For text messages, replying with the word STOP withdraws consent immediately.

We do not disclose personal information to third parties for commercial purposes. We rely on providers that act as processors (they process data on our behalf, under our instructions and confidentiality commitments). The categories and providers are as follows.

• Cloud hosting. Vercel (deployment and execution of the service).
• Database. Turso (storage of service data).
• Google. Google Calendar and Gmail (calendar sync and email sending from the connected account), Google Business Profile (reading reviews), Google Maps (map display). See the Google data section below.
• Online booking. Calendly (clients booking appointments, with automatic creation of a contact and an appointment).
• Social platforms. Meta (Facebook, Instagram), when the broker connects a page or account, to receive messages or leads.
• Telephony. Twilio (sending and receiving text messages and calls).
• AI call transcription and summary. OpenAI and Deepgram (transcribing call audio and producing a summary, at the broker's request).

Each provider receives only the data needed for its function. We may also disclose information where required by law.

The service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

In practice, when the broker connects a Google account:

• we access Google data (for example Business Profile reviews, calendar events and email sending) only to provide the features requested by the broker;
• we do not use this data for advertising and we do not sell it to anyone;
• we transfer this data to third parties only to provide or improve those features, when required by law, or as part of a transaction with the user's consent;
• no human reads this data, except with the user's express consent, for security purposes, to comply with the law, or when the data is aggregated and anonymized;
• Google access tokens are stored in encrypted form and are never exposed to other users.

Our hosting and infrastructure providers may process and store information on servers located outside Quebec, in particular in the United States. Before disclosing information outside Quebec, the organization conducts a privacy impact assessment in accordance with Law 25 and puts contractual and technical measures in place to ensure adequate protection, comparable to that provided in Quebec.

We apply reasonable measures to protect information.

• Encryption of sensitive secrets at rest (access tokens, integration keys) and secure transmission (HTTPS).
• Access control through authentication and a password stored as an encrypted value.
• Per user isolation of connections and credentials (one user's data is never accessible to another).
• Signature verification of incoming communications from connected services.

We retain information for as long as the broker's account is active and it remains necessary for the purposes described, or to meet our legal and accounting obligations. When information is no longer needed, it is securely destroyed or anonymized. A broker may request deletion of their account and associated data by writing to confidentialite@kourtia.ca.

You have the following rights over your personal information.

• Access. Obtain a copy of the information we hold about you.
• Correction. Have inaccurate, incomplete or ambiguous information corrected.
• Withdrawal of consent. Withdraw your consent to processing, subject to legal obligations.
• Deletion and de indexing. Request deletion of your information or that its dissemination cease, in the cases provided by law.
• Portability. Receive, in a structured and commonly used technological format, the computerized information you provided to us.
• Automated decision. Be informed when a decision based exclusively on automated processing concerns you, and submit your observations.

To exercise a right, write to the officer at confidentialite@kourtia.ca. We respond within the timelines set by law. You may also file a complaint with the Commission d'acces a l'information du Quebec.

The service uses only cookies strictly necessary for its operation, in particular an authentication cookie to maintain your session. Public pages may, where applicable, include an advertising or analytics pixel. In that case, a prior consent mechanism is presented and you may decline it without being prevented from accessing the page. We do not use tracking cookies for profiling without your consent.

In the event of a confidentiality incident presenting a risk of serious injury, the organization takes reasonable measures to reduce the consequences, keeps a register of incidents, and promptly notifies the Commission d'acces a l'information and the individuals concerned, in accordance with Law 25.

We may update this policy to reflect changes to the service or to our obligations. The current version is always published on this page, with its last updated date. We encourage you to review it periodically. For any question, write to confidentialite@kourtia.ca.