Privacy Policy

1. Introduction & Regulatory Framework

Dealster is a real estate transaction management, document conveyance, and regulatory audit platform built specifically for licensed real estate professionals. Our data handling practices are governed by the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy statutes, the Trust in Real Estate Services Act (TRESA / former REBBA), and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

2. Roles: Data Controller vs. Data Processor

The Brokerage as Data Controller: The subscribing Real Estate Brokerage and its designated Broker of Record act as the Data Controller (or Organization having control under PIPEDA) with respect to all buyer, seller, landlord, and tenant personal information uploaded to or processed through the Platform. The Brokerage determines the lawful purpose for collecting consumer personal information and obtains all required client consents.

Dealster as Data Processor: Dealster acts strictly as a Data Processor (or Service Provider). We process transaction records, client data, and uploaded contracts solely on documented instructions from the Brokerage to deliver platform services and maintain statutory compliance archives. Dealster does not sell, market, or commercialize consumer personal data.

3. Categories of Real Estate Data Collected

To facilitate real estate conveyance, contract preparation, and statutory audit logging, Dealster processes:

• Real Estate Professional Credentials: Full legal name, real estate licensing board number (e.g., RECO / provincial council ID), brokerage affiliation, office role, professional email, phone number, and billing credentials.
• Consumer Transaction & Client PII: Names, residential addresses, contact information, marital status (for matrimonial home consent verification), and corporate authority records of buyers and sellers provided in trade files.
• Contracts & Real Estate Forms: Standard board agreements (such as OREA Form 100 Agreements of Purchase and Sale, Form 635 Trust Deposit Receipts), proprietary agency AcroForms, counter-offers, amendments, and subject waiver documents.
• Financial & Trust Account Records: Earnest money deposit figures, trust account confirmations, deposit due dates, commission split percentages, co-operating broker disbursements, and trade record sheets.
• FINTRAC & Identity Verification Records: Government photo ID document metadata, Individual Identification Information Records (IIIR), corporate beneficial ownership registries, and Politically Exposed Person (PEP) screening records.
• System Audit Logs: Access timestamps, electronic signature certificate logs, IP addresses, and document revision histories.

4. Statutory Purposes for Data Processing

Dealster processes real estate information solely for legitimate operational and compliance purposes, including:

• Facilitating the preparation, assembly, redaction, and electronic execution of real estate purchase and sale contracts;
• Tracking statutory deposit receipt deadlines and conditional period milestones;
• Enabling supervisory review and transaction sign-off by the Broker of Record;
• Maintaining immutable transaction audit trails required under real estate licensing legislation.

5. FINTRAC & Anti-Money Laundering (AML) Compliance

Under the Canadian PCMLTFA, real estate brokerages and sales representatives are subject to mandatory Know-Your-Client (KYC) identification and record-keeping rules.

All FINTRAC identification records compiled in Dealster (including Individual Verification, Entity Identification, Beneficial Ownership, Third Party Determination, and PEP evaluations) are stored in encrypted, tenant-isolated data partitions accessible only by authorized brokerage personnel. Pursuant to PCMLTFA regulations and provincial real estate guidelines, these records are preserved for a mandatory minimum of seven (7) years.

6. In-Browser PDF Suite & E-Signature Privacy

Dealster incorporates client-side PDF document manipulation tools designed to prevent data leakage:

• PDF Redaction: Redacted areas (such as social insurance numbers, banking account details, or confidential transaction terms) are permanently erased through client-side rasterization. Dealster does not retain unredacted underlying text or metadata in redacted output files.
• Electronic Signatures: Digital signature stamping adheres to the Ontario Electronic Commerce Act, 2000 and the US ESIGN Act. Signing events record cryptographic checksums, signer IP addresses, and exact timestamps permanently attached to the document audit certificate.
• Smart Page Assembly: Merging, splitting, and reordering of contract schedules occur in isolated sandbox memory, and temporary cache fragments are purged upon vault synchronization.

7. Artificial Intelligence (AI) & LLM Data Protection

Dealster provides optional AI-assisted features for contract summarization, OCR, and AcroForm auto-population. We enforce strict data protection policies regarding artificial intelligence:

• No Model Training: Neither Dealster nor our upstream AI providers use your brokerage transaction documents, client files, or private prompts to train or fine-tune public foundation models.
• Bring Your Own Key (BYOK): Brokerages may configure private API keys (e.g., OpenAI, Anthropic, Gemini, Groq) within the Admin panel, ensuring all AI requests execute under your direct enterprise agreements.
• Ephemeral Processing: AI document processing operates over encrypted connections with zero data retention (ZDR) on third-party inference endpoints.

8. Calendar Sync & Notification Logging

When you connect external calendar services (such as Google Calendar, CalDAV, or iCal), Dealster accesses your calendar solely to publish and update transaction milestones (such as deposit deadlines, inspection dates, and closing dates). Dealster does not read or retain unrelated personal calendar events.

9. Sub-Processors & Cloud Infrastructure

Dealster engages established enterprise cloud infrastructure providers for database hosting, secure document storage, and transactional notifications. All sub-processors maintain SOC 2 Type II or ISO 27001 certifications and are bound by Data Processing Addenda (DPAs) requiring stringent data security controls.

10. Data Security & Tenant Isolation

All data in transit is protected using Transport Layer Security (TLS 1.3). All persistent database records, trade worksheets, and document vault storage are encrypted at rest using AES-256. Multi-tenant database partitioning ensures that records belonging to one brokerage are strictly inaccessible to any other firm or user.

11. Mandatory 7-Year Real Estate Record Retention

Under the Trust in Real Estate Services Act, 2020 (TRESA), RECO guidelines, and FINTRAC regulations, real estate brokerages are required by law to maintain complete transaction files, client representation agreements, unaccepted offers, and trust accounting records for a minimum of seven (7) years from the date of closing, termination, or deal collapse.

Dealster maintains your transaction vault records and audit logs for the duration of your active subscription and the mandatory 7-year regulatory period.

12. Individual Privacy Rights & Statutory Exceptions

Under applicable privacy laws, consumers have rights of access and correction regarding their personal information. Inquiries must be directed to the Broker of Record of the brokerage handling their transaction. Requests for deletion cannot override mandatory statutory retention periods imposed on real estate brokerages by law.

13. Contact & Privacy Officer

For questions regarding this Privacy Policy, data protection practices, or compliance inquiries, please contact: