Legal

Privacy Policy

This Privacy Policy describes how PropID ("we", "us", or "our") collects, uses, and shares information when you use our GPS-verified property documentation platform ("Service"). Most people use PropID because a lender or other organization asked them to document a property. That organization requests the report and is the one that receives it. By using the Service, you agree to the collection and use of information as described in this policy.

1. Information we collect

When you use PropID we collect:

• Identity information — your name and email address, and your phone number if you give it
• Property information — address, property type, bedrooms, bathrooms, square footage, year built, mechanical systems, and any notes you provide
• GPS coordinates — your device's location while you document the property, used to verify that you are at the property
• Photographs — photos of each room, with the address, GPS coordinates and time stamped into the image
• Activity in the app — each step you take with your invite link: opening the link, whether location and camera permission were allowed or blocked, photos taken or deleted, rooms marked as not accessible, upload errors, submission, and how long the page was active. Each step is recorded with your browser's user agent (a short description of your browser and device).
• Security logs — your IP address, user agent, and the page or service requested, when a request looks like a security problem (for example, an invalid invite link, a failed sign-in, or too many requests)
• Rate-limit counters — temporary counters tied to your IP address, used to block abuse. They expire on their own within an hour.
• Messages — what you send us through the request-access and contact forms

Stored on your own device

While you document the property, your photos and progress (the details you have entered and the step you are on) are kept in your browser's storage on your own device, so nothing is lost if the browser closes. They are sent to us only when you submit. They are cleared from the device after you submit. If you don't submit, they are cleared after 8 days, the next time the PropID page is opened in that browser. You can also remove them at any time by clearing this site's data in your browser settings. Until then, anyone who can use that browser could see them.

We also remember your light or dark theme choice in your browser. We do not use advertising or analytics cookies.

2. How we use your information

We use the information we collect to:

• Prepare your GPS-verified property documentation report for the lender or organization that requested it
• Verify that documentation was completed at the stated property location
• Review the submitted photos and property details for condition, using AI (see Section 5)
• Add sold comparables to a lending report, when the lender requests them
• Help if something goes wrong, for example to see where an upload failed or a permission was blocked
• Communicate with you about your invite or report status — by email, or by text message (SMS) when the organization that requested your report provides your mobile number and chooses text delivery. Message and data rates may apply; reply STOP to opt out of texts.
• Keep the Service secure and prevent abuse
• Comply with legal obligations

PropID reports are documentation only and are not an appraisal, inspection or valuation.

We do not use your information to train AI models. AI is used only to review the report you submit. We will never use your personally identifiable information for advertising purposes.

3. GPS data collection

GPS location data is a core part of how PropID works. While you document the property, we read your device's location to confirm that you are at the property, and we stamp it, with the time, onto each photo. Location is read only while the PropID page is open during your documentation session. We use it only to verify the documentation.

If you decline to share your location, the report will show that your location could not be verified, and the organization that requested it may not accept it. Some invites require location before you can submit.

4. Photo usage rights

By submitting photographs through PropID, you grant us a non-exclusive, royalty-free licence to store, process, and share those photographs as part of your property report. Photos are shared with:

• The lender or organization that requested the report, and anyone it directs us to send the report to
• PropID staff, for quality review

We do not sell your photographs to third parties or use them for marketing without your explicit written consent.

5. Who receives your information

We do not sell your personal information. We share it only with:

• The lender or organization that requested the report — it receives the finished report, including your details, photos, GPS verification and condition review, and any sold comparables it requested. We send copies to anyone else only at its direction.
• Service providers that run parts of PropID for us. Each receives only what it needs for its service:
  • Supabase — database and file storage
  • Vercel — website and server hosting
  • Anthropic — AI review of submitted photos and property details. This processing takes place in the United States.
  • Resend — sending email
  • Twilio — sending text messages (SMS), when your invite link is delivered by text
  • Upstash — temporary rate-limit counters tied to IP addresses
  • OpenStreetMap Nominatim — address lookup from your GPS position or from the address you type. Your browser contacts this service directly.
  • Google Fonts and cdnjs — fonts and scripts loaded by our pages. As with any website, they receive your IP address and browser details when your browser downloads these files.
  • An operational alerting service — receives error and security notifications, which can include an IP address or a report ID
• Legal authorities — if required by law or valid legal process

Where your data is stored and processed

Your reports, photos and account details are stored in our Supabase database and photo storage, which are hosted in the United States (East US, Ohio). Our website and servers run on Vercel, and the AI review of submitted photos runs on Anthropic, both also in the United States. Data is encrypted in transit (TLS) and at rest, and each provider processes it under contractual safeguards that limit how it may use your information.

Because data is stored and processed outside Canada, it is subject to the laws of the United States and may be accessible to its courts, law enforcement and national security authorities. We remain responsible for your information under PIPEDA when a service provider processes it for us. Canadian clients that need their data kept in Canada can contact us to discuss it.

6. Data retention

• Reports and photos — kept as required by the record-keeping obligations of the lender or organization that requested the report, and deleted on its instruction
• Activity in the app — deleted after 180 days
• Security logs — deleted after 90 days
• Invites that were never used — deleted 90 days after they expire
• Records of emails we sent (recipient, email type and delivery status) — deleted after one year
• Rate-limit counters — expire on their own within an hour
• Photos and progress on your device — see "Stored on your own device" in Section 1
• Messages sent through our forms — kept as long as needed to respond to you

You can ask about deleting your information at any time (see Section 8). If the organization that requested your report must keep it, we will tell you.

7. Data security

All data is stored on Supabase infrastructure with row-level security enabled. Photos are stored in private buckets accessible only via time-limited signed URLs, and links to download a finished report expire after 30 days. All data is encrypted in transit (TLS) and at rest. Access to the admin dashboard is password-protected.

8. Your rights

You have the right to:

• Request a copy of the personal information we hold about you
• Request correction of inaccurate information
• Ask us to delete your information (subject to the record-keeping obligations in Section 6)
• Withdraw your consent to future processing. If you do this before submitting, your report can't be completed.

To make a request, email info@propid.ca or use our contact form and choose "Data privacy / deletion request". We may need to confirm your identity first. We respond within 30 days.

Canada

PropID handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

United States

If you are in the United States, you may have additional rights under your state's privacy law, including the right to know what personal information we hold, to request its deletion and to not be discriminated against for exercising those rights. We honour these requests through the same contact above. We do not sell personal information.

9. Children's privacy

PropID is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

This Service is operated by PropID. If you have questions about this Privacy Policy, email info@propid.ca or get in touch.