Privacy Policy

TL;DR

• We're Precon Finder, a tool brokerages and agents use to track pre-construction condo deals from first inquiry through signing and deposits.
• We collect what's needed to do the deal — your contact info, and (only when a builder requires it) ID and tax info for the worksheet.
• We don't sell your data, we don't show ads, and we don't track you across other websites. We don't use your data to train AI models.
• Our servers are in the United States (Google, Vercel, Stripe, Loops). Your data leaves Canada and U.S. law applies to it.
• Want your data, or want it deleted? Email hello@preconfinder.com with the subject "Data request" and we'll reply within 30 days.

1. Who We Are

Precon Finder ("we," "us," "our") runs the platform at preconfinder.com. Our software helps Greater Toronto Area brokerages and agents manage pre-construction condo deals — from first project inquiry, through the builder's worksheet, unit allocation, signing the Agreement of Purchase and Sale (APS), and tracking deposit payments.

Two kinds of people use Precon Finder:

• Agents and brokerages — our paying customers. You sign in to manage clients and deals.
• Homebuyers (clients) — usually invited by your agent through a client portal link, though you can also sign in directly.

Where the answer is different depending on which one you are, we say so.

Precon Finder is operated from Ontario. This policy is written to meet our obligations under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable Ontario law.

2. Who's the "Data Controller" for Your Information

Privacy law cares about who decides what happens with your data. For Precon Finder it depends on who you are:

• If you're an agent, brokerage admin, demo lead, or a client who signed up directly, Precon Finder is the controller of your information.
• If you're a client who reached us through a portal link from your agent, your brokerage is the controller of the deal-related information they store about you, and Precon Finder is the processor (the software they're using). For requests about your deal data, start with your agent or brokerage. We'll help them respond, and you can also contact us if you can't reach them.

3. What We Collect

Account information (agents, brokerage admins, clients who sign up directly)

Name, email, profile photo (via Google Sign-In or email/password), optional avatar, phone. Brokerage assignment, role, and subscription tier. A Stripe customer ID if you're on a paid plan. A log of your activity in the platform.

Sign-in is handled by Firebase Authentication. We never see your Google password. If you use email/password, Firebase stores a salted hash — we never see the plaintext.

Demo and sales leads (/demo, /contact-sales)

Name, email, optional phone, company or brokerage, role, preferred demo time, your message.

Client data (entered by an agent or submitted via a portal)

Name, email, phone, optional bio. Which projects you're interested in. Worksheet submissions, allocation details (unit, floor, price, parking, locker), deposit milestones, payment records, agent notes.

Sensitive identity data — only for advanced worksheets

Once a builder requires an advanced worksheet, we collect:

• Social Insurance Number (SIN) — required by builders and their lawyers for the APS and for FINTRAC anti-money-laundering reporting.
• Occupation and employer/company name — also required by the builder.
• A photo of your driver's licence (or other government-issued ID) — builders require ID verification before accepting a worksheet.

Who sees it inside Precon Finder: you, your agent, brokerage staff working on your deal, and a small number of Precon Finder administrators with a legitimate operational reason.

Who we share it with: the specific builder the worksheet is being submitted to. We don't use it for analytics, we don't share it with marketers, we don't share it with any other party.

If you'd rather not provide this through Precon Finder, ask your agent to submit it to the builder outside the platform.

Collected automatically

IP address (in security logs), browser and device information, page views and performance metrics (Vercel Analytics — first-party, cookie-less, no cross-site tracking, no advertising IDs), and audit logs of who viewed or changed what.

4. What We Don't Do

Because people assume the worst:

• We don't sell your personal information. Not to data brokers, not to marketers, not to builders beyond what your specific deal requires.
• We don't run ads on the site and we don't share data with ad networks.
• We don't track you across other websites. No Facebook Pixel, no Google Ads tags, no third-party trackers.
• We don't use your data to train AI models.

5. How We Use Your Information

• Run the platform — accounts, deal pipeline, worksheets, allocations, deposit tracking.
• Submit worksheets and supporting documents to builders on behalf of brokerages and their clients.
• Process subscription payments through Stripe.
• Send the emails you'd expect: account events, deal events, allocation notifications, password resets, demo follow-ups.
• Send product announcements where you've consented (every marketing email has an unsubscribe link).
• Maintain audit logs for security, compliance, and dispute resolution.
• Detect and prevent unauthorized access and abuse.
• Analyze aggregate usage to improve the product.

For transactional emails (account and deal events) we rely on CASL's transactional exemption — these cannot be turned off without closing your account. For commercial/marketing email we rely on your express consent and honour unsubscribes within 10 business days.

6. Subprocessors

We rely on these services to operate the platform. They're each bound by data processing agreements:

| Service | Purpose | Location | Data | |---|---|---|---| | Google Firebase (Auth, Firestore, Cloud Storage) | Authentication, primary database, file storage (including driver's licence uploads) | United States | All account, client, deal, and sensitive identity data | | Loops | Transactional and product email | United States | Name, email, deal-event context for the email | | Vercel | Hosting and first-party web analytics | United States | IP address, page views, performance metrics | | Stripe | Subscription billing | United States | Name, email, payment method (handled entirely by Stripe — we never see card numbers) |

We don't use any other subprocessors. If that changes, we'll update this list.

7. Cross-Border Transfer

All four subprocessors above store and process data in the United States. That means your data leaves Canada. Under U.S. law, U.S. authorities (courts, law enforcement, national-security agencies under the CLOUD Act, FISA, and similar instruments) can compel these companies to hand over data, in some cases without notifying us or you. This is true of essentially every major cloud service — but you should know it's true of us too.

If this isn't acceptable for your use case, please don't submit personal data and contact us to discuss alternatives.

8. Cookies

We use only first-party cookies, in two categories:

• Session — keeps you signed in. HTTP-only, secure, 5-day expiry.
• Access control & feature gating — stores your role and subscription tier so we can route you to the right screens and unlock the features included in your plan.

We don't use advertising cookies, cross-site tracking cookies, or analytics cookies that identify you personally. Vercel Analytics is cookie-less.

Clearing these cookies in your browser will sign you out.

9. Security

What we actually do:

• HTTPS / TLS for all traffic between your browser, our servers, and our subprocessors.
• Encryption at rest on Firebase and Vercel infrastructure.
• Role-based access control enforced server-side and through Firebase Security Rules. Each brokerage's data is scoped — other brokerages can't read or write it.
• Audit logging of sensitive reads and writes (allocations, payments, document downloads).
• Least privilege for Precon Finder staff. Administrative actions are logged.

No system is perfectly secure. If we discover a breach affecting your personal information, we'll notify affected users and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA's mandatory breach-reporting requirements.

10. How Long We Keep Things

| Data | Retention | |---|---| | Active account data | Lifetime of the account + 30 days after a deletion request | | Deal records, worksheets, sensitive ID (SIN, driver's licence) | 7 years after the deal closes or is cancelled — this matches FINTRAC and Ontario brokerage record-keeping obligations | | Demo / contact-sales leads (not converted) | 24 months from last contact, then deleted | | Session cookies | 5 days | | IP request logs | 90 days | | Vercel Analytics | 30 days at row level, then aggregated | | Audit logs (security and compliance) | Retained for as long as the brokerage's compliance obligations require |

If you ask us to delete your data and we're not legally required to keep it, we'll do so within 30 days. We'll tell you if we can't delete something and why.

11. Your Rights

Under PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Correct information that's inaccurate or incomplete.
• Delete your information, subject to legal retention obligations (e.g. the 7-year FINTRAC retention on closed deals).
• Withdraw consent, including for marketing email, at any time.
• Port your data in a machine-readable format where applicable.
• Challenge our compliance with this policy or with PIPEDA.

How to submit a request

Email hello@preconfinder.com with the subject line "Data request" and tell us what you'd like. Include the email associated with your account. We may ask you to confirm the request from the email on file, or provide additional identity verification proportionate to the sensitivity of the request.

We'll acknowledge within 5 business days and substantively respond within 30 days. If we need more time, we'll tell you why.

Client portal users: as noted in Section 2, your brokerage is the controller for your deal data. We'll either route your request to them or fulfill it on their instruction. If you can't reach your brokerage, contact us and we'll help.

If you're not satisfied with our response, you can file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. Ontario real estate registrants are also subject to oversight by the Real Estate Council of Ontario (RECO) for matters relating to brokerage conduct.

12. Children

Precon Finder is intended for adult real estate professionals and adult buyers. We don't knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us and we'll delete it.

13. Changes to This Policy

If we make a meaningful change — a new subprocessor, a new category of data, anything that affects your rights — we'll email registered users and update the effective date at the top. Small clarifications and typo fixes won't get an email.

14. Contact Us

Questions, complaints, or data requests: hello@preconfinder.com (subject "Data request" for privacy matters).

We're a small team. A real person will read your email.