HousesGate Privacy Policy and Cookie Disclosures

1. Who we are

1.1 HousesGate is the website and business name of Nabeel Irtaza Tunio, registered professionally as Ali Tunio (the Operator). The Operator is an individual who operates the website personally, and is accountable for the personal information the website handles. Ali Tunio is the privacy contact for the website.

1.2 This Policy explains what personal information the website collects, why, how it is shared, how long it is kept, how it is protected, and what you can ask for. It applies to the website, including the password-protected listing feature (the VOW). The VOW Access Agreement and Website Terms of Use govern their own subjects.

1.3 We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA), and we follow Canada's anti-spam law (CASL) for commercial electronic messages, along with applicable Ontario law. This Policy does not limit any right you have under those laws.

1.4 This version applies from the date it is published on the website and, where acceptance is required, when you accept it. Version: v6, October 5 2026.

2. What we collect

2.1 We collect only what we need for the purposes in section 3:

(a) Registration: your name and email address when you create an Account, and a username and password you set for it;

(b) Optional telephone number: only if you ask for a service that needs one, such as requested brokerage assistance, and only if you choose to give it;

(c) Your activity: saved searches, properties you view, showing and appointment requests, and inquiries or messages you send, including your property choices, preferences, and proposed transaction terms where you submit them;

(d) Technical records: browser type, IP address, and server logs about how the website is accessed;

(e) Consent records: what you agreed to, when, and how, including your acceptance of documents and your marketing choices;

(f) Cookie data: as described in section 11.

2.2 Please do not send us sensitive information the website does not need, such as government identity numbers, payment card numbers, or health or financial records. We do not ask for them to operate the website.

3. Why we collect it

3.1 We collect, use, and share personal information to: create and secure your Account and verify your email; provide the website features you use, including the VOW and saved searches; confirm eligibility for the VOW; send service messages needed to deliver what you asked for; connect you with real estate services when you ask; keep the website secure and prevent misuse; keep records the VOW rules and the law require; respond to your requests and complaints; and improve the website using aggregated information that does not identify you.

3.2 If we want to use personal information for a new purpose, we identify the purpose and get your consent first, unless the law says we may proceed without it.

4. Consent

4.1 Consent is purpose-specific and is given through an informed choice at the point it is needed, such as when you register, when you accept the VOW Access Agreement, or when you opt in to an optional feature. Accepting account terms on its own is not consent to every kind of processing. Each consent covers only the purposes in section 3 that the step it accompanies actually needs. It is not consent to marketing, and it is not blanket consent to any collection.

4.2 You may withdraw consent, subject to legal and contractual restrictions and reasonable notice. We explain the consequences: if you withdraw consent needed for a feature, we may no longer be able to provide that feature. Withdrawing consent does not erase records the law or VOW rules require us to keep.

5. Marketing messages

5.1 We send marketing messages only if you separately agree, by an affirmative opt-in that is not pre-checked and is not part of accepting any document or creating an Account. Marketing consent is optional and refusing it does not limit your access.

5.2 Every marketing message identifies who sends it, how to reach us, and how to unsubscribe. We honour an unsubscribe without delay, and no later than 10 business days, at no cost to you.

5.3 Messages needed to deliver a service you requested, such as a verification email or a reply to your inquiry, are handled according to their content under CASL. We do not treat every such message as automatically exempt.

6. Sharing

6.1 We do not sell your personal information, and we do not give it to unidentified third parties for their own marketing.

6.2 We share personal information only:

(a) with HomeLife Landmark Realty Inc., Brokerage, through which Ali Tunio, Broker, provides regulated real estate services, when you request those services. If another agent, whether at the same or another brokerage, is proposed to assist or receive your request, we identify that agent and brokerage, explain what information will be shared and why, and obtain your informed permission before sharing it. We share only the information reasonably needed for that request. Permission for an introduction is not permission for unrelated marketing or a sale of your contact details. The recipient must protect the information and comply with applicable privacy and marketing law;

(b) with PropTx, for auditing and legal purposes connected to the VOW, as the VOW rules require and as the VOW Access Agreement discloses;

(c) with service providers that process it for us under contract, in these categories: account and database services (Supabase), which store your account information and send the account verification email; website hosting (Vercel); and traffic delivery and security (Cloudflare). Other services are described by category rather than by provider: maps are delivered through map infrastructure, messages you ask for go through message-delivery services, and optional analytics exists to understand and improve the website. Optional analytics and session replay run only with your consent under section 11. We do not claim that personal information stays in Canada;

(d) where the law requires or permits it, for example to comply with a lawful request, enforce our documents, or protect someone's safety; or

(e) with anyone else, only with your consent or at your direction.

6.3 HousesGate is currently operated personally by Ali Tunio. Investor interest or a proposed corporate transfer does not by itself change the Operator or permit general disclosure of your information to investors. If the website or business is ever sold or transferred, we limit what is shared to what the transaction needs, restrict its use to the transaction, require protection of the information, and return or destroy it if the transaction does not proceed. If it completes, your information stays subject to this Policy or a matching one, your existing choices continue, you may withdraw consent as before, and we notify you within a reasonable time. This paragraph does not permit a transaction whose main purpose is buying or selling personal information.

7. Where information is processed

7.1 Service providers may process personal information outside Canada. Personal information may be processed in the United States: the database and authentication services the website uses are configured to a United States region. Other providers' storage, backup, and subprocessor locations can differ, so we do not claim that personal information is kept only in Canada or make any broader residency claim. Information processed abroad may be accessed by the authorities of those jurisdictions under their laws. You may ask us which service providers we use.

7.2 Foreign privacy laws do not displace PIPEDA for this website, and we do not claim that no foreign law ever applies to any visitor. Where another law validly applies to a specific situation, we comply with our obligations under both.

8. How long we keep it

8.1 We keep personal information only as long as needed for the purposes in section 3, and as required by law and VOW rules, then securely destroy, erase, or anonymize it.

8.2 Fixed minimums we follow: VOW registration records and audit trails, at least 180 days after the password to which they relate expires, as the VOW rules require; records of every breach of security safeguards, at least 24 months starting on the day we determine the breach occurred; consent records, while relied on and as needed to demonstrate compliance. Records held by or for the Brokerage for brokerage transactions, and records held under board rules, follow the rules that apply to them. Under section 19 of Ontario Regulation 579/05, made under the Trust in Real Estate Services Act, 2002, documents and records a brokerage is required to keep under that Act and its regulations must generally be kept for the period the registrar specifies or, if none is specified, at least six years. Unsuccessful written offers received for a seller are treated separately by section 20 of that regulation, generally for at least one year from receipt on the terms it sets out. Those are record rules for brokerage records; they do not set a six-year minimum for all website data.

8.3 We do not promise any deletion schedule beyond what this section says.

9. Your access and correction rights

9.1 On written request, we tell you what personal information we hold about you, how it is used, and to whom it has been disclosed, and give you access, subject to limited exceptions under PIPEDA.

9.2 We respond no later than 30 days after the day we receive your request. If meeting that time would unreasonably interfere with our activities, or the consultations needed to answer you are impracticable within it, we may extend once by up to 30 more days. If you ask for the information in an alternative format, we may take the time the conversion actually needs. Any extension notice goes to you within the original 30 days and states the new deadline, the reasons, and your right to complain to the Privacy Commissioner of Canada. We give access at no cost, or at the minimal cost PIPEDA permits. Any charge is limited to that minimal cost. We tell you the approximate cost in advance and act only if you confirm you are not withdrawing the request. If we do not respond in time, the request is deemed refused and you may complain.

9.3 If you show information is inaccurate or incomplete, we correct it and, where appropriate, tell the recipients we shared it with. If we do not agree, we record your disagreement and, where appropriate, share that note with recipients.

9.4 We verify identity before acting on a request, use verification information only for that purpose, and help you if you need assistance making a request. While your recourse is open, we keep the records you asked about.

9.5 Requests and complaints go to the contact in section 13. You may also complain directly to the Office of the Privacy Commissioner of Canada at any time. You do not need to finish our process first.

10. Protection and breaches

10.1 We protect personal information with safeguards appropriate to its sensitivity: access controls, encryption in transit, contractual duties on service providers, and limits on who can reach the data. No system is perfectly secure, and we do not claim certifications we have not obtained.

10.2 If a breach of security safeguards occurs, we assess whether it creates a real risk of significant harm to any individual. If it does, we report it to the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, with the information needed to understand and reduce the harm, and we notify other organizations that can help reduce the harm. We keep a record of every breach of security safeguards, reportable or not, for at least 24 months starting on the day we determine the breach occurred.

11. Cookies and similar technologies

11.1 Cookies are small files a website stores in your browser. Local storage works similarly. The website uses them to keep you signed in, keep sessions secure, and remember your preferences.

11.2 Technologies needed to deliver a service you asked for, such as keeping your session working, are used because of that purpose and your reasonable expectations. We do not treat every technology labelled essential as exempt from consent; the purpose and expectations shape what consent is needed for each one.

11.3 Analytics technologies are optional and run only with your consent, given before they are activated. Where the website offers an on-site choice control for them, you can accept or refuse there and change your mind at any time. You can always refuse or withdraw consent by contacting [email protected] (section 13), and we stop the optional analytics concerned. Refusing analytics does not limit your access. Where an analytics tool can record session replays, it runs only with your consent, and any replay recording is masked before it is stored or used. If we cannot meet that standard, we disable session replay rather than publish it.

11.4 Your browser can also block or delete cookies. Blocking strictly necessary technologies may break sign-in and other features.

11.5 The necessary cookie and local-storage technologies the website uses in your browser today are first-party account, security, and preference storage: they keep you signed in, keep your session secure, and remember your preferences. We do not claim that every service described in section 6.2(c) sets browser storage. If optional analytics is enabled with your consent, its cookies and local storage are used only for the analytics purposes in section 11.3. The full current inventory of these technologies, their providers, and their purposes is available on request through the contact in section 13.

11.6 Marketing emails are governed by CASL consent under section 5, which is separate from any cookie choice.

12. Children and other websites

12.1 Accounts are for people 18 or older. We do not knowingly collect personal information from anyone under that age. Tell us if you believe a child gave us personal information and we will delete it, subject to records we must keep.

12.2 The website may link to other websites we do not control. Their practices are their own.

13. Contact

13.1 The privacy contact is Ali Tunio. Questions, requests, and complaints about privacy go to [email protected]. Please do not include sensitive information the website does not need in your message.

13.2 Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, 1-800-282-1376, www.priv.gc.ca.

14. Changes

14.1 We post changes here and update the version date. For a new purpose or a new sharing of personal information, we notify you and get consent where PIPEDA requires it before the change takes effect. If a change materially affects the VOW Access Agreement, fresh acceptance is required before further VOW access.