Privacy Policy

1. Who we are

Into the Flavor Inc. ("we", "us", "our", or "CloseFlow") is a corporation incorporated in the Province of Ontario, Canada. We operate the CloseFlow platform (the "Service") at https://closeflow.ca. CloseFlow is a productivity, communication, and marketing platform offered exclusively to licensed Ontario real estate professionals.

This Policy uses three defined terms throughout:

• An Agent is a licensed REALTOR® (or an authorised member of their brokerage) who holds a CloseFlow account and uses the Service.
• A Lead is a prospect, client, or contact whose information an Agent enters into, or communicates with through, the Service.
• The Service is the CloseFlow platform and all associated websites, applications, and features.

For all questions about this Policy or about how your personal information is handled, you may contact us at [email protected] or by mail at the address in Section 15.

2. Information we collect

We collect the following categories of personal information.

Account information (provided by the Agent)

• Name, business email address, telephone number, and real estate licence details.
• Brokerage name, business address, profile photo, biography, and branding (logo, colours).
• Authentication data, including a securely hashed password and, where enabled, two-factor authentication settings.
• Account preferences and settings.

Lead information (entered by the Agent)

• Lead name, email address, telephone number, and mailing or property address.
• Pipeline and relationship data, such as stage, property interests, budget range, notes, and follow-up dates.
• Consent records, including whether the Lead has provided express or implied consent to be contacted, and the source, method, and timestamp of that consent.

Communication content

• The content of email and SMS messages composed and sent through the Service, together with delivery metadata (sender, recipient, timestamp, delivery status, and engagement events such as opens, clicks, and bounces).
• Where calling features are enabled, telephone call metadata (the numbers involved, call time and duration, and outcome), and any call recordings and automated transcriptions of calls placed or received through the Service. When a call connects, an automated announcement notifies the called party that the call may be recorded.

Calendar data (where the Agent connects Google Calendar)

• Appointments and events created through the Service.
• When you connect Google Calendar, CloseFlow requests the Google Calendar calendar.events permission to provide two-way calendar sync. Using this permission, CloseFlow creates, updates, and deletes the appointments you schedule in CloseFlow (such as showings and closings) on your connected Google Calendar, and reads the time ranges of your existing Google Calendar events so it can show busy and free periods and avoid double-booking. We do not read or store the titles, descriptions, locations, or attendee lists of events we did not create; this is a privacy-by-design choice described further in our Data Usage & Retention Policy.
• CloseFlow's use of Google Calendar data is solely to provide and improve these calendar-sync features that you request. We do not use Google Calendar data for advertising, and we do not sell it or transfer it to third parties except the sub-processors that operate the sync on our behalf (see below).

Google API Services User Data Policy (Limited Use)

CloseFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, information obtained through Google Calendar is used only to provide or improve the calendar-sync features you connect it for, is not transferred to others except as necessary to provide those features or as required by law, is not used for advertising, and is not read or used by humans except with your consent, to comply with law, or for security and abuse operations.

Usage and device data

• Log data such as sign-in times, IP address, browser type, device type, and pages or features used.
• Diagnostic and error data used to keep the Service secure and reliable.

Cookies and similar technologies

• Strictly necessary cookies for session management and security (including protection against cross-site request forgery), and limited analytics. See Section 11.

3. How we use information

We use personal information for the following purposes:

• To provide the Service: to operate your account, manage your pipeline, send the communications you initiate, sync your calendar, and deliver the features you use.
• To improve the Service: to understand how features are used, diagnose problems, and develop new functionality.
• To assist with compliance: to record and surface consent status so that Agents can meet their obligations under CASL and other applicable law.
• To communicate with Agents: to send service notices, security alerts, and account-related messages.
• To maintain security: to detect, prevent, and respond to fraud, abuse, and security incidents.
• To meet legal obligations: to comply with applicable laws, regulations, and lawful requests.
• To provide AI support answers: the in-app support assistant answers an Agent's product questions using our documentation and a small set of verified account-status facts (plan, connected integrations, and similar). It does not read Lead, message, or billing records. Conversations with the assistant are logged; see our Data Usage Policy for retention.

We do not sell personal information, and we do not use the content of Lead communications for advertising.

4. Legal basis for processing

Under PIPEDA, we rely primarily on consent as the basis for collecting, using, and disclosing personal information, supported by the principle that collection is limited to what a reasonable person would consider appropriate in the circumstances.

• Agent personal information: an Agent provides consent when creating and using an account, and through their subscription agreement with us.
• Lead personal information: the Agent is responsible for having a valid basis to collect and use a Lead's information and to contact that Lead. The Agent attests to holding the necessary express or implied consent at the point of entry, consistent with CASL and PIPEDA.

Where we process the personal information of individuals located outside Canada, we apply equivalent protections and recognise that additional frameworks may apply, as described in Section 8.

5. Our two-tier role (controller and processor)

CloseFlow operates under a two-tier model that reflects how the Service is used.

• For Agent account information, CloseFlow is the controller. We determine the purposes and means of processing this information and are accountable for it under PIPEDA.
• For Lead information, the Agent is the controller and CloseFlow acts as a processor. We process Lead information only on the Agent's instruction and on their behalf, in order to provide the Service. The Agent is the organisation accountable to the Lead for that information.

In practice, this means a Lead who wishes to access, correct, or delete their information, or to withdraw consent, should ordinarily direct that request to the Agent they are dealing with, because the Agent controls that information. CloseFlow will assist the Agent in giving effect to such requests, and will respond directly to a Lead where required by law or where the Agent is unavailable. Our contact details are in Section 15.

6. Third-party processors

We engage a limited number of carefully selected service providers to operate the Service. Each processes personal information only as needed to perform its function and under contractual obligations to protect it. We do not authorise any of them to use personal information for their own marketing.

Processors that are always part of the Service

Processors used only where an Agent connects them

Some optional integrations may involve an additional processor that is engaged only if an Agent chooses to connect that integration. There are currently no such processors. If we introduce one, we will list it in this section, with its purpose, the data shared, and its location, before the integration becomes available.

Google reCAPTCHA

Our public forms, including agent booking pages, use Google reCAPTCHA Enterprise to protect against automated abuse and spam. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service, which describe Google's own data-handling practices for the form-interaction signals it processes.

7. Data storage and security

The Service runs on infrastructure operated by Hetzner Online GmbH in Germany, including our compute, primary database, photo object storage, and encrypted database backups. Content assets and document attachments are stored on Cloudflare R2.

We apply organisational and technical safeguards appropriate to the sensitivity of the information, including:

• Encryption in transit: all connections to the Service use Transport Layer Security (TLS 1.2 or higher).
• Encryption at rest for secrets: sensitive credentials, such as calendar authorisation tokens, are encrypted at rest using authenticated encryption (Fernet with HKDF-derived keys). Passwords are stored only as salted hashes (bcrypt), never in plain text.
• Access controls: multi-tenant isolation is enforced at the data-query layer so that an Agent can access only their own account and Lead data.
• Two-factor authentication: available to Agents using time-based one-time passwords and recovery codes.
• Audit logging: sensitive actions are recorded to support accountability and incident investigation.
• Breach response: we maintain procedures to assess and respond to security incidents, and we will notify affected individuals and the Office of the Privacy Commissioner of Canada where a breach poses a real risk of significant harm, consistent with PIPEDA.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. Cross-border data transfers

CloseFlow's primary data residency is in the European Union (Germany), where Hetzner provides our compute, database, photo storage, and backups. A smaller set of specialised functions is provided by processors located in the United States (artificial intelligence, email, SMS, calendar and address services, and error monitoring), and content assets are stored on Cloudflare's network, operated by a United States headquartered company.

As a result, personal information may be stored or processed outside Canada and may be subject to the laws of the jurisdictions where our processors operate, including lawful access requests by authorities in those countries.

• PIPEDA: we remain accountable under PIPEDA for personal information transferred to a processor for processing, and we use contractual and technical measures to provide a comparable level of protection. Germany's data-protection regime under the EU General Data Protection Regulation is widely recognised as offering a high standard of protection.
• Quebec (Law 25): where personal information of Quebec residents is communicated outside the province, we conduct a privacy assessment of the transfer that weighs the sensitivity of the information, the purposes, the protective measures in place, and the legal framework of the destination, and we proceed only where the information would receive adequate protection.

9. How long we keep information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to provide the Service, and to meet legal, regulatory, and legitimate business requirements. The periods below are our standard defaults.

Where information must be retained for legal reasons after an account is closed (for example, communication and consent records, or financial records), we restrict its use to those purposes until the retention period ends, after which it is securely deleted or anonymised. These periods are kept under review and may be adjusted to meet evolving legal requirements.

10. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you and obtain information about how it is used.
• Correct information that is inaccurate or incomplete.
• Delete your information, subject to the legal retention requirements in Section 9.
• Port your information by requesting an export in a structured, commonly used format.
• Withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.
• Complain to a regulator (see Section 15).

Agents can exercise most of these rights directly through their account settings, including self-service data export and account deletion. Because Agents control Lead information, a Lead should ordinarily make a request to the Agent they are dealing with; CloseFlow will facilitate the request, as described in Section 5. We respond to verified requests within 30 days.

11. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Strictly necessary: to keep you signed in, maintain your session, and protect against cross-site request forgery. The Service does not function without these.
• Analytics: limited, privacy-respecting measurement of how the Service is used, so that we can improve it.

We do not use third-party advertising cookies. You can control cookies through your browser settings, although disabling strictly necessary cookies will prevent you from signing in.

12. Text messaging (SMS)

The Service includes the CloseFlow SMS program, through which licensed real estate agents send text messages to their own consented contacts using the CloseFlow platform. Messages sent through the program include booking confirmations, appointment and showing reminders, follow-up messages, and market updates. Each message is sent by the Agent an individual is dealing with, and only to individuals who have provided that Agent with the required consent.

• Opting out: reply STOP to any message to opt out of further messages at any time.
• Help: reply HELP to any message, or contact us at [email protected].
• Frequency: message frequency varies.
• Rates: message and data rates may apply.

SMS Consent and Data Sharing

Mobile phone numbers and SMS consent information collected through CloseFlow booking forms and agent-recorded verbal consent are used solely for direct communication between the licensed Ontario REALTOR® and the lead. This information is not shared with third parties or affiliates for marketing or promotional purposes.

Consent to receive SMS messages is given directly to the agent through the CloseFlow platform. Mobile opt-in data is never resold, syndicated, or transferred to external marketing partners.

Third-party service providers (Twilio for SMS delivery, Resend for outbound email delivery) process this data solely to fulfil delivery of the messages consented to, under strict data processing agreements. They do not use this data for their own marketing purposes.

The terms that govern the CloseFlow SMS program, including the full program disclosure, are set out in Section 6 of our Terms of Service.

13. Children's privacy

The Service is intended for licensed real estate professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from a person under 18. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us with personal information, please contact us at [email protected].

14. Changes to this Policy

We may update this Policy from time to time. When we make a material change, we will update the "Last updated" date above and notify Agents through an in-application notice, by email, or both, before the change takes effect. Your continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy.

15. How to contact us

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. Residents of Quebec may contact the Commission d'accès à l'information du Québec at cai.gouv.qc.ca. Concerns about commercial electronic messages may be reported to the Canadian Radio-television and Telecommunications Commission through the Spam Reporting Centre at fightspam.gc.ca.