Privacy Policy

Last updated: October 8, 2026 · Governs use of mohammademon.ca and any personal information collected through this website.

1. Who We Are

This website (mohammademon.ca) is operated by Mohammad Emon, REALTOR® at KO Realty (the "brokerage"). For privacy-related questions, contact:

• Mohammad Emon, REALTOR®
• Suite 206, 301 14 Street NW, Calgary, AB T2N 2A1
• Email: [email protected]
• Phone: 403-888-4268

2. What Information We Collect

We collect personal information that you voluntarily provide through forms on this website, plus limited technical data automatically generated when you visit.

Information you provide

• Contact forms, lead forms, calculator forms, listing pages — name, email, phone (if given), property address (sellers), budget, intent (buyer/seller/investor), preferred areas, and any free-text message. Where you use one of the calculators, the figures you entered and the result are included — for example a down payment and the resulting maximum price. A stated household income, credit rating or employment status is never transmitted or stored, even if you enter one to use a calculator: those stay in your browser.
• Newsletter — email address and first name.
• Chat widget (Chinook AI) — your messages to the assistant; if you opt to share contact info, your name, phone, email, timeline, and goal.
• Sold-data portal (/vow/) — registration details we are required to collect under our MLS licence before sold data can be displayed. Set out in full in Section 5.
• Investor workspace (/investor-workspace.html) — set out in full in Section 6A.

Information collected automatically

• Google Analytics — anonymized page views, device type, country, referral source. We do not collect IP addresses for marketing purposes.
• Server logs — IP address (used briefly for rate-limiting / spam prevention), user agent, request time. Logs are retained by our hosting provider (Vercel) for a limited period.
• Meta (Facebook) Pixel — we run two Meta pixels. They record page views and lead events and set the _fbp and _fbc cookies, which Meta uses to measure and target advertising. They load only if you accept cookies.
• HubSpot tracking — the HubSpot script records page views and sets hubspotutk, __hstc and __hssc, which link your browsing to your contact record if you have ever submitted a form. It is suppressed unless you accept cookies.
• Cookies and local storage — a cookie for theme preference; me_recognized and me_recognized_js so a returning visitor is not asked for their details again; and browser storage keys me_lead (your name and email if you have given them), me_consent_v1 (your cookie choice) and me_chat_pages (pages viewed in the current chat session). Google Analytics, Meta and HubSpot each set their own cookies, governed by their own policies.

3. How We Use Your Information

Lead scoring and profiling

We want to be straightforward about this, because it is the part people least expect. If you give us your contact details, we do more than store them:

• We score you. Each contact record carries a numeric priority based on what you asked for and how you behaved on the site, so that the most urgent enquiries get answered first.
• We build a short profile. An automated summary of what appears to motivate you, what your likely timeline is, what you have said matters to you, and a suggested sequence of follow-up. It is generated from what you told us and the pages you viewed. It is a working note to help a human prepare, not a decision made by a machine — nothing is refused, priced or granted automatically on the basis of it.
• If we already know who you are, we notice when you come back. For a contact we have already identified, we record which pages are viewed and may alert Mohammad when the activity suggests you are close to a decision. This only happens if you have accepted cookies.

You can ask to see the profile we hold on you, ask us to correct it, or ask us to delete it, at [email protected]. We are not required to keep it and will not argue about removing it.

SMS / text messages

If you provide a mobile phone number through any form on this site (lead capture, MLS gate, contact form, listing alerts, etc.), Mohammad may contact you via SMS to follow up on your inquiry, send listing alerts you signed up for, or coordinate showings + closings. SMS is delivered through Twilio (a service provider — see Section 4). Standard message-and-data rates from your mobile carrier may apply. You can opt out anytime by replying STOP to any text from us; Twilio automatically suppresses your number going forward. Replying HELP returns Mohammad's contact info. We do not send marketing text blasts — SMS is only used to respond to your specific request or alerts you opted into.

4. Who We Share Information With

We never sell your personal information. We share limited information only with the following service providers, who process it on our behalf under their own privacy policies:

• Resend (United States) — sends transactional emails (lead notifications, newsletter, welcome emails).
• Twilio (United States) — sends SMS / text messages to your mobile number when you opt-in via a form. Reply STOP to opt out.
• HubSpot (United States) — CRM that stores lead records + booking flow, and website analytics that track page views against your contact record. Privacy policy: hubspot.com/privacy-policy.
• Vercel (United States) — hosts this website, runs the API endpoints, and stores data files in Vercel Blob.
• Supabase (United States) — the database that stores sold-data portal registrations, sessions, and the access log required by our MLS licence. Used only for the portal (Section 5). Privacy policy: supabase.com/privacy.
• Google Analytics (United States) — anonymized website traffic statistics.
• Meta Platforms, Inc. (United States) — advertising measurement and audience targeting via the Meta Pixel, only if you accept cookies.
• GitHub, Inc. (United States) — several of our data files, including the subscriber list, are stored in a private GitHub repository that the site reads and writes.
• Anthropic (Claude API) (United States) — powers the Chinook AI chat widget. Chat messages are processed for response generation only; Anthropic does not use API inputs to train models per their data policy.
• Cloudflare, Inc. (United States) — carries all traffic to this site and runs the Turnstile check on forms that stops automated sign-ups. It sees your IP address and browser details for that purpose only.
• KO Realty — our brokerage of record. May receive your information when required for a real estate transaction.
• CREB / Pillar 9 (MLS) — when an offer or listing is created, your information forms part of the standard MLS transaction record.

Where your information is stored (cross-border disclosure)

Every service provider named above, other than KO Realty and CREB / Pillar 9 (both in Alberta), is located in the United States. Your personal information is therefore stored and processed outside Canada, and while it is there it may be accessible to United States courts, law enforcement and national-security authorities under the laws of that country, without notice to you or to us.

Alberta's Personal Information Protection Act (section 13.1) requires us to tell you this before you give us your information, and to give you someone to ask about it. That person is Mohammad Emon, and you can reach him at [email protected] or 403-888-4268 with any question about how these providers handle your data or where it is held.

We may also disclose information when required by law (court order, regulatory request) or to protect the safety of any person.

5. Sold-Data Portal (Pillar 9 VOW)

The sold-data portal at mohammademon.ca/vow/ is a Virtual Office Website (VOW) operated under a Pillar 9™ MLS® System Listing Data Access License Agreement. Sold prices and sold dates are licensed data, not public data, and Pillar 9's Internet Rules do not permit anonymous access to them. Under Internet Rule 4.02, a licensee may display sold data only to a person it has identified by name, whose email address it has confirmed, and who has accepted a separate Terms of Use — and it must keep a record of what that person searched and viewed. Registration is therefore a condition of the MLS licence, not a marketing choice. Every other part of this website can be used without registering, and nothing on the portal costs money or creates a client relationship.

What the portal collects

• Name — your first and last name.
• Email address — also your username. You must verify it by clicking a link we email you; the account cannot see any sold data until you do.
• Phone number — part of the registration record.
• Password — stored only as a salted pbkdf2-SHA256 hash (100,000 iterations). The password itself is never written down and cannot be recovered or read by us; a forgotten password is reset, not retrieved.
• Terms of Use acceptance — the version of the terms you were shown, the date and time you accepted, the IP address you accepted from, and the full name you typed to accept. Rule 4.02(g) does not allow acceptance by mouse click alone, which is why you are asked to type your name.
• Access log — a record of account events (registration, email verification, terms acceptance, logins, failed logins, suspension) and of the searches you run and the listings you view, with the time and IP address. Rule 4.02(j) requires the licensee to be able to detect and stop misuse of the licensed data — scraping, bulk extraction, redistribution, shared credentials — and this log is how that is done.
• Marketing consent — if, and only if, you tick the optional box described below, we also record that you ticked it, when, from what IP address, and the exact wording you were shown.

How the access log is used

The record of your searches and the listings you view exists as compliance evidence: it is what we produce if Pillar 9 audits the portal or asks us to demonstrate that a given person was properly registered before seeing sold data. It is not used for marketing or profiling. It is not sent to HubSpot, is not combined with the analytics or advertising pixels used elsewhere on this site, is not used to score or rank you as a lead, and is not used to decide what we send you.

Optional marketing consent

The registration form includes one optional checkbox asking whether you would also like to hear from Mohammad about buying or selling. It is unticked by default, and it is separate from the Terms of Use you must accept. Your access does not depend on it: an account registered with the box left unticked receives exactly the same sold data as one with it ticked, and receives only account emails — verification, password reset, and notices about the portal itself. Only if you tick it do your name, email, and phone go to our CRM (HubSpot) and the newsletter list; that tick is your express consent under CASL. You can withdraw at any time using the unsubscribe link in any commercial email, or by emailing [email protected]. Withdrawing consent does not affect your access to the portal.

Where portal data is stored, and cross-border disclosure

Section 13.1 of Alberta's Personal Information Protection Act requires us to tell you when a service provider outside Canada handles your personal information. For the portal:

• Supabase Inc. (United States) — the database holding registration records, login sessions, and the access log.
• Vercel Inc. (United States) — hosts the portal and runs its API endpoints.
• HubSpot (United States) — receives your contact details only if you gave the optional marketing consent above. If you did not, no portal data reaches HubSpot.

Personal information held in the United States may be accessible to U.S. courts, law enforcement, and government agencies under U.S. law. For written information about our policies and practices for personal information handled by service providers outside Canada, or to ask questions about it, contact Mohammad Emon at [email protected] or 403-888-4268 (Section 1).

Deleting your portal registration

Email [email protected] and ask for your portal registration to be deleted. On receipt we:

• Suspend the account and end every active session immediately, so access stops at once.
• Erase the personal fields — name, email address, phone number, password hash, IP addresses, and the searches and listings recorded against you — within 30 days. If you had given marketing consent, you are removed from HubSpot and the newsletter list at the same time.
• Retain only the minimum Terms of Use acceptance evidence: the name you typed, the version you accepted, and the date and time. This is kept for as long as the Pillar 9 licence is in force, because it is the record that proves the registration was lawful and that sold data was not disclosed to an unregistered person. It is not used for any other purpose and is not linked to any marketing system.

The MLS sold data itself

The sold records shown in the portal are licensed to us for display on this website only. We do not sell them, licence them, share them, or redistribute them, and we do not use them to build any other product, dataset, valuation model, or derivative work. They are stored separately from the registration database, and if the licence ends they are destroyed and the destruction is certified to Pillar 9.

6. Email Marketing & CASL

We comply with Canada's Anti-Spam Legislation (CASL). When you subscribe to the newsletter or otherwise consent to receive commercial emails, we record:

• The email address and first name you provided
• The date, time, and form/page where you subscribed

Every newsletter email contains an unsubscribe link that takes effect immediately. You can also unsubscribe by emailing [email protected] with the subject "Unsubscribe."

6A. Investor Workspace

The investor workspace (/investor-workspace.html) is where you sign in to keep investment criteria and a watchlist, read reports Mohammad prepares for you, and choose alerts. This section covers everything it collects, why, who can see it, where it is stored, how long it is kept, and what you can ask for.

What we collect

• Your account — your email address (it is also how you sign in), the sign-in links we email you (valid 15 minutes, single use), and a session record for each browser you sign in from (30 days), which holds that browser's user-agent string. If you are already a client, Mohammad may note your CRM contact number on the account after confirming it is you.
• What you set up — your investment criteria, language and view preferences, how often you want alerts, and your watchlist.
• Reports and alerts — which reports list you as a recipient, and which opportunities each alert was about.
• Agreements and consent — the consent wording and its version, the time you agreed, and the IP address of the browser that confirmed it (and of the one that asked for the sign-in link); if you withdraw, the time and IP address of the withdrawal. For confidentiality agreements (NDAs) you accept: the agreement's version, a fingerprint of its exact text, and the time.
• Access to confidential opportunities — each request you make, its time and any message you add; and, if access is granted, its terms, when it ends, and how Mohammad confirmed who you are (for example by phone or in person). We do not collect identity documents.
• Opportunities you submit — everything on the form: the property or business details and figures, links to documents (stored as text and never opened by our systems), your statements about your authority to share it, the contact for questions you give us, and your email address.
• Send records — for each report and alert email: when it was sent, whether our email provider accepted it, the consent version it relied on, and the provider's message id.
• An audit log — sign-ins, consent given or withdrawn (with the wording's version), access requests, NDA acceptances, submissions and account deletion. Entries carry an internal account number, never your email address. It is append-only, because it is the record that you consented to commercial email under CASL.

Your IP address is also checked briefly, in memory only, to limit how many sign-in requests one address can make, and the sign-in form uses Cloudflare Turnstile, which receives your IP address to tell people from automated abuse.

Why we collect it, and on what basis

We use workspace information for nothing else. It is not sent to our CRM, not combined with the analytics or advertising pixels used elsewhere on this site, not used to score you as a lead, and never sold.

Who can see it

Mohammad, through his signed-in owner's console. Other investors never see who else is interested in an opportunity, and the workspace does not pass your details to a seller, a listing brokerage or another investor. If a deal goes ahead, KO Realty and the other side receive what the transaction requires (Section 4). The service providers below store or carry the information on our behalf. Records are held in private storage that is not reachable from the web, and the secret in a sign-in link or session cookie is stored only as a keyed hash, so a copy of the storage alone cannot sign anyone in.

Service providers outside Canada (PIPA section 13.1)

The workspace uses service providers in the United States, so your personal information is stored and processed outside Canada:

• Vercel Inc. (United States) — hosts the workspace, runs its server code, and stores every record listed above, and the monthly backups, in private Vercel Blob storage.
• Resend (United States) — sends the sign-in, report and alert emails. It receives your email address and the message, and keeps its own delivery logs for its own retention period.
• Cloudflare, Inc. (United States) — runs the Turnstile check on the sign-in form and carries every request to this site, so it sees your IP address.
• GitHub, Inc. or Vercel (United States) — the do-not-email list your address joins if you unsubscribe or delete the account is kept with our subscriber list (Section 4).
• Anthropic (United States) — reads documents Mohammad uploads about an opportunity (a rent roll, for example) to suggest figures for his review. Your account details are not sent to it.

While it is in the United States, your information may be accessible to courts, law enforcement and national-security authorities under United States law. For written information about our policies and practices for service providers outside Canada, or to ask how they collect, use, disclose or store your information, contact Mohammad Emon (below).

How long we keep it

Why 3 years: under Canada's Anti-Spam Legislation the sender has to prove consent, and a complaint or a penalty proceeding can concern a message for up to three years after it was sent. Alberta's PIPA says not to keep personal information longer than reasonably required, so these records are deleted when that period ends, by a job that runs every day, whether or not the account still exists. A record deleted from live storage can remain in a backup made before the deletion until that backup ages out.

Seeing, correcting or deleting your information

• See it. Most of it is on your workspace pages: criteria, watchlist, reports, and your access requests and agreements. For a copy of everything we hold about you, including the consent and audit records, email [email protected] from the address you sign in with.
• Correct it. Change your criteria, preferences and watchlist yourself at any time. For anything else, email us with what is wrong.
• Delete it. Use "Delete account" in the workspace, or email us.

We may ask you to confirm a request from the address on the account before we disclose anything. We answer in writing within 30 days (Section 8), and never later than the 45 days Alberta's PIPA allows unless, within that time, we tell you in writing that PIPA's extension applies and why. If you are not satisfied with the answer, you can ask the Office of the Information and Privacy Commissioner of Alberta to review it (Section 8).

Withdrawing consent

You can withdraw consent to report and alert emails at any time: untick it in the workspace's alert settings, use the unsubscribe link in any of those emails, or email us. Nothing more is sent from then on. We keep the record of what you agreed to and when you withdrew, because it is the proof that earlier emails were sent with consent. Withdrawing does not close the account: you can still sign in, and a sign-in link is emailed only when you ask for one. To remove the account as well, delete it.

What deleting your account removes, and what it does not

Deleting the account (in the workspace, or by emailing us) first adds your address to our do-not-email list, so nothing more is sent, and then removes: your account and email address; your consent record, with its times and IP addresses; your criteria, preferences and watchlist; your access requests, NDA acceptances and any confidential access you were granted; your place on any report's recipient list; the record of which alerts you were last shown, and every alert not yet sent; your sign-in links and every session. From an opportunity you submitted it removes your email address and the contact you gave; if we never accepted the submission, it also removes every description, figure, link and statement in it, leaving only dates and the fixed-choice answers. A submission we accepted keeps its content, because an opportunity record was built on it.

It does not remove the following. Each holds an internal account number, never your name or email address, except where noted:

• audit log entries made before the deletion (including when you consented, to which version of the wording, and when you deleted the account), each deleted 3 years after it was made. The deletion entry keeps a one-way fingerprint (a SHA-256 hash) of your email address, not the address, so that if you later ask whether you consented we can check it; it is deleted with the entry;
• report send records, deleted 3 years after each send, and alert records, deleted 400 days after each alert. A send record's provider message id can still be matched to your address in the email provider's own logs, for that provider's retention period;
• a note on a report that it was withdrawn for you, what is left of a submission we never accepted, and, where Mohammad named you on an opportunity's list of approved people, that entry;
• your address on the do-not-email list (this one does hold your address), so that we never email you again;
• copies in earlier backups, which hold the records as they were, address included, until they age out, normally about 12 months later. We do not edit old backups.

Who is responsible

Mohammad Emon, REALTOR® at KO Realty, is responsible for personal information in the investor workspace and answers questions about it, including questions about the service providers outside Canada listed above: [email protected], 403-888-4268, or by mail to Suite 206, 301 14 Street NW, Calgary, AB T2N 2A1.

7. How Long We Keep Your Information

• Lead/contact form submissions — retained while there is an active relationship plus 7 years (Real Estate Council of Alberta record-keeping requirements).
• Newsletter list — retained until you unsubscribe.
• Analytics — anonymized, retained per Google's standard policy (typically 14 months).
• Server / rate-limit logs — short-term (hours to days).
• Investor workspace — set out in Section 6A: sessions 30 days, alert records 400 days, report send records and the audit log 3 years (the proof of consent) and then deleted, account data until you delete the account, backups about 12 months.
• Disaster-recovery backups — a monthly encrypted-at-rest snapshot of our contact and subscriber lists is kept in private storage; we keep the 12 most recent snapshots and delete anything older, so a record removed at your request disappears from backups within 12 months.

8. Your Rights Under PIPEDA and Alberta PIPA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent (e.g. unsubscribe from emails)
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca)

To exercise any of these rights, email [email protected]. We respond within 30 days.

9. Children's Privacy

This website is not directed to children under 13. We do not knowingly collect information from children.

10. Security

We use HTTPS site-wide, security headers (HSTS, CSP, X-Frame-Options), input validation, and IP rate-limiting. No transmission over the internet is 100% secure, but we work to protect your information using current best practices.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be flagged at the top of this page with a new "Last updated" date.

12. Contact

Questions about this privacy policy or how your information is handled? Email [email protected] or call 403-888-4268.