Privacy Policy

Last updated: August 7, 2026 · Governs use of mohammademon.ca and any personal information collected through this website.

1. Who We Are

This website (mohammademon.ca) is operated by Mohammad Emon, REALTOR® at KO Realty (the "brokerage"). For privacy-related questions, contact:

• Mohammad Emon, REALTOR®
• Suite 206, 301 14 Street NW, Calgary, AB T2N 2A1
• Email: [email protected]
• Phone: 403-888-4268

2. What Information We Collect

We collect personal information that you voluntarily provide through forms on this website, plus limited technical data automatically generated when you visit.

Information you provide

• Contact forms, lead forms, calculator forms, listing pages — name, email, phone (if given), property address (sellers), budget, intent (buyer/seller/investor), preferred areas, and any free-text message. Where you use one of the calculators, the figures you entered and the result are included — for example a down payment and the resulting maximum price. A stated household income, credit rating or employment status is never transmitted or stored, even if you enter one to use a calculator: those stay in your browser.
• Newsletter — email address and first name.
• Chat widget (Chinook AI) — your messages to the assistant; if you opt to share contact info, your name, phone, email, timeline, and goal.
• Sold-data portal (/vow/) — registration details we are required to collect under our MLS licence before sold data can be displayed. Set out in full in Section 5.

Information collected automatically

• Google Analytics — anonymized page views, device type, country, referral source. We do not collect IP addresses for marketing purposes.
• Server logs — IP address (used briefly for rate-limiting / spam prevention), user agent, request time. Logs are retained by our hosting provider (Vercel) for a limited period.
• Meta (Facebook) Pixel — we run two Meta pixels. They record page views and lead events and set the _fbp and _fbc cookies, which Meta uses to measure and target advertising. They load only if you accept cookies.
• HubSpot tracking — the HubSpot script records page views and sets hubspotutk, __hstc and __hssc, which link your browsing to your contact record if you have ever submitted a form. It is suppressed unless you accept cookies.
• Cookies and local storage — a cookie for theme preference; me_recognized and me_recognized_js so a returning visitor is not asked for their details again; and browser storage keys me_lead (your name and email if you have given them), me_consent_v1 (your cookie choice) and me_chat_pages (pages viewed in the current chat session). Google Analytics, Meta and HubSpot each set their own cookies, governed by their own policies.

3. How We Use Your Information

Lead scoring and profiling

We want to be straightforward about this, because it is the part people least expect. If you give us your contact details, we do more than store them:

• We score you. Each contact record carries a numeric priority based on what you asked for and how you behaved on the site, so that the most urgent enquiries get answered first.
• We build a short profile. An automated summary of what appears to motivate you, what your likely timeline is, what you have said matters to you, and a suggested sequence of follow-up. It is generated from what you told us and the pages you viewed. It is a working note to help a human prepare, not a decision made by a machine — nothing is refused, priced or granted automatically on the basis of it.
• If we already know who you are, we notice when you come back. For a contact we have already identified, we record which pages are viewed and may alert Mohammad when the activity suggests you are close to a decision. This only happens if you have accepted cookies.

You can ask to see the profile we hold on you, ask us to correct it, or ask us to delete it, at [email protected]. We are not required to keep it and will not argue about removing it.

SMS / text messages

If you provide a mobile phone number through any form on this site (lead capture, MLS gate, contact form, listing alerts, etc.), Mohammad may contact you via SMS to follow up on your inquiry, send listing alerts you signed up for, or coordinate showings + closings. SMS is delivered through Twilio (a service provider — see Section 4). Standard message-and-data rates from your mobile carrier may apply. You can opt out anytime by replying STOP to any text from us; Twilio automatically suppresses your number going forward. Replying HELP returns Mohammad's contact info. We do not send marketing text blasts — SMS is only used to respond to your specific request or alerts you opted into.

4. Who We Share Information With

We never sell your personal information. We share limited information only with the following service providers, who process it on our behalf under their own privacy policies:

• Resend (United States) — sends transactional emails (lead notifications, newsletter, welcome emails).
• Twilio (United States) — sends SMS / text messages to your mobile number when you opt-in via a form. Reply STOP to opt out.
• HubSpot (United States) — CRM that stores lead records + booking flow, and website analytics that track page views against your contact record. Privacy policy: hubspot.com/privacy-policy.
• Vercel (United States) — hosts this website, runs the API endpoints, and stores data files in Vercel Blob.
• Supabase (United States) — the database that stores sold-data portal registrations, sessions, and the access log required by our MLS licence. Used only for the portal (Section 5). Privacy policy: supabase.com/privacy.
• Google Analytics (United States) — anonymized website traffic statistics.
• Meta Platforms, Inc. (United States) — advertising measurement and audience targeting via the Meta Pixel, only if you accept cookies.
• GitHub, Inc. (United States) — several of our data files, including the subscriber list, are stored in a private GitHub repository that the site reads and writes.
• Anthropic (Claude API) (United States) — powers the Chinook AI chat widget. Chat messages are processed for response generation only; Anthropic does not use API inputs to train models per their data policy.
• KO Realty — our brokerage of record. May receive your information when required for a real estate transaction.
• CREB / Pillar 9 (MLS) — when an offer or listing is created, your information forms part of the standard MLS transaction record.

Where your information is stored (cross-border disclosure)

Every service provider named above is located in the United States. Your personal information is therefore stored and processed outside Canada, and while it is there it may be accessible to United States courts, law enforcement and national-security authorities under the laws of that country, without notice to you or to us.

Alberta's Personal Information Protection Act (section 13.1) requires us to tell you this before you give us your information, and to give you someone to ask about it. That person is Mohammad Emon, and you can reach him at [email protected] or 403-888-4268 with any question about how these providers handle your data or where it is held.

We may also disclose information when required by law (court order, regulatory request) or to protect the safety of any person.

5. Sold-Data Portal (Pillar 9 VOW)

The sold-data portal at mohammademon.ca/vow/ is a Virtual Office Website (VOW) operated under a Pillar 9™ MLS® System Listing Data Access License Agreement. Sold prices and sold dates are licensed data, not public data, and Pillar 9's Internet Rules do not permit anonymous access to them. Under Internet Rule 4.02, a licensee may display sold data only to a person it has identified by name, whose email address it has confirmed, and who has accepted a separate Terms of Use — and it must keep a record of what that person searched and viewed. Registration is therefore a condition of the MLS licence, not a marketing choice. Every other part of this website can be used without registering, and nothing on the portal costs money or creates a client relationship.

What the portal collects

• Name — your first and last name.
• Email address — also your username. You must verify it by clicking a link we email you; the account cannot see any sold data until you do.
• Phone number — part of the registration record.
• Password — stored only as a salted pbkdf2-SHA256 hash (100,000 iterations). The password itself is never written down and cannot be recovered or read by us; a forgotten password is reset, not retrieved.
• Terms of Use acceptance — the version of the terms you were shown, the date and time you accepted, the IP address you accepted from, and the full name you typed to accept. Rule 4.02(g) does not allow acceptance by mouse click alone, which is why you are asked to type your name.
• Access log — a record of account events (registration, email verification, terms acceptance, logins, failed logins, suspension) and of the searches you run and the listings you view, with the time and IP address. Rule 4.02(j) requires the licensee to be able to detect and stop misuse of the licensed data — scraping, bulk extraction, redistribution, shared credentials — and this log is how that is done.
• Marketing consent — if, and only if, you tick the optional box described below, we also record that you ticked it, when, from what IP address, and the exact wording you were shown.

How the access log is used

The record of your searches and the listings you view exists as compliance evidence: it is what we produce if Pillar 9 audits the portal or asks us to demonstrate that a given person was properly registered before seeing sold data. It is not used for marketing or profiling. It is not sent to HubSpot, is not combined with the analytics or advertising pixels used elsewhere on this site, is not used to score or rank you as a lead, and is not used to decide what we send you.

Optional marketing consent

The registration form includes one optional checkbox asking whether you would also like to hear from Mohammad about buying or selling. It is unticked by default, and it is separate from the Terms of Use you must accept. Your access does not depend on it: an account registered with the box left unticked receives exactly the same sold data as one with it ticked, and receives only account emails — verification, password reset, and notices about the portal itself. Only if you tick it do your name, email, and phone go to our CRM (HubSpot) and the newsletter list; that tick is your express consent under CASL. You can withdraw at any time using the unsubscribe link in any commercial email, or by emailing [email protected]. Withdrawing consent does not affect your access to the portal.

Where portal data is stored, and cross-border disclosure

Section 13.1 of Alberta's Personal Information Protection Act requires us to tell you when a service provider outside Canada handles your personal information. For the portal:

• Supabase Inc. (United States) — the database holding registration records, login sessions, and the access log.
• Vercel Inc. (United States) — hosts the portal and runs its API endpoints.
• HubSpot (United States) — receives your contact details only if you gave the optional marketing consent above. If you did not, no portal data reaches HubSpot.

Personal information held in the United States may be accessible to U.S. courts, law enforcement, and government agencies under U.S. law. For written information about our policies and practices for personal information handled by service providers outside Canada, or to ask questions about it, contact Mohammad Emon at [email protected] or 403-888-4268 (Section 1).

Deleting your portal registration

Email [email protected] and ask for your portal registration to be deleted. On receipt we:

• Suspend the account and end every active session immediately, so access stops at once.
• Erase the personal fields — name, email address, phone number, password hash, IP addresses, and the searches and listings recorded against you — within 30 days. If you had given marketing consent, you are removed from HubSpot and the newsletter list at the same time.
• Retain only the minimum Terms of Use acceptance evidence: the name you typed, the version you accepted, and the date and time. This is kept for as long as the Pillar 9 licence is in force, because it is the record that proves the registration was lawful and that sold data was not disclosed to an unregistered person. It is not used for any other purpose and is not linked to any marketing system.

The MLS sold data itself

The sold records shown in the portal are licensed to us for display on this website only. We do not sell them, licence them, share them, or redistribute them, and we do not use them to build any other product, dataset, valuation model, or derivative work. They are stored separately from the registration database, and if the licence ends they are destroyed and the destruction is certified to Pillar 9.

6. Email Marketing & CASL

We comply with Canada's Anti-Spam Legislation (CASL). When you subscribe to the newsletter or otherwise consent to receive commercial emails, we record:

• The email address and first name you provided
• The date, time, and form/page where you subscribed

Every newsletter email contains an unsubscribe link that takes effect immediately. You can also unsubscribe by emailing [email protected] with the subject "Unsubscribe."

7. How Long We Keep Your Information

• Lead/contact form submissions — retained while there is an active relationship plus 7 years (Real Estate Council of Alberta record-keeping requirements).
• Newsletter list — retained until you unsubscribe.
• Analytics — anonymized, retained per Google's standard policy (typically 14 months).
• Server / rate-limit logs — short-term (hours to days).
• Disaster-recovery backups — a monthly encrypted-at-rest snapshot of our contact and subscriber lists is kept in private storage; we keep the 12 most recent snapshots and delete anything older, so a record removed at your request disappears from backups within 12 months.

8. Your Rights Under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent (e.g. unsubscribe from emails)
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)

To exercise any of these rights, email [email protected]. We respond within 30 days.

9. Children's Privacy

This website is not directed to children under 13. We do not knowingly collect information from children.

10. Security

We use HTTPS site-wide, security headers (HSTS, CSP, X-Frame-Options), input validation, and IP rate-limiting. No transmission over the internet is 100% secure, but we work to protect your information using current best practices.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be flagged at the top of this page with a new "Last updated" date.

12. Contact

Questions about this privacy policy or how your information is handled? Email [email protected] or call 403-888-4268.