Your data. Actually yours.

1. Introduction and Scope

This Privacy Policy explains how Genesis Arc collects, uses, discloses and safeguards personal information, and the choices and rights available to you. Genesis Arc is operated by Genesis Arc Technologies Inc., Nanaimo, British Columbia, Canada.

This policy is effective as of the “Last updated” date shown above and applies to all personal information we handle through the Service.

This policy covers the Genesis Arc application at genesisarc.ca/app, the genesisarc.ca website, agent websites and open-house sign-in pages we host at yourname.genesisarc.ca, the public property-search site, video meeting rooms, video messages, calls placed from the app, and the ARIA Care messaging feature (together, the “Service”). It applies alongside our Terms of Service.

2. How the Service Works and Where Your Data Is Stored

Genesis Arc is a software workspace for licensed real estate professionals. It helps you manage contacts, leads, buyers and listings; prepare, read and compare contracts and market reports; create marketing materials; publish an agent website; host video meeting rooms; send video messages; run open-house sign-in; and place, receive and follow up on client communications by phone, text and email. An AI assistant, ARIA, supports these tasks — for example acting as a receptionist, drafting client messages for your approval, summarizing calls, and translating and explaining content. The sections below describe what information each of these features involves and where it is stored.

Genesis Arc runs in your browser. Your business content — contacts, leads, listings, buyers, documents, photos, notes, reports and settings — is stored on your own device (browser storage) and synced to your own Google Drive account. We do not operate general databases of your client records, and we do not access them; a limited set of features described below store specific data on our infrastructure in order to function-for example, the assistant’s outbound-messaging roster, call transcripts and summaries, video-message indexes, website and open-house form submissions in transit, and your branding. If you stop using Genesis Arc, your Drive and on-device data remains under your control.

Some features need a server to work at all-answering a phone call while your laptop is closed, hosting a public website, connecting a video call, recording and transcribing calls you place from the app, drafting and sending the messages the assistant prepares on your behalf, and serving your branded pages and video-message links. The rest of this policy describes those narrow cases precisely.

3. Information We Collect and How We Use It

Your account

You sign in with Google. We receive your basic profile (name, email) to operate your account. If you purchase a plan, billing is handled by our payment processor, Stripe; we receive only your customer id, subscription id, plan, billing email, and the card brand and last four digits shown in the Stripe billing portal — we never receive or store your full card number.

Additional sending addresses. You may add other email addresses you use for business (for example a brokerage or team address) so that email you send from the Service can carry that address as its reply-to. We confirm each address with a one-time code sent to it, and we store the address and the display name you give it on our infrastructure only to send on your behalf. We do not read the inbox of an address added this way, and you can remove it at any time in Settings.

Device, log and technical information

When you access the Service, we and our infrastructure providers automatically collect certain technical information, including your IP address, device and browser type, operating system, app version, language and similar settings, and log and diagnostic data such as access dates and times, features or pages used, referring pages, and error and crash reports. We use this information to operate, secure and troubleshoot the Service, to authenticate access and prevent fraud and abuse, to understand how the Service is used, and to analyze, maintain and improve our features. We may also create de-identified or aggregated analytics from this information, as described in “De-identified and aggregated data” below.

Google user data (Drive, Gmail, Calendar, Contacts)

Genesis Arc signs you in with your Google account and, with your consent on Google’s permission screen, uses the following Google user data. Every use below happens in your browser or in your own Google account; Genesis Arc does not copy Google user data to servers of ours, except where a line says otherwise.

We request the narrowest permissions that make each feature work, ask for them only when the feature needs them, and never use Google user data for advertising, never sell it, and never share it with anyone except the service providers listed in section 4 when strictly needed to provide the feature you are using (for example, our AI provider receives the one message you asked ARIA to answer). Humans at Genesis Arc do not read your Google data, except with your explicit permission for a support request you raised, or where required by law. You can remove Genesis Arc’s access at any time at myaccount.google.com/permissions; your data stays in your Google account.

Communications: phone, text and email

The features described in this section let ARIA and the assistant handle calls, texts and email on your business line and on your behalf. Each requires some server processing to function and is described individually below.

ARIA receptionist (calls, texts, email) — optional, off by default

If you enable the receptionist, communications sent to your business line or forwarded from your inbox are processed in real time so ARIA can answer: audio and text pass through our infrastructure provider (Cloudflare), your telephony account (Twilio — the message logs live in your Twilio account, not ours), and an AI provider to generate the response. We keep only the minimum operational memory needed for a coherent conversation (for example, recent thread context and scheduled bookings), stored with automatic expiry. Incoming receptionist calls answered by ARIA are not recorded.

Commercial electronic messages: where the Service sends texts or emails on an agent’s behalf, those messages are sent only where the required consent exists, identify the sender and include the sender’s contact information, and provide an unsubscribe or STOP mechanism that is honoured automatically, in accordance with Canada’s Anti-Spam Legislation (CASL). The agent is responsible for obtaining and maintaining the underlying consent.

Calls you place from the app — recorded and transcribed

When you place a call to a client from the app, the call runs through your own Twilio account. Before the client is connected, ARIA announces that the assistant is taking notes, that the call is being recorded, and that the client may ask not to be recorded. The audio is recorded by Twilio, transcribed by our infrastructure provider’s speech-to-text (Cloudflare), and summarized by our AI provider; the audio recording is then deleted unless you choose to keep it. The resulting transcript and summary are stored on our infrastructure, keyed to your Twilio account, and shown in your app. Calls that are not answered are not transcribed. You can turn call recording off, and if a client objects to being recorded you should continue the call without recording. You are responsible for the recording announcement being played and for compliance with any recording rules that apply to you.

ARIA Care — messages the assistant sends on your behalf

If you switch on ARIA Care, the assistant drafts occasional personal notes to your past clients (for example birthday, home-anniversary, holiday or check-in messages), and you approve each one before it is sent. To draft them, the app sends your client roster (name, phone, email, the relevant dates and the client’s recent notes) to our infrastructure (Cloudflare), where it is stored, and our AI provider drafts the message. Texts are sent through your Twilio number and emails through our email provider (Resend). The first text tells the client they can reply STOP, every email carries an unsubscribe link, and STOP and unsubscribe are honoured automatically. You can switch any client off. These are commercial electronic messages sent on your behalf and are subject to the CASL commitments above; you are responsible for obtaining and maintaining the underlying consent.

Email campaigns — newsletters and marketing email you send

If you use Email campaigns, the campaign (its content, the segment you chose, and the list of recipients with each person’s consent basis) is stored on our infrastructure (Cloudflare) so it can be sent and so you have a record of what went to whom. Emails are sent through our email provider (Resend) from a Genesis Arc sending address with your name and reply-to address. Each email contains a small tracking image and tracked links, so we record when a message is opened and which links are clicked; this is shown to you as campaign statistics and used to keep our sending reputation healthy (bounces and complaints automatically stop further email to that address). Recipients can unsubscribe with one click from any message, and unsubscribes are honoured automatically across all your campaigns and ARIA Care messages. These are commercial electronic messages sent on your behalf and are subject to the CASL commitments above; you are responsible for obtaining and maintaining the underlying consent, and the mailing address in the footer is yours.

Money — commission and expense records

If you use Money, your commission figures, expense ledger, receipt images and bank-statement imports are stored in your own Google Drive with the rest of your workspace, not on our servers. When you ask ARIA to read a receipt or sort statement lines into categories, the receipt image or the statement lines (vendor, date, amount) are sent to our AI provider for that single task and are not kept by it. We do not connect to your bank, hold your banking credentials, or move money; a bank-statement file you import is read in your browser. Receipt images are kept in your Drive for as long as you keep them (the CRA expects six years).

Agent websites & leads

If you publish a website, the content you chose to publish (and its AI translations, if enabled) is stored on our hosting so the public can view it. When a visitor submits a form on your site, their submission (name, contact details, message) is held briefly on our hosting until your app collects it — typically minutes, and in no event longer than 30 days, after which uncollected submissions are deleted — after which it lives in your own records. For website visitors: the agent whose site you used is the business collecting your information; we process it on their behalf.

Open-house sign-in

At an open house, visitors can scan a QR code and sign in on their own phone using a page we host, providing their name, mobile, email, whether they already work with a REALTOR®, how they heard about the open house, and an optional, unticked consent to future contact. They may also leave quick feedback and a comment. Submissions are held briefly on our infrastructure until your app collects them (typically minutes), after which they live in your records. The page identifies the agent and states that the details go to that agent only. Where a visitor consents, feedback about the home may be shared with the seller in a report; names are not included unless the visitor consented.

Cooperating agents

When you upload a listing data sheet, the listing agent’s business contact details (name, brokerage, phone and email) may be filed automatically as a contact in your records. This is business contact information of a licensee and is treated accordingly under applicable privacy law.

Video meeting rooms

Meetings are peer-to-peer: video and audio stream directly between participants where possible, and are not recorded or stored by us. Genesis Arc does not record meetings. Chat messages travel directly between participants and are not stored by us. Tiny connection notes used to establish the call are held with short automatic expiry. If a participant asks ARIA to translate or explain text or a selected clause image, that content is sent to the AI provider to produce the answer and is not retained by us. If the agent saves a marked-up contract to their app, the file is held on our hosting for up to 7 days for delivery, then removed.

Video messages

You can record a short video (camera or screen) and send it by email or text. The video file is stored in your own Google Drive and shared by an unlisted link, which means anyone who has the link can view it, so you should not include sensitive personal information in a video message; our infrastructure keeps only an index (video id, title and the client it was for) and play events (opened, played, how much was watched, the timestamp and the viewer’s browser type) so you can see engagement. The play page we serve shows your name, brand and contact buttons, sets no cookies, and notes that the sender can see whether and how much of the video was viewed. Viewers are not identified beyond the link they clicked.

Member intercom

Realtors on the platform can message one another, place video calls and send files directly to other members. Messages and calls connect between members, and files transfer from the sender’s Google Drive to the recipient — we do not keep copies of the files exchanged. As with meeting rooms, only tiny connection notes used to establish a call are held with short automatic expiry. Where a file or message contains client personal information, the member sending it is responsible for having the authority and any consent needed to share it.

Facebook Page and Instagram messages (Messenger & Instagram inbox) — optional

If you connect your Facebook business Page (and the Instagram professional account linked to it) through Meta’s login for business, we receive the messages people send to that Page or account and show them to you in the Service so you can reply from one place. To do this we store, on our infrastructure, the Page access token Meta issues to us for your Page, the id and name of the Page and Instagram account, the messages and any photos exchanged, and the sender’s name, username and profile picture as provided by Meta. Replies are sent only when you press Send (or when you send a photo or one of your listings from the thread); the assistant may draft a reply for you but never sends one. Photos you send from the Service are held on our hosting for up to 7 days so Meta can deliver them. We do not read any other content on your Page or account, post on your behalf from this feature, or use these messages for advertising. Disconnecting the Page in Settings deletes the stored token and stops delivery. Where a message contains a client’s personal information, you remain the organization responsible for that information as described in Section 6. Meta’s own handling of Messenger and Instagram is governed by Meta’s privacy policy.

Transaction desk

When two members negotiate through the transaction desk — sending an offer, confirming receipt, indicating whether it is a multiple-offer situation, exchanging counters, and collapsing a deal with a release — we keep a timestamped log of who did what and when, stored on our infrastructure, so there is a reliable compliance record. The log records the actions and their timestamps; the underlying contract documents remain in the members’ own records. Because this is a transaction and compliance record, we retain the log for seven years, consistent with brokerage record-keeping requirements. Members remain responsible for their own regulatory obligations, including any multiple-offer disclosure required by their board or BCFSA and the correct release form for a collapsed deal.

Your branding

To send branded emails and serve branded pages, your business branding (colours, logo, headshot, name, brokerage and email signature) is stored on our infrastructure. This is your own business information, not client data.

Member verification

To confirm that an account belongs to a licensed real estate professional before board or MLS® data is shown, we verify licence numbers and check real estate board membership rosters. Roster information is used only to verify eligibility and to administer access to board data.

MLS® and market data

Under agreements with the real estate boards we partner with, we process MLS® listing and sold-data history and store it on our infrastructure to generate market statistics and comparative reports. This data is handled in accordance with the applicable board’s or licensor’s rules.

De-identified and aggregated data

We may create and use de-identified or aggregated data — for example, aggregate usage and reporting statistics — that does not identify any individual, to operate, secure, analyze and improve the Service. We do not attempt to re-identify data we have de-identified.

Beta testing and our access

During any beta period, participating agents use the Service with their own client data. We operate an automated test account that runs only on synthetic data, and an internal owner portal that shows aggregate usage and reporting; we do not access any individual agent’s client records through it.

Automated processing and AI

Several features use AI to draft, summarize, read, translate and edit content — including client-facing messages, call summaries and website copy. AI is used to assist you and does not make decisions that produce legal or similarly significant effects about any individual without your involvement: you review AI outputs, and you approve outbound client messages before they are sent. Content sent to the AI provider is processed only to generate the output you request and, under our or your agreements with the AI provider (depending on whose account is used), is not used to train the provider’s models.

4. Legal Basis and Consent

Genesis Arc collects, uses and discloses personal information on the basis of consent, except where collection, use or disclosure without consent is permitted or required by law. By using the Service, or by providing information through a feature we host (such as an agent website form or an open-house sign-in page), you consent to the collection, use and disclosure of your personal information for the purposes described in this policy. Depending on the sensitivity of the information and the circumstances, consent may be express or implied; where we rely on express consent — for example, an unticked consent box for future contact, or the recording announcement played before a call — we obtain it at the point of collection.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. We will explain the likely impact before you do so, as withdrawing consent may limit or end our ability to provide certain features. Where an agent uses the Service to handle information about their own clients, the agent is responsible for obtaining and maintaining any consent those clients must give, as described in the section on your clients’ information below.

5. Service Providers, Disclosure and International Transfers

We rely on a limited number of trusted service providers (in privacy terms, our “service providers” or processors) to deliver the Service. Each is engaged under a contract that requires them to use personal information only to provide services to us, to protect it with appropriate safeguards, and to act on our instructions. The list below sets out our current providers, their primary processing locations and the purposes for which they process personal information. We may add or replace subprocessors as the Service evolves; a current subprocessor list is available at genesisarc.ca/service-providers, and where required by law we will provide notice of material changes before they take effect.

For your account information and the data our hosted features store on our infrastructure, Genesis Arc is the organization responsible (the controller). For the client information an agent manages using the Service, the agent is the responsible organization and Genesis Arc acts only as the agent’s service provider (processor) on the agent’s instructions, as described in the “Your Clients’ Information — Roles” section below.

The service provider list as of the date this Privacy Policy was last updated, including the locations where data is processed and the purposes for which it is used, is set out below:

Google (Canada / United States) - Google sign-in, Drive storage in your own account, and Calendar free/busy availability.

Cloudflare (Canada / United States) — Hosting, networking, short-lived operational storage, and speech-to-text transcription.

Anthropic (United States) — AI processing (drafting, reading, translation, receptionist responses and call summaries).

Twilio (United States) — Your business phone line, texting and call recording (your own Twilio account).

BoldSign by Syncfusion (Canada) — Genesis Sign electronic signatures: the documents you send for signature, signer names and email addresses, signing activity and the completion certificate.

ElevenLabs (United States) — ARIA's voice (text-to-speech) and live conversation audio when you talk to ARIA or the receptionist answers your line.

DocuSign (United States) — Electronic signatures, download-and-send only.

Resend (United States) - Transactional and outbound email delivery.

Meta Platforms (United States / Ireland) — Messenger and Instagram message delivery for a Facebook Page or Instagram account you choose to connect.

Stripe (Canada / United States) — Subscription billing (customer id, subscription id, plan, billing email, and card brand and last four digits; no full card numbers).

These providers process data in Canada and the United States. We remain accountable for personal information handled by our service providers and require them by contract to protect it with safeguards comparable to those we apply, including data-processing terms and standard contractual clauses where appropriate. Where personal information is processed outside Canada, it is subject to the laws of those jurisdictions and may be accessible to courts, law enforcement and authorities there; by using the Service you consent to this transfer. We choose providers with strong security practices and use them only for the purposes above.

We may transfer personal information to a third party as part of, or in connection with, a corporate transaction such as a financing, reorganization, merger, acquisition, or sale of all or part of our business or assets, including during due diligence for such a transaction. We will require the recipient to protect the personal information in a manner consistent with this policy and applicable law, and we will notify affected users where required.

6. Your Clients’ Information — Roles

Agents use Genesis Arc to manage information about their own clients. For that information, the agent is the organization responsible under privacy law, and Genesis Arc acts as the agent’s service provider (processor) on the agent’s instructions. Agents are responsible for collecting client information lawfully and with appropriate consent. Agents are also responsible for the privacy, confidentiality and security of their client records and personal information, for their CASL and anti-spam compliance, and for their professional, civil, regulatory and other legal obligations. Indemnification and limitation-of-liability terms that apply to this allocation of responsibility are set out in the Terms of Service. If you are a client of an agent who uses Genesis Arc and want to access or correct your information, contact your agent — we will assist them with any such request.

Assistants

A realtor may invite an assistant into their workspace. The assistant signs in with their own Google account and can access only the client information and features the realtor chooses to share, including through the realtor’s sharing of their Genesis Arc Google Drive folder. An assistant acts for and under the direction of the realtor who invited them; the realtor remains the organization responsible for their client information and for the assistant’s access to and use of it. Genesis Arc does not charge for assistant access and does not control what a realtor shares with an assistant. The realtor may limit or revoke an assistant’s access at any time.

7. Retention

We keep personal information only as long as necessary for the purposes described in this policy or as required by law, after which we delete or de-identify it. Specific retention periods include:

Your business content: stored in your Google Drive and on your devices — you control it.

Website form submissions: held on our hosting only until your app collects them, and in no event longer than 30 days, after which uncollected submissions are deleted.

Receptionist operational memory: short rolling windows with automatic expiry.

Meeting connection notes: 24 hours. Meeting rooms: expire in 24 hours. Saved meeting documents: up to 7 days.

Published website content: until you unpublish or close your account.

Call transcripts and summaries from calls you place: kept in your app records until you delete them, and in any event no longer than 24 months; the audio recording is deleted after transcription unless you choose to keep it.

ARIA Care roster and message drafts/history: kept in your records until you remove a client or close your account, and in any event no longer than 24 months after a client is last contacted through the feature.

Email campaigns (content, recipients, consent basis, open and click events): kept in your account until you delete the campaign or close your account, and in any event no longer than 24 months after sending; unsubscribe and bounce records are kept for as long as needed to honour them.

Video-message indexes and play events: kept until you delete the video or close your account.

Consumer search accounts and saved searches: kept until you delete your account or ask us to remove them.

Member-verification records: kept while your account is active and as needed to administer board-data access.

MLS® and market data: retained in accordance with our board and licensor agreements.

Messenger and Instagram conversations: conversations not linked to a contact are deleted 90 days after the last message; conversations you link to a contact are kept up to 12 months on our hosting (and in your own records until you delete them). Photos sent from the Service: 7 days. Page access tokens: until you disconnect the Page or close your account.

Additional sending addresses: until you remove them or close your account.

Transaction desk log: kept for seven years, consistent with brokerage record-keeping requirements under the Real Estate Services Rules.

8. Security

All traffic is encrypted in transit (TLS) and data stored on our infrastructure is encrypted at rest. Access tokens are scoped as narrowly as the platforms allow. The app includes on-device protections such as the Privacy Screen (blur + PIN) and kiosk PIN-locking for open-house devices. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify affected users and authorities as required by law, and we will maintain records of any such breach as required.

9. Your Rights

You may request access to, or correction of, personal information under our control, request a copy or export of your data in a structured, commonly used, machine-readable format where technically feasible, and withdraw consent (which may limit what the Service can do for you-we will explain the likely impact so you can make an informed decision). Because your business content is in your own Drive, most access is immediate and self-serve. When you make a request, we may need to verify your identity before we act on it, and we will respond within the time required by applicable law, generally within 30 days, letting you know if we require additional time. In limited circumstances we may be unable to fulfil a request-for example, where doing so would reveal another individual’s personal information or where an exception under applicable law applies-and we will explain the reason where permitted. To exercise rights or make a complaint, contact [email protected]. You may also contact the Office of the Information and Privacy Commissioner for BC or the Office of the Privacy Commissioner of Canada.

10. Children

The Service is for licensed professionals and business use; it is not directed to anyone under 19, and we do not knowingly collect information from minors.

11. Changes

We may update this policy as the Service evolves. Material changes will be reflected in the “Last updated” date and, where practical, an in-app notice. Where a change materially affects your rights or how we use your personal information, we will provide notice and, where required by applicable law, obtain your express consent before the change takes effect. Continued use after changes take effect means you accept the updated policy.

12. Contact Us

If you have questions about this policy, wish to exercise your privacy rights, or would like to make a complaint, contact our Privacy Officer at [email protected].

Agent Website Privacy Notice (short form)

This notice is displayed on agent websites and open-house sign-in pages hosted through Genesis Arc. Bracketed fields are completed for each agent.

This site is operated by [Agent Name], a licensed real estate professional, using technology provided by Genesis Arc Technologies Inc. When you submit a form or sign in at an open house, [Agent Name] collects the details you provide — such as your name, contact information and message — to respond to you and provide real estate services. Genesis Arc hosts this page and briefly processes your submission on the agent’s behalf before delivering it to the agent; Genesis Arc does not use it for its own purposes. If you leave feedback at an open house, it may be shared with the property’s seller in a report; your name is not included unless you consent.

Where you consent, [Agent Name] may contact you by email or text with marketing messages and updates about listings and real estate services, and you can unsubscribe or reply STOP at any time. To access or correct your information, or to withdraw consent, contact [Agent Name] at [agent email]. For more detail on how information is handled, see the Genesis Arc Privacy Policy at genesisarc.ca/privacy.