Privacy Policy

braelyn is operated by L&P Marketing Inc. ("braelyn", "we", "us", "our"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. If you have questions, email hey@braelyn.co.

1. Information We Collect

We collect the following categories of information when you use braelyn:

• Account information: your name, email address, phone number, brokerage, and (if provided) team name.
• MLS board credentials: your MLS login ID and password. These are encrypted with AES-256-GCM at rest and are used only to authenticate against your board's system on your behalf.
• CREA Agent ID: to match you to your active listings via the DDF (Data Distribution Facility) feed.
• Google OAuth data: if you sign in with Google, your name, email, and profile picture URL.
• Telegram chat ID: if you link Telegram, the numeric chat identifier used to deliver messages to you.
• Listing data: details of your active and historical listings synchronized from CREA/DDF and your MLS board.
• Seller contact information: names, email addresses, and any notes you associate with sellers you add to the platform.
• Realtor.ca stats: if you forward Realtor.ca stats emails to your braelyn address, the property view/lead metrics contained in those emails.
• Expense and receipt data: receipt photos, extracted vendor names, dates, amounts, and categories you assign.
• Usage analytics: which tools you use, tool run counts, and error rates. Used to improve the service.
• Technical data: IP address, browser type, device type, and operating system for security and abuse prevention.

2. How We Use Information

• Provide the braelyn service, including access to your account and the tools within it.
• Generate CMAs, property reports, and market intelligence outputs.
• Sync your listings via CREA/DDF and keep them current.
• Send seller reports and communications on your behalf, per the mode you have selected (concierge or auto-pilot).
• Process your expenses and produce exports for tax/accounting purposes.
• Communicate with you via Telegram and email about your account and the service.
• Process payments through Stripe.
• Detect abuse, prevent fraud, and secure the service.
• Improve the product — including aggregate, non-identifying usage analysis.

3. Data Storage & Security

• Hosting: data is hosted on DigitalOcean infrastructure located in Canada.
• Database: PostgreSQL, encrypted at rest.
• MLS credentials: encrypted with AES-256-GCM using a key that is not stored alongside the ciphertext.
• Magic links: single-use, time-limited tokens for seller portal access. Expired tokens cannot be reused.
• Server access: SSH key-based authentication only; no password login.
• Backups: encrypted daily backups retained for 90 days.

4. Third-Party Services

We share the minimum information necessary with the following processors:

• Stripe — subscription billing and payment processing.
• SendGrid — outbound email delivery.
• Telegram — messaging channel for notifications and the conversational assistant.
• Google — OAuth sign-in (if you choose to use it).
• Anthropic — AI processing of your prompts and data returned to those prompts. Your data is not used to train Anthropic's models.
• DigitalOcean — hosting and infrastructure.
• CREA / DDF — listing data retrieval, authenticated with your credentials.

5. Seller Data

Sellers do not create accounts. You (the agent) add sellers on their behalf. Sellers access their portal only via single-use magic links you send them, and their data belongs to you. When you remove a seller or cancel your account, that seller's data is deleted along with your account per Section 7.

You are responsible for obtaining a seller's consent before adding them to the platform. See our Terms of Service for details.

6. Cookies

• Session cookies — used only to keep you signed in.
• No third-party tracking cookies.
• No advertising cookies.

7. Data Retention

• Active accounts: data is retained for as long as your subscription is active.
• Cancelled accounts: deleted within 30 days of cancellation, subject to the exception below.
• Expense records: retained per Canada Revenue Agency requirements (currently 7 years) unless you specifically request earlier deletion.
• Backups: automated encrypted backups are retained for 90 days and then purged.

8. MLS Credentials

Your MLS credentials are stored solely to provide the service. They are encrypted at rest with AES-256-GCM, are never transmitted to third parties, and you can delete them at any time from your portal settings. Deleting your credentials will disable features that rely on them (listing sync, MLS lookups) but will not delete other data.

9. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal information (subject to the retention exceptions in Section 7).
• Export your data in a machine-readable format.
• Withdraw consent for optional processing at any time.
• Lodge a complaint with the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

10. PIPEDA Compliance

braelyn is a Canadian service and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

11. Children

braelyn is not intended for anyone under 18 years of age. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 30 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

13. Contact