Privacy Policy

Effective October 18, 2026 (replaces the version of September 17) · Bliip Box Inc., doing business as TOP REAL ESTATE .AI

Plain-language summary (the full policy below governs): we collect what we need to run your account and the tools — your contact details, the documents and projects you put in, and payment status from Stripe. Documents you upload for AI extraction are processed by our AI provider and are not used to train models. We don't sell your information. You can see, correct or delete it by emailing us.

1. Scope and the law that applies

This policy explains how Bliip Box Inc. ("we", "us") handles personal information when you use toprealestate.ai and its subdomains, including the dashboard, APEX, Binder and Cliiqez (the "Services"). We are based in British Columbia and comply with the Personal Information Protection Act (BC) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and anti-spam law (CASL). If you are outside Canada, additional rights may apply to you and we will honour them where the law requires.

2. What we collect

Information you give us

Account: email address; name, phone number, business address and profile photo if you add them for branded outputs; your saved signature and initials if you create them in Binder.
Your content: documents, images and PDFs you upload; pro forma inputs and saved projects; Binders, transcripts and markups; links you save in Cliiqez; and anything you choose to share.
Contacts you upload: names, emails, phone numbers, companies and notes in contact lists you upload to Email Depo or import into Duez, and follow-ups you schedule. You are responsible for having the authority to upload them.
FUN prospect and identification records: contact details you save in FUN, and, if you choose to scan a prospect's government-issued ID, the data read from it (document type, number, issuer, expiry, date of birth) and an encrypted copy of the image. We hold them for you and only you can open them.
Contact form and newsletter: first name, last name, email, phone number, your message, and whether you consented to receive our newsletter and promotions. Sending a message is voluntary: we use these details to reply, and we do not add you to our newsletter unless you opt in.
Member profile: if you claim a public profile, the details you choose to publish — name, brokerage, photo, areas, languages, specialization, sales figures and awards you choose to show, social links, and the office address and contact details you add — are public at toprealestate.ai/your-handle and can be saved by visitors as a contact card. Your licence number, regulator and member board are collected only to verify you and are never shown publicly.
Brochure viewers: when someone opens a private brochure that requires a Confidentiality Acknowledgement, we collect their first name, last name, business email and brokerage, and record their acknowledgement against the shared link with the date and time. We email them a copy and a time-limited access password.
TOP AI: the questions you ask TOP AI and its answers, stored with your account.
Location and addresses: if you allow your device’s location when you scan in FUN, your device’s coordinates are sent to Photon, a public address-lookup service operated by Komoot using OpenStreetMap data, to find the nearest street address; we store only the address text you save with the contact, not the coordinates. Address fields in our forms and tools send what you type to the same service to suggest addresses.

Information collected automatically

Usage and device data: pages and tools used, actions taken, approximate location from IP address, browser and device type, and error logs. We use this to run and improve the Services and to prevent abuse (for example, rate-limiting AI extraction).
Invitation pages: when you open our invitation or registration pages we count the visit anonymously, using a random ID stored in your browser, so we can see which invitation links are used. We do not store your name or IP address with these visits.
Cookies and similar storage: a sign-in session cookie shared across our subdomains so you stay signed in; local storage for preferences such as light/dark mode and unsaved work in the browser. We do not use third-party advertising cookies.
Bot protection: our contact forms use Cloudflare Turnstile to block automated abuse; Cloudflare receives your IP address and browser signals to decide whether you are a person.

Information from others

Stripe: subscription status, plan, and a customer identifier. Stripe holds your card details; we never see or store your card number.
Google or other sign-in providers: your email address and basic profile (name, photo) when you choose to sign in with them.

3. Why we use it

To create and secure your account, sign you in across our tools, and remember your preferences.
To provide the tools: run AI extraction on documents you upload, compute pro formas, generate brochures and PDFs, host Binders and links you share, and send transactional email (sign-in codes, share notifications, receipts).
To bill Pro subscriptions and detect fraud.
To respond to your messages and support requests.
To publish your profile if you claim one, show a verified check once we have checked your licence details, and let TOP AI name verified members when someone asks for an agent in an area.
To send you reminders for follow-ups you schedule in FUN.
To send our newsletter and promotions — only if you opted in, and you can opt out at any time.
To understand how the Services are used, fix problems, and improve them — including improving TOP AI for all members, as described in section 4.
To meet legal obligations and enforce our Terms.

We rely on your consent (which you give by using the Services, by opting in, or as the law implies for obvious purposes), on the need to perform our contract with you, and on purposes a reasonable person would consider appropriate.

4. AI processing of your documents

When you use AI extraction or transcription, the document or image you upload is sent to our AI provider (Anthropic) to read the stated values and return them to you. Under our agreement with them, that content is used only to provide the response to you and is not used to train their models. Questions you ask TOP AI, and its answers, are also sent to our AI provider and stored with your account. We keep everything TOP AI reads from a document (not only the values placed into fields) and the corrections you make, stored with your account, so nothing you enter is lost and so TOP AI improves for all members. What we learn from this is how to read documents and which details matter; we never show your documents, your projects or your clients’ details to other members, and we never sell them.

5. Who we share it with

We do not sell personal information. We share it only with service providers who process it for us under contract, and only as needed to run the Services:

Supabase — database, authentication and file storage.
Vercel — web hosting and serverless functions.
Anthropic — AI extraction and transcription (see section 4).
Stripe — subscription billing.
Resend — sending our email.
Cloudflare — bot protection (Turnstile) on our contact forms.
Photon (Komoot, using OpenStreetMap data) — address suggestions and the FUN “Met at” address lookup.
Google — optional sign-in, fonts, and, in Cliiqez, retrieving site icons for links you save.

We may also disclose information when the law requires it, to protect our rights or safety, or to a successor if our business is sold. People you share a Binder, brochure or link with will see what you shared, including your name and contact details if you include them.

6. Where your information is stored

Our providers operate data centres in Canada, the United States and elsewhere. Your information may be stored and processed outside British Columbia and outside Canada, where it is subject to the laws of those jurisdictions. We choose providers with strong security commitments and contractual privacy protections. Questions about our cross-border handling can be sent to the contact below.

7. How long we keep it

Account and content: for as long as your account is open. When you delete content or close your account, we delete it within 30 days, and it leaves routine backups within a further 30 days.
Billing records: as long as tax and accounting law require (generally seven years).
FUN identification records (scanned ID data and the encrypted image): five years from the date the record was created, which is the retention period the PCMLTF Regulations set for real estate brokers and sales representatives, unless you delete the record sooner. Business-card scans are ordinary contact data and follow the account rule above.
Public profile: until you hide it or close your account.
Contact-form messages: up to two years, so we can follow up.
Newsletter consent records: for as long as you are subscribed, plus a record of your unsubscribe as CASL requires.
Logs: up to 90 days.

8. Security

We protect information with encryption in transit (HTTPS), encryption at rest at our storage providers, row-level access controls in our database so each account sees only its own data, signed and time-limited share links where used, secret-key verification on payment webhooks, and access limited to people who need it. No system is perfectly secure; if we learn of a breach that creates a real risk of significant harm, we will notify you and the Privacy Commissioner as the law requires.

9. Your rights and choices

Access and correction: you can see and change your profile in the dashboard, or email us to request a copy of the personal information we hold about you and to correct it.
Deletion: delete individual projects, Binders and links in the tools, or email us to close your account.
Withdraw consent: you may withdraw consent at any time, subject to legal or contractual limits; withdrawing consent to essential processing may mean we can no longer provide the Services.
Public profile: you can hide or show your page at any time from your profile.
Marketing: every newsletter or promotional email includes an unsubscribe link, and you can email us to opt out. Transactional emails (sign-in codes, receipts, share notifications) continue while you have an account.
Complaints: contact our privacy officer first (below). If you are not satisfied, you may complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

10. Children

The Services are for real estate professionals and adults. We do not knowingly collect information from anyone under 19. If you believe a minor has provided information, email us and we will delete it.

11. Changes

We may update this policy. Material changes will be emailed to account holders and posted here with a new effective date before they take effect.

12. Contact / privacy officer

Privacy Officer, Bliip Box Inc. · TOP REAL ESTATE .AI · #101 – 5701 Granville Street, Vancouver, BC V6M 4J7, Canada · Oracle@TopRealEstate.Ai · Contact form