CondoVitals Privacy Policy

Version: 2026-10-06

Who we are: CondoVitals is a service of Compass AI Group Inc., a registered corporation, which operates CondoVitals and is the organization accountable for your personal information under PIPEDA.

CondoVitals ("we," "us") reads the Ontario condominium status-certificate packages that buyers upload and turns them into plain-language findings reports. A status certificate is a sensitive financial document. This policy explains, following the ten fair-information principles of PIPEDA (the Personal Information Protection and Electronic Documents Act, Schedule 1), what we collect, why, what happens to it, and what your choices are.

The short version: you give express opt-in consent before every upload. We analyze your package, then delete the uploaded files (right after analysis, with a hard deletion sweep within 24 hours as the backstop). We keep the extracted findings so we can deliver and support your report, and delete them when you ask. Your documents are never used to train AI models. The only outside companies that touch your data are the processors listed below that we need to run the service.

Principle 1 — Accountability

Compass AI Group Inc., operating as CondoVitals, is responsible for personal information under its control, including information it transfers to processors.

• Privacy Officer: Privacy Officer, Compass AI Group Inc. (CondoVitals) · privacy@condovitals.ca. The Privacy Officer is accountable for this policy and handles access and correction requests, complaints, and breach response. The name of the individual is available on request.
• When a processor handles personal information on our behalf (see "Processors" below), we use contracts to require a comparable level of protection while the information is in the processor's hands.

Principle 2 — Identifying Purposes

We collect and use personal information only for these purposes, identified at or before collection:

1. Analyze your status-certificate package into a findings report — the core purpose. The documents are processed to extract and summarize what they disclose (reserve fund, special assessments, litigation, budget, insurance).
2. Deliver your report — showing it on screen through a private link and emailing it to you as a PDF.
3. Quality review — for expert-verified scans, and for scans where a figure could not be read with confidence, a CondoVitals reviewer checks the extracted findings before your report is finalized.
4. Process payments and refunds — through our payment processor.
5. Scan codes from realtors — when a realtor buys scan codes for clients, we email the codes to the realtor and tell them when a code has been used. The realtor never sees your documents or your report.
6. Free headline check — showing your headline result on screen. We keep the email address you give with it as a record of the check and do not send you marketing email without your separate consent.
7. Running and improving the service — first-party analytics and accuracy research (see "Cookies and Analytics" and Principle 5).
8. Legal obligations — records we must keep, such as payment records, consent records, and the breach log.

We do not use your information for a new purpose without first identifying it and asking for your consent.

Principle 3 — Consent

• Express, opt-in consent before upload. Because a status certificate is sensitive financial information, we do not rely on implied consent. Before any upload, including when you redeem a realtor's scan code, you see a plain-language consent statement and actively opt in. We record your consent with each scan, together with the date, your IP address, and the version of the wording you accepted.
• Realtor codes: the buyer who redeems a code gives their own consent. A realtor cannot consent on a buyer's behalf.
• No AI model training. Your uploaded documents and extracted findings are never used to train or fine-tune machine-learning models — not by us, and not by our AI provider (see "Processors").
• Withdrawal. You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by writing to privacy@condovitals.ca. We will explain any consequence (for example, we cannot produce a report without processing the document). Because uploaded files are already deleted after analysis, withdrawal after a scan applies to the retained findings, which we will delete except where the law requires us to keep a record.

Principle 4 — Limiting Collection

We collect only what the purposes above need:

• The documents you upload (the status-certificate package) — for analysis only.
• Contact details: your name and email address, collected at checkout or when you redeem a code. Buyers do not create accounts or passwords.
• Scan records: scan status, tier, timestamps, the documents' file names and page counts, consent version, and the extracted findings.
• Payment data: handled by our payment processor. We receive a payment confirmation and what we need for receipts and refunds, never full card numbers.
• Technical data: your IP address, recorded with your consent and with free headline checks (to evidence consent and enforce the daily free-check limit).
• First-party analytics events (see "Cookies and Analytics").

We do not buy data from data brokers or collect anything beyond what the scan needs.

Principle 5 — Limiting Use, Disclosure, and Retention

• Uploaded files are deleted right after analysis. A hard sweep permanently deletes any remaining uploaded files within 24 hours of upload, whether or not analysis succeeded. Files staged for upload but never submitted are deleted within 2 hours.
• Your report: the private report link works for 7 days. The PDF report is generated on request and emailed to you; we do not store a copy of the PDF.
• Extracted findings and scan records are kept so we can re-send your report, handle refunds and quality review, and answer questions. We delete them when you ask, except where the law requires us to keep a record.
• Building-level accuracy research: we keep building-level records derived from findings (for example, that a building's certificate disclosed a special assessment in a given year) and may later compare them with public outcomes to measure our accuracy. Anything we publish or share from this research describes buildings, not people, and never includes names, unit numbers, prices, or anything else that identifies you or your transaction.
• Disclosure: we do not sell or rent personal information. We disclose it only to the processors needed to run the service, when required by law, or with your consent (for example, when you choose to share your own report).
• Consent and payment records are kept as long as required for legal and audit purposes. The breach log is kept as described under "Breach Response".

Principle 6 — Accuracy

We keep personal information as accurate and complete as the purposes require. Automated document reading can misread figures, so the report marks low-confidence fields instead of guessing, and your original documents remain the authoritative source. You can ask us to correct your contact details or errors in your extracted findings (see Principle 9).

Principle 7 — Safeguards

Our safeguards match the sensitivity of status certificates:

• Encryption in transit (TLS) for all uploads and access, and encryption at rest for stored files and databases.
• Private storage and private links: uploaded files go to private storage that is not publicly reachable, and reports are reachable only through signed, expiring links.
• Access controls: access to findings is limited to what operating the service and quality review require. Staff sign-in is restricted.
• Deletion as a safeguard: because uploaded files are deleted right after analysis, the most sensitive item — your full document — exists on our systems for the shortest time possible.
• Processor safeguards are addressed by contract (see "Processors").

Principle 8 — Openness

This policy is public, written in plain language, and versioned. The consent wording shown at upload, the current policy version, and the Privacy Officer's contact details are on the site. Material changes are posted with a new version, and new consent is requested where a change involves a new purpose.

Principle 9 — Individual Access and Correction

On written request to privacy@condovitals.ca, we will tell you what personal information we hold about you, how it is used, and to whom it has been disclosed, and give you access to it — normally within 30 days and at no cost, subject to the limited exceptions PIPEDA allows (we will explain in writing any exception we rely on). If you show that information is inaccurate or incomplete, we will correct it and, where appropriate, pass the correction to third parties that have it. Because uploaded files are deleted after analysis, requests usually cover your contact details, scan records, findings, and consent records.

Principle 10 — Challenging Compliance

Questions or complaints about how we handle personal information go to the Privacy Officer at privacy@condovitals.ca. We investigate every complaint and, where justified, change our practices and this policy. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (OPC) — www.priv.gc.ca · 1-800-282-1376.

Processors (Companies That Process Data for Us)

Each processor is bound by contract to a comparable level of protection and used only for the stated purpose:

Cross-border note: some processors store or process data outside Canada, in the United States and the European Union. While there, your information is subject to those jurisdictions' laws, including lawful-access laws. We require comparable protection by contract, but a contract cannot override foreign law. Your consent at upload covers this processing.

Breach Response

• We maintain a breach-response plan owned by the Privacy Officer.
• If a breach of security safeguards creates a real risk of significant harm to anyone — assessed on the sensitivity of the information and the probability of misuse — we report it to the OPC and notify the affected people as soon as feasible, as PIPEDA requires.
• We keep a record of every breach of security safeguards, whether or not it meets that threshold, for 24 months, as PIPEDA requires.

Cookies and Analytics

Buyers do not need cookies to use CondoVitals; the only cookies we set are for staff sign-in. Analytics are first-party only: we count use of our own service (pages, the scan funnel, errors) with our own instrumentation. We do not use advertising trackers, cross-site tracking pixels, or social-media trackers, and analytics never include the content of your documents.

Children

The service is for adults involved in real-estate transactions and is not directed to children. We do not knowingly collect personal information from anyone under 18.

Changes to This Policy

Changes are posted here with a new version. Where a change involves a new purpose for information we already hold, we ask for your consent first.

Contact

Privacy Officer, Compass AI Group Inc. (CondoVitals): privacy@condovitals.ca
General support: support@condovitals.ca

CondoVitals is a service of Compass AI Group Inc.. CondoVitals is not a law firm and does not provide legal, financial, tax, or engineering advice. This is general information to help you understand your document. It is not a substitute for advice from a licensed lawyer or advisor. Always confirm anything important with your own professional before you act.