Exetto — Privacy Policy

Introduction

Ragas Enterprises Inc. (“Company,” “we,” “us,” or “our”) respects your privacy and is committed to protecting it by complying with this policy. Ragas Enterprises Inc. operates the Exetto web application available at exetto.com and exetto.ca (the “Service”).

This policy describes how we collect, use, disclose, and protect the personal information of our users (“you”), the types of information we collect from you or that you provide when you use the Service, and our practices for collecting, using, maintaining, protecting, and disclosing that information.

Exetto handles documents about homes. Those documents are unusually revealing: they describe the condition of a specific address, and they routinely contain personal information about people who are not users of the Service, such as the current owner. We have written this policy, and built the Service, with that in mind.

Privacy laws in Canada — including the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Québec’s Act respecting the protection of personal information in the private sector (the “Québec Privacy Act,” as amended by Law 25) — generally define “personal information” as information about an identifiable individual. This policy applies to information we collect, use, or disclose about you on the Service and in email and other electronic messages between you and us.

The Service integrates certain third-party providers that process data on our behalf, described below. Those providers act as our service providers under this policy. The Service may also contain links to third-party websites we do not control; this policy does not apply to those websites.

Please read this policy carefully. By accessing or using the Service, you indicate that you understand and accept the practices described in this policy. If you do not agree, your choice is not to use the Service. We will notify you in advance of any material changes and, where required by law, obtain your consent to any new ways in which we collect, use, or disclose your personal information.

Information we collect about you

We collect and use the following types of information:

• Account information. You may create an account either by signing in with Google (via Google OAuth) or with an email address and a password. If you sign in with Google, we receive from Google, and store, basic profile information such as your name, email address, profile picture, and Google account identifier; we do not receive or store your Google password. If you use an email address and a password, we store your address and your name, and the password itself is held by our authentication provider in hashed form — we never see it. Where the same email address is used for both, they are the same account.
• Documents you upload. You may upload documents relating to a property you are considering — building inspection reports, sellers’ declarations, certificates of location, and similar material. These documents commonly identify a specific property and describe its condition in detail, and they frequently contain personal information about people other than you.
• Property details you enter, such as the address of a property and any nickname you give it. As you type an address we send what you have typed to Google Maps Platform to suggest matching addresses. If you choose one of those suggestions, we also receive from Google and store the address's place identifier, its latitude and longitude, and its city, province and postal code. If you type an address without choosing a suggestion, we store only what you typed.
• Contact details for the advisors you add to your team. When you build a team — your broker, your inspector, your notary — we store the name, firm, email address and role you give us for each of them, so that we can send your invitation and show you who can see which property.
• Questions, answers and professional views. When you ask an advisor about a finding, or an advisor records a view on one, we store what was written, who wrote it, when, and a copy of the finding as it read at that moment. Each exchange is private between the two of you unless you choose to show it to somebody else on the same property.
• Professional details you declare about yourself. If you tell us you use Exetto for professional work, we store the profession you choose, the place you say you practise in, the firm or agency you name, the licensing body and licence number you give, any professional association and membership number you give, the exact wording of the attestation you accept, and the date you accepted it. These details are shown to the people who share a property with you, so that they can check them for themselves. You can change or withdraw the declaration at any time, and withdrawing it deletes the licence details and the attestation.
• Findings produced from your documents, including their text, severity, and the pages of your document they refer to.
• Correspondence. Records and copies of your correspondence with us if you contact us for support or other purposes. This is handled in our customer-relationship system, HubSpot.
• Technical information, including your login information, browser type and version, time zone setting, operating system and platform, and information about your internet connection and the device you use to access the Service.
• Usage information, including details of your visits to the Service, pages and features you access, and the dates and times of your interactions. We use this to operate and secure the Service.

We may use the information we hold about you and about the properties you follow to select and present advertising and offers, including offers from third parties such as insurers and mortgage lenders. We do not disclose your personal information to those third parties for their own marketing purposes without your express consent.

A note about information about other people

The documents you upload will usually contain personal information about people other than you — most often the current owner, who signs a seller’s declaration, and the professionals who prepared the document, such as an inspector, a surveyor, or a notary.

By uploading a document, you represent that you received it lawfully in the course of considering a property, that you are authorized to provide it to us for processing in connection with your use of the Service, and that you will, where required, inform those individuals of this policy.

The same applies to the team you build. When you add an advisor, you are giving us that person’s contact details, and by doing so you represent that you are entitled to provide them to us and to invite that person to see a property you choose to share with them. We use those details only to send the invitation and to show you who is on your team; we do not use them to market anything to that person.

How we collect information about you

We collect information through:

• Direct interactions, when you provide it — for example, by signing in, uploading a document, entering property details, or corresponding with us.
• Our authentication provider (Google), when you choose to sign in with Google.
• Automated technologies, as you navigate the Service, including information collected through cookies and similar technologies used to keep you signed in and to operate the Service.

Cookies and similar technologies

We use two categories of cookies and similar technologies (including browser local storage and session tokens):

• Strictly necessary technologies, which are required to operate the Service — principally to authenticate you, maintain your session, keep the Service secure, and remember your language preference.
• Analytics technologies, which help us understand how the Service is used so that we can improve it. We use Google Analytics and HubSpot for this purpose. Both set cookies and collect information such as your device and browser type, pages viewed, and interactions with the Service, and may collect information about your use of the Service over time and across the pages of the Service. We use these analytics to measure and improve the Service.

We do not currently use advertising cookies or third-party behavioural-advertising networks. If we add any, they will be described here and subject to your consent.

You can set your browser to refuse some or all cookies or to alert you when cookies are being set. If you disable strictly necessary cookies, you may be unable to sign in or use core parts of the Service. You may also opt out of Google Analytics by installing Google's opt-out browser add-on, or decline analytics technologies altogether using the cookie control offered on the Service — withdrawing consent there also deletes the cookies these tools have already set. We honour applicable consent requirements for analytics technologies in Québec and elsewhere before activating them in your browser.

How we use your information

We use the information we collect, including personal information:

• To provide, operate, and maintain the Service and its features, including reading your documents and producing your briefing.
• To authenticate you and manage your account.
• To store your documents and findings and make them available to you.
• To notify you by email when a briefing is ready, or when a document could not be read.
• To respond to your requests and provide customer support.
• To secure the Service, prevent fraud and abuse, and protect the rights, property, and safety of the Company and our users.
• To improve the Service. Where we analyze usage to improve the Service, we use aggregated or de-identified information that does not identify you wherever practicable.
• To send you service-related communications, such as account, security, and material change notices.
• to select, present and measure advertising and offers that may interest you, based on your profile and the properties you follow;
• To comply with our legal obligations and enforce our agreements.
• For any other purpose disclosed to you at the time you provide the information, or with your consent.

We rely on your consent, and on the other legal bases permitted under applicable Canadian and Québec privacy law, to process your personal information for these purposes. You are asked to consent specifically, at the point of upload, before any document is sent for analysis.

How your documents are analyzed

This section describes the single most significant thing that happens to a document you upload, and we set it out separately for that reason.

Exetto reads your documents using an artificial-intelligence model operated by Anthropic, PBC. When you upload a document, its contents are transmitted to Anthropic’s commercial API, analyzed, and a structured result is returned to us and stored in your account. Anthropic acts as our service provider for this purpose and processes the document under its commercial terms, which provide that inputs submitted through the API are not used to train its models.

We keep the raw response from the model in an internal processing log, so that we can diagnose faults. That log is not readable by any user, including you: access to it is restricted at the database level to our own server processes, and it is never displayed in the Service. It is deleted when the document, the property, or your account is deleted.

The findings shown to you are generated automatically and may be incomplete or wrong. They are not a professional opinion. Our Terms of Use explain what they are and are not. Where an advisor has proposed a different classification or score for a finding and you have accepted it, that part of the finding is that person's judgement rather than the model's; the briefing says so, names them, and keeps the automatic reading beside it.

Our rights in your User Data

The information you submit to the Service — including the documents you upload and the property details you enter (your “User Data”) — is also licensed to us under our Terms of Use. Under that licence, you grant us and our affiliates, service providers, and their respective licensees, successors, and assigns a worldwide, royalty-free, perpetual, irrevocable, non-exclusive right to use, reproduce, modify, host, store, process, distribute, exploit, commercialize, and otherwise disclose to third parties your User Data, and to incorporate it into any form, medium, or technology, for any purpose and in accordance with your account settings, without compensation to you. Where your User Data contains personal information, our collection, use, and disclosure of that personal information is also governed by this policy and by applicable privacy law.

Property records, and what outlives your account

Exetto keeps, for each property and under its address, a record that is separate from your account and is not deleted when your account is.

The reason is that a house outlives each of its buyers. A 2021 inspection and a 2032 inspection describe the same building, and it is by keeping both that the Service can one day tell a future buyer what has been said about a house over time, rather than only what one report says about it today. A record attached to the last person who looked at it could not do that.

That record holds the address itself, in normalized form, together with the unit number and postal code where you provided them. Where the address was matched through Google Maps Platform, it also holds that match — the place identifier, the latitude and longitude, and the city and province. It also holds structured observations about the building drawn from uploaded documents — for example that a roof covering was recorded as near the end of its life in a given year. Those observations are factual statements about the building; they carry no document text, no names, and nothing that identifies you, and deleting your account leaves nothing in them that points back to you.

Those automatic observations carry no document text, no names, and nothing that identifies you. Separately, when you remove a property you may choose to leave its findings for a later buyer of the same home; those findings do carry the text written from your documents and the passages they quote, still with nothing that identifies you. That is a choice you make, never a default, and it is described under “Data retention”.

We may use and disclose these property records, including for commercial purposes.

If you believe a property record should not exist, contact our Privacy Officer.

Service providers

We disclose personal information to service providers who process data on our behalf, under contract and only for the purposes of operating the Service. Our service providers are:

• Google LLC — authentication (Google OAuth sign-in), address lookup and mapping (Google Maps Platform), and website analytics (Google Analytics).
• Supabase, Inc. — database, authentication infrastructure, and storage of the documents you upload.
• Anthropic, PBC — analysis of the documents you upload, as described above.
• Vercel Inc. — application hosting and delivery.
• Resend (Plus Five Five, Inc.) — transactional and service-related email delivery.
• HubSpot, Inc. — customer-relationship management, processing of the messages you send us, and website analytics.

These providers are contractually required to protect personal information, use it only for the purposes for which we disclose it, and apply protections consistent with this policy and applicable law.

Other disclosure of your information

We do not disclose your personal information to third parties for their own marketing purposes without your express consent. Apart from the service providers listed above, we may disclose personal information:

• To someone you invite. You may share a property with people you add to your team — typically your broker, your inspector or your notary. They see that property's findings and the documents you uploaded for it, and may comment on them. You choose who and which property, and you can withdraw access at any time. Nothing is shared unless you ask for it.
• To a later buyer of the same home, if you choose it. When you remove a property from your account you may choose to leave its findings behind for whoever looks at that address next. They see the findings and the passages quoted from your documents; they do not receive the documents themselves, which are erased, and nothing identifies you as their source. This happens only if you ask for it, and it cannot be undone afterwards.
• In connection with a business transaction, such as a merger, acquisition, financing, reorganization, or sale of assets, in accordance with applicable law, where personal information may be among the assets transferred. We will require the recipient to protect the information consistent with this policy.
• To comply with legal obligations, including in response to a court order, subpoena, law, or governmental or regulatory request, in accordance with applicable law.
• To protect rights and safety, where we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our users, or others, or to enforce our Terms of Use.
• With your consent, or as otherwise disclosed to you when you provide the information.

We may disclose aggregated or de-identified information that does not identify any individual without restriction.

Transferring your personal information (cross-border)

We and our service providers may store and process your personal information outside Québec and outside Canada, including in the United States. As a result, your personal information may be subject to the laws of those jurisdictions, and the governments, courts, law enforcement, or regulatory agencies of those jurisdictions may in certain circumstances be able to access it.

Before transferring personal information outside Québec, we assess the transfer as required under the Québec Privacy Act, and we require our service providers to provide protection for personal information that is adequate and consistent with applicable Canadian and Québec privacy legislation.

You are welcome to contact our Privacy Officer for more information about our practices regarding service providers located outside Québec or Canada.

Data security

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to protect your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure.

These measures include access rules enforced in the database itself, so that each user’s properties, documents, and findings are reachable only by that user; storage of uploaded documents in a private bucket that is not publicly readable and from which files are served only through short-lived links generated for you; and encryption of data in transit.

Access to your account data by our personnel is limited. Only a small number of authorized staff may access it, and only where necessary to operate, support, secure, or maintain the Service — for example, to resolve a support request or investigate abuse.

The safety and security of your information also depends on you. You are responsible for keeping your Google account and any access credentials secure, and for not sharing access to your account. Please notify us immediately of any unauthorized access to or use of your account.

Unfortunately, no method of transmission over the internet or electronic storage is completely secure. While we take reasonable measures to protect your personal information, we cannot guarantee its absolute security, and any transmission is at your own risk.

Confidentiality incidents (breach notification)

We maintain procedures to respond to confidentiality incidents (security breaches involving personal information). In accordance with the Québec Privacy Act and other applicable law, where a confidentiality incident presents a risk of serious injury, we will take reasonable measures to mitigate the risk, notify affected individuals and the Commission d’accès à l’information (and any other regulator, such as the Office of the Privacy Commissioner of Canada, where required), and maintain a register of confidentiality incidents as required by law.

Data retention

Except as otherwise permitted or required by applicable law, we retain your personal information only for as long as necessary to fulfill the purposes for which we collected it, including to provide the Service to you and to satisfy any legal, accounting, or reporting requirements.

Your documents and the findings produced from them are kept for as long as you keep the property in your account. When you remove a property, you choose what happens to it. If you choose to delete it, its documents are erased from our storage and its findings, its clusters and its processing logs are deleted from our database. If you instead choose to leave the findings for a later buyer of the same home, your documents are still erased and your account is detached from what remains, but the findings and clusters — including their text and the passages they quote from your documents — stay attached to the address and can be read by another account that later adds that same address. That choice cannot be reversed, because once the record is detached from your account there is no longer an owner to reverse it. Deleting your account deletes everything still attached to it, other than the exchanges described under “Questions and answers”. The property record described under “Property records” is separate from your account and is not deleted with it.

The internal processing log described above holds the raw output of the model. Its payload is erased thirty days after a document is read, whether or not you still keep the property, leaving only technical measurements about our own pipeline — whether the read succeeded, how long it took — that say nothing about you or your property. The whole record is deleted sooner if you delete the document, the property or your account.

When you delete your account, we remove your stored documents and delete or de-identify the personal information associated with your account from our live systems within 30 days. Questions, answers and professional views you exchanged with another person are an exception, described under “Questions and answers” below: they remain with the other party, still naming you, until nobody who took part in them has an account. The property record described above is not part of your account and remains, holding the address and nothing that identifies you. Residual copies may remain in our encrypted backups for up to 90 days following deletion, after which they are purged as backups cycle out in the ordinary course. These retention periods are subject to any legal retention obligations that require us to keep certain information longer.

An advisor’s contact details are kept for as long as that person remains on your team. When you remove them, their record is deleted and any access you had given them to your properties is withdrawn at the same time. Questions, answers and professional views exchanged with them are not deleted: they remain readable by you and by them, frozen so that neither of you can add to them, for the reason given under “Questions and answers” below.

Questions and answers

The Service lets you put a question to an advisor about a particular finding, and lets an advisor record a professional view on one. A view may include that advisor's own reading of the finding's classification and its two scores; if you accept it, the finding changes on your briefing, and both readings are kept. What is written is kept as a record of the exchange, and that record is treated differently from the rest of your information.

It is kept together with a copy of the finding as it read when the exchange took place. A finding's classification can change afterwards — if you accept an advisor's different reading of it — and a finding disappears with the document it came from. Advice given about one reading should not later appear beside a different one, or beside nothing at all.

It survives events that delete other things. Removing an advisor from a property does not delete it — it remains readable by both of you and is frozen, so neither can add to it afterwards. Deleting the property does not delete it. Deleting your account does not delete it from the other party, and it continues to name you, because a record of who gave advice is not a record if it cannot say who. It is deleted once no one who took part in it has an account with us.

Neither party can edit or delete what they have written. A correction is made by writing again.

If you believe such a record should not exist, contact our Privacy Officer.

Children

The Service is intended for adults and is not directed to, or intended for use by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, please contact our Privacy Officer and we will take appropriate steps to delete it.

Accessing and correcting your personal information; your rights

It is important that the personal information we hold about you is accurate and current. You have the right, under applicable law, to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Withdraw consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions (withdrawing consent may mean we can no longer provide the Service).
• Request deletion of your personal information, subject to our legal retention obligations.
• Data portability — where required by the Québec Privacy Act, request that computerized personal information you have provided to us be communicated to you in a structured, commonly used technology format.

You can review and update much of your information directly within the Service, and account deletion is offered on the Account page and takes effect immediately. You may also contact our Privacy Officer. We may request specific information to confirm your identity before responding. Applicable law may permit or require us to decline certain requests; if we do, we will explain why, subject to legal restrictions.

Withdrawing your consent

Where you have provided consent to the collection, use, or transfer of your personal information, you may withdraw it, subject to legal or contractual restrictions, by contacting our Privacy Officer. We will explain the likely consequences of withdrawal, which may include our inability to continue providing the Service.

Changes to our privacy policy

We post any changes to this policy on this page and update the “Last modified” date above. If we make material changes to how we treat your personal information, we will notify you by email to the address associated with your account and/or through a notice on the Service. You are responsible for keeping your contact information current and for reviewing this policy periodically.

Privacy Officer — contact information and challenging compliance

We welcome your questions, comments, and requests about this policy and our privacy practices. The person responsible for the protection of personal information (our “Privacy Officer”) within the meaning of the Québec Privacy Act can be reached at:

Constantinos Ragas, President (Privacy Officer)

privacy@exetto.com

We have procedures to receive and respond to complaints or inquiries about our handling of personal information and our compliance with this policy and applicable privacy laws. If you are not satisfied with our response, you may be entitled to bring a complaint to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.