Privacy Policy

Version 3 · effective September 5, 2026

Privacy Policy

This policy explains what personal information Realty Studios collects, why, who we share it with, where we keep it, and how to get a copy, correct it or have it deleted. In short: we collect what we need to photograph a property, deliver the files, invoice you and support your account. We do not sell personal information. Our database and file storage are hosted in the United States, explained below. You can ask us for your data, or ask us to delete it, at any time at /privacy-request, and we will answer within 30 days.

Effective date: September 3, 2026.

Who we are

Realty Studios is the operating name of VLGRS Inc., incorporated federally in Canada under the Canada Business Corporations Act and operating in British Columbia. We are a real-estate photography and listing-media studio, and we license our booking and delivery software to other photography studios.

For privacy questions, and to reach the person accountable for privacy here, email info@realtystudios.ca or call +1 (604) 779-4089. We are in Vancouver, British Columbia, Canada. This policy meets the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

When another studio uses our software to serve its own customers, that studio decides what to collect and why, and we handle it on the studio's behalf under its instructions. Those customers should read that studio's own privacy policy first.

What we collect

When you book a shoot. Your name, email, phone number, brokerage and listing-agent name. Optionally, a second email so an assistant or coordinator receives confirmations, a co-listing agent's email so they receive the confirmation and the finished photos, your preferred language and contact time, and an answer to "how did you hear about us?" that you may decline. About the property: the address, city, the map pin you confirm, interior square footage, property type, and details such as bedrooms, bathrooms, year built and MLS number. About the shoot: your chosen date and slot, any custom time you request in your own words, and notes on access, parking or pets. About the order: the services, the totals, your payment choice, and any discount or referral code. Your studio may add its own checkout questions, and your answers are stored with the order. We also read the network (IP) address a booking arrives from and keep it as a rate-limiting record, so one source cannot flood our booking system — abuse prevention, not profiling. Booking also creates a customer portal account using the email you gave us.

In your portal. You sign in with a one-time email link or a passkey. The portal holds your orders, deliverables, invoices, listings, documents, messages, notifications, calendar and saved payment methods; card details stay with our payment processor.

When you sign up a studio. Business name, email and a password. The password goes straight to our authentication provider, which stores only a cryptographic hash — our signup function never receives it.

In the chat widget. The conversation and the session key that groups it. A name, email or phone number you give is stored as a lead, with a short excerpt of the recent conversation and the website it happened on. Attachments are stored privately and opened only through short-lived links.

On our forms. Quote and callback requests, brokerage enquiries, newsletter sign-ups, rush and rate-card requests, open-house RSVPs, listing enquiries and support tickets collect what is on the form — usually a name, an email, sometimes a phone number, and what you write. Job applications collect the details and résumé you submit, held in private storage; a consent box is required, and you can ask us to delete the application at any time.

On listing pages we host. Branded listing pages count page views, photo opens, gallery scrolls, contact clicks, booking clicks, shares and QR scans, so the listing agent can see how the property is performing. A banner asks you to choose "Essentials only" or "Accept"; "Accept" also sets a cookie lasting up to a year and allows that visit to be counted in a retargeting audience the listing agent can build from listing-page activity. We do not store your raw network address here — the identifier grouping one day's activity is a one-way salted hash that changes daily. A browser sending Do Not Track is treated as "Essentials only" and sees no banner, and unbranded, MLS-safe listing pages carry no banner.

When you make a privacy request. Your email, the request type, an optional reason, and technical details such as your browser's user-agent string and, on one of our request endpoints, a shortened record of the network address it came from.

Our measurement script

We provide a measurement script that counts page views and shows which pages people find useful. Clients embed it on their own websites, and we may use it on our own site, so it may run on our site or on theirs. It does not set cookies, does not store your IP address, and is not shared with advertising networks. The page views it records do not identify you: the page addresses we keep are stripped of everything after the page path except campaign tags, and the identifier used to group one visit's page views is random and is not kept after your browsing session ends. Separately, if you type your email address into a form on one of those sites, that address is sent to us and stored as a lead — that happens because you submitted the form, not as part of counting page views. If your browser sends a Global Privacy Control or Do Not Track signal, we record no page views.

An email captured that way is never added to an automated email sequence, and it is recorded in our system as having given no consent to commercial messages.

Why we collect it, and your consent

We collect personal information to do what you asked us to do: schedule and complete a shoot, find and access the property, deliver files, invoice and take payment, answer your questions, keep records for tax and legal purposes, prevent abuse of our public forms, and understand which parts of our service work.

Under PIPEDA and BC PIPA we rely on consent. When you give us information to get something done, your consent to use it for that purpose is implied by the request. A few uses rest on an opt-in you give us first — the careers newsletter box, and choosing "Accept" on a listing-page banner. Our marketing and lifecycle emails to booking customers rest instead on the implied consent that comes from an existing business relationship under Canada's Anti-Spam Legislation: they are switched on after you book rather than opted into, and every one of them carries a one-click unsubscribe. You can withdraw consent at any time, subject to legal and contractual limits: we must keep enough of a record of a completed order to meet tax and accounting obligations, and withdrawing consent may mean we can no longer provide part of the service.

Email and text messages

Transactional messages — booking confirmations, arrival windows, invoices, delivery notices, replies — are part of the service. They continue while your account is active and carry no unsubscribe link, because unsubscribing from them would break the service you asked for.

Marketing and lifecycle messages — pre-shoot reminders, post-delivery follow-ups, anniversary and re-engagement emails — are sent under Canada's Anti-Spam Legislation (CASL). Each carries our name, our city and our contact details, and a one-click unsubscribe link that works without signing in; you can also email info@realtystudios.ca and ask us to stop.

We may text you about a booking where a studio has enabled SMS and your number is on the order, and we may text you about a waitlist opening, files we are sending you, or an enquiry you made. Replying STOP stops our booking reminders and our inbox and chat replies to that number. To be taken off every text we send, email info@realtystudios.ca and we will remove you.

Who we share it with

We do not sell personal information, and we do not disclose it to anyone for their own marketing. We use service providers who process it on our behalf, under contract:

Supabase — database, sign-in and file storage; everything we hold passes through it.
Cloudflare — hosting, content delivery and abuse protection.
Resend — sends our email; receives the recipient address and the message.
Twilio — sends and receives our texts; receives the number and the message.
Stripe and Square — payment processing. Card details go from your browser to the processor; we receive a confirmation and a transaction record, not your full card number. Square also creates and hosts the invoices customers pay.
NVIDIA and Anthropic — the AI providers behind the AI-assisted features described in our Terms; each receives what a feature sends it. Our AI photo-enhancement feature sends the photograph being enhanced to Replicate or ClipDrop when a studio has enabled it.
Other providers a studio can connect — calendar sync, accounting and CRM sync, file delivery, 3D-tour import and similar integrations that only receive data once a studio switches them on. Each is named, with what it receives, on our sub-processor page.
Mapbox — address lookup and map images; receives the property address and coordinates.
Google — web fonts, mobile push notifications, and, where a studio connects them, calendar sync and business-listing information.
Dropbox — where a studio uses it, the folders holding delivered shoot files.
Open-Meteo — weather for shoot dates; receives a location and a date, not your identity.

The complete, current list — including providers we only use when a studio connects an integration — is at /legal/subprocessors, and that page is the one we keep up to date. A studio can build a retargeting audience from listing-page visits where the visitor chose "Accept". We do not currently send those audiences to an advertising platform, and we do not share your email address with one.

We will also disclose personal information where the law requires it, where it is needed to investigate a breach of our terms or protect someone's safety, or as part of a sale or reorganisation of our business, in which case the recipient must protect it on terms at least as strong as these.

Where it is stored

Our database, sign-in system and file storage run in the United States. Our websites are delivered from a global content network, and our email, text-message, payment, mapping and AI providers may process information in the United States or elsewhere.

So personal information we hold about you is stored and processed outside Canada. While it is there it is subject to that country's laws, and its courts, law-enforcement bodies and government authorities may in some circumstances obtain access to it. PIPEDA and BC PIPA require us to be open about this. We choose providers who contractually commit to protect the information, but we cannot promise a foreign authority will never compel disclosure.

How long we keep it

We keep personal information for as long as we need it for the purpose we collected it, and then for as long as tax, accounting and legal record-keeping requires. Some periods are fixed by our systems:

Chat attachments are deleted about 90 days after upload.
Chat transcripts are kept for the period the studio sets — at least 30 days, and one year by default.
Archived operator inbox messages are deleted 90 days after archiving.
Unsent ticket drafts are deleted after 14 days.
Job applications are deleted on a scheduled retention cycle, and immediately on request.
The token in a marketing email's unsubscribe link expires after 90 days.
Delivered shoot files: we keep the photos, video, floor plans and other files we produce for a listing available in your portal for 12 months after we deliver them. After that we archive them: we keep the files, nothing is deleted, but we stop showing them in your portal and we stop giving out access to them. You can ask us to bring an archived listing back at any time by opening a support ticket from your portal. If you would rather your files never go quiet, you can pay to keep a listing live for another year; the price is shown in your portal, each purchase adds twelve months to that listing's date, and buying it for a listing we have already archived brings its files straight back. A link to a specific file that we gave out before we archived it may keep working until it expires. Studios using our software may set a different window for their own customers; their delivery page shows the date that applies.

When a studio ends its subscription we do not delete its data at that moment: access continues to the end of the paid period, and the studio can export its records before then.

How we protect it

Row-level database security keeps one studio's records out of another's reach, and traffic to our sites is encrypted in transit. Files sit in private storage and are released through short-lived signed links rather than public addresses. Portals sign in with one-time email links or passkeys rather than passwords, operator accounts can enable two-factor authentication, public endpoints are rate-limited, and administrative actions and data exports are recorded in an audit log. Where a consent or suppression check cannot be completed, our systems treat it as "no" rather than "yes".

No system is perfectly secure, and we claim no security certification. To report a vulnerability, email info@realtystudios.ca.

Your rights

You may ask us to confirm whether we hold personal information about you and what it is, give you a copy, correct it, delete it where we are not required to keep it, and stop sending you marketing.

The fastest route is /privacy-request, which offers access, export, correction and deletion. We email a link to confirm the request came from you, and we respond within 30 days as PIPEDA requires. You can also email info@realtystudios.ca. If we refuse a request we will tell you why. If you are not satisfied with how we handled your personal information, you may complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca, or to the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca.

Children

Our services are for businesses and for adults marketing or selling property. They are not directed to children, and we do not knowingly collect personal information from anyone under the age of majority where they live. If you believe a child has given us personal information, email info@realtystudios.ca and we will delete it.

Changes

We may update this policy as our service or the law changes; the effective date above tells you which version you are reading. Where a change materially affects how we handle your personal information, we will post it and tell active accounts by email before it takes effect.

Contact

Email info@realtystudios.ca or call +1 (604) 779-4089. Realty Studios is the operating name of VLGRS Inc., Vancouver, British Columbia, Canada.