Privacy policy

1. Scope

This policy applies to the zobol.ca website and to the Zoé service offered to real estate brokers taking part in the pilot. Zoé is a service for professionals; it is not intended for children.

2. Who is responsible

Zobol Technologies (Québec, Canada) is responsible for the personal information described here. Questions or requests: contact@zobol.ca.

Person in charge of the protection of personal information: to be confirmed (name and title to be published here before going live).

3. This website

zobol.ca is an informational website. It uses no tracking cookies, no audience measurement, no advertising and no forms. If you email us, we receive what you choose to include (for example your name, address and message), through our email provider Zoho.

The site's host may process technical data (IP address, browser, pages requested, date) to deliver and protect the site. Host and retention period for these logs: to be confirmed before going live.

4. The Zoé service

During the pilot, Zoé processes the following information, only to provide the service to you:

• Your account: sign-in information provided by our authentication service (for example your email address and an account identifier) and your sessions.
• What you write: your messages to Zoé, client records (names, contact details, search criteria, budget, asking price…), follow-ups, notes and file facts.
• Your connected calendars: Google Calendar, Microsoft Outlook and your Android phone's calendars, which you connect yourself (see section 5 for Google).

You are responsible for having the right to share your clients' information with Zoé, in line with your professional obligations. Emails (Gmail) are not processed yet: this feature is not offered.

5. Google data

If you connect Google Calendar, Zoé requests the following permissions, and only these:

• Read your calendars and events (calendar.readonly): to answer questions about your schedule, find your free time and spot conflicts.
• Create, change or delete events (calendar.events): only if you enable changes, and each change is made only after your explicit confirmation.

What we keep

The content of your events is read when you ask a question; it is not copied into our database, except: the identifiers of the calendars you select; actions prepared and awaiting your confirmation (encrypted, 24 hours at most); the identifier of events Zoé creates or changes, for the action log; your access token, encrypted. Your Google account is represented by an irreversible fingerprint, not by your email address.

Sharing and artificial intelligence

We do not sell your Google data, do not use it for advertising and do not use it to train generalized artificial intelligence models. Zoé's answers about your appointments may appear in the conversation history sent to OpenAI to understand your next request (section 6). No one at Zobol reads your data, except with your explicit consent (for example for support), for security, or where required by law.

Zoé's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access

You can disconnect Google Calendar in Zoé at any time: Zoé then revokes access with Google. You can also remove access from your Google Account (myaccount.google.com/permissions). To have the related data deleted, email us.

6. Artificial intelligence

To understand your messages, Zoé uses an artificial intelligence model from OpenAI (United States). It receives: the message you type, the latest exchanges of the conversation and, for the general conversation, the record of the client concerned. For calendar questions, only the text of your question may be sent. Processing by OpenAI is governed by its terms for API services; retention periods and contractual commitments are to be confirmed and documented before the pilot with real data.

7. Providers and processing locations

• Auth0 (Okta): signing in to your account. Hosting region: to be confirmed.
• OpenAI (United States): understanding messages (section 6).
• Google and Microsoft: the services you connect yourself.
• Zoho: our email (contact@zobol.ca).
• Service hosting: planned in Canada (Amazon Web Services, Montréal region), not in place yet.

Some of these providers process information outside Québec. Before the pilot with real data, we will assess these transfers as the law requires.

8. Retention and deletion

We keep information for as long as needed for the service and applicable obligations. Precise periods by type of information: to be confirmed before the pilot with real data. At the end of the pilot or on request, we delete the broker's data, unless the law requires it to be kept. Self-service deletion is not offered yet: requests are made by email.

9. Security

Measures in place in the prototype: separation of data by broker enforced by the database; encryption of sensitive information and access tokens; minimal access to connected services; explicit confirmation before any external action; an action log without personal content. No measure guarantees absolute security. In the event of a confidentiality incident presenting a risk of serious injury, we will notify the people concerned and the Commission d'accès à l'information, as the law requires.

10. Your rights

You may request access to your information, its correction or deletion, withdrawal of your consent, or a copy of your information in a structured technological format. Email contact@zobol.ca; we answer within 30 days. You may also contact the Commission d'accès à l'information du Québec.

11. Changes

We will update this policy for each new feature or provider, before it is used, and show the update date at the top of the page.