FirstList Privacy Policy

Effective: September 29, 2026
Last updated: September 11, 2026

This Privacy Policy describes how MyAbode, Inc. ("Company," "we," "us," or "our") collects,
uses, discloses, and protects personal information in connection with the FirstList platform (the
"Platform"), including www.firstlist.co, app.firstlist.co, and related Widgets and APIs. This
Policy applies to Agents, Brokerages, and Consumer Users of the Platform, and to visitors to
Agent/Brokerage websites that display a FirstList Widget.
‍
A. Scope and Who This Policy Covers
1. Roles. This Policy covers three categories of individuals: (a) Agents and Brokerage
personnel who use the Platform in their professional capacity; (b) Consumer Users —
buyer and seller clients invited to the Platform by a specific Agent; and (c) visitors who
interact with a Widget on an Agent's or Brokerage's own website (including those who
sign up for a newsletter through a Widget but never log in to the Platform itself).
Company also collects limited technical information (such as via cookies or analytics, as
described in Section G) from a visitor's browser when the visitor loads a Platform page or
a Widget on an Agent's or Brokerage's website, including where the visitor never signs up
for a newsletter, registers, or otherwise logs in to the Platform.
‍
B. Personal Information We Collect
1. Account and registration information. Name, email address, phone number, brokerage
affiliation, and registration/licence information for Agents; and name, email address, and
phone number for Consumer Users, collected at sign-up or invitation.
2. Business relationship acknowledgments. For Consumer Users, the acknowledgments
made at sign-up regarding the identified Agent/Brokerage relationship and absence of a
conflicting brokerage relationship (see the Terms of Use), which Company retains as a
record of the basis on which pre-MLS information was shared.
3. Listing and transaction-adjacent information. Property details submitted by Agents and
Brokerages, which may incidentally include seller name or contact information
depending on how an Agent completes a Listing record.
4. Usage and technical information. Log data, device/browser information, IP address, and
platform interaction data (e.g., which Listings a User views), collected automatically
through the Platform and Widgets.
5. Cookies and similar technologies. Cookies, pixels, and similar technologies placed on the
Platform and on Widgets collect device and browser identifiers, session and
authentication tokens, IP address, and usage data such as pages viewed and Listings
clicked. Section G below describes the categories of cookies used and how a User can
manage them.
6. Communications data. Content of support inquiries and other communications a User
sends to Company.
‍
C. How We Use Personal Information
1. Operating the Platform. To create and manage accounts, verify the Agent-Consumer User
relationship described in the Terms of Use, and provide access to Listings appropriate to a
User's role. This includes authenticating Users, maintaining account security, providing
customer support, enabling core Platform features such as Agent invitations and Listing
display, and communicating with Users about their account or the Service.
2. Automated Listing distribution. To generate and send automated communications to
Users, including emails describing new or Coming Soon Listings relevant to a User,
solely to the extent permitted in accordance with CASL.
3. Syndication and Widgets. To distribute Coming Soon Listing data to Syndication Partners
and to operate Widgets that Agents and Brokerages embed on their own websites, and to
attribute Widget sign-ups to the correct inviting Agent.
4. Analytics and product improvement. For general product and service assessment and
improvement — to understand how the Platform is used, evaluate performance, diagnose
technical issues, and inform new features — including generating aggregated or de-
identified analytics that Company may share with Brokerages about their own agents'
usage. Such aggregated or de-identified information may also be used by the Company
for its own commercial purposes as further set out in the Terms.
5. Compliance and enforcement. To verify compliance with real estate board rules
(including Coming Soon Window requirements) and with the Terms of Use, and to
respond to regulatory inquiries from CREA, a real estate board, or a real estate regulatory
authority.
6. Legal and safety. To comply with applicable law, respond to lawful requests, and protect
the rights, property, and safety of Company, Users, and others.
‍
D. We Disclose Personal Information To…
1. The identified Agent and Brokerage. A Consumer User's information is disclosed to the
Agent and Brokerage identified at sign-up, and to that Brokerage's internal systems, since
the Consumer User is a client of that Agent/Brokerage.
2. Syndication Partners. Coming Soon Listing data (which may include the Listing Agent's
identity but is not intended to include Consumer User personal information) is disclosed
to Syndication Partners as described in Section C(3).
3. Service providers. Company may disclose personal information to third-party service
providers who perform functions on Company's behalf (e.g., hosting, email delivery,
analytics, accounting, legal), under contractual or statutory obligations of confidentiality
and limited use.
4. Business transfers. In connection with a merger, acquisition, financing, or sale of assets,
personal information may be disclosed to the parties involved, subject to customary
confidentiality protections.
5. Legal requirements. Company may disclose personal information where required by law,
court order, or to a real estate regulatory authority or board investigating a compliance
matter.
6. No sale of personal information. Company does not sell personal information to third
parties for their own independent marketing purposes.
‍
E. Consent
1. Manner of consent. By registering for the Platform, an Agent, Brokerage, or Consumer
User consents to the collection, use, and disclosure of personal information as described
in this Policy. Consumer User consent is obtained through the sign-up acknowledgments
described in the Terms of Use.
2. Withdrawing consent. A User may withdraw consent to certain uses (for example,
unsubscribing from marketing emails) at any time by clicking the unsubscribe link
included in each such email, adjusting notification preferences in the User's Platform
account settings, or contacting Company using the details in Section K, subject to legal or
contractual restrictions. Withdrawing consent to core processing necessary to operate the
Platform (e.g., verifying the Agent relationship) may mean the User can no longer use the
Platform.
3. CASL-specific consent. A Consumer User selects an email notification frequency (instant,
daily, or never) at sign-up, which constitutes the Consumer User’s express consent to
receive Listing update emails at the selected frequency; a Consumer User may change
this selection at any time in the Consumer User’s Platform account settings. An Agent is
automatically subscribed to the “morning briefing” digest as a registered Platform user;
an Agent may opt out of the morning briefing, and toggle other Company
communications on or off, at any time in the Agent’s account settings. Each such message
identifies Company, includes contact information, and provides a working unsubscribe or
preference-management mechanism, as required by CASL.
‍
F. Data Retention
1. Retention period. Company retains personal information for as long as reasonably
necessary to fulfil the purposes described in this Policy, and, in any event, for no longer
than “twenty-four (24) months” after the account becomes inactive. Company may retain
personal information for longer where required to comply with a legal, accounting, or
regulatory obligation under Canadian law — for example, financial and tax records are
generally kept for at least six years as required under the Income Tax Act (Canada), and
records relevant to a potential legal claim may be kept for the applicable limitation period
(generally two years from discovery under the Ontario Limitations Act, 2002) — or to
respond to a future regulatory inquiry, such as one involving a Consumer User's business-
relationship acknowledgments.
2. Deletion. Upon request or account closure, Company will delete or anonymize personal
information within 30 days, except to the extent retention is required as described in
Section F(1) above.
‍
G. Cookies and Similar Technologies
1. Use of cookies. The Platform and Widgets use: (i) strictly necessary cookies to
authenticate Users and maintain sessions; (ii) preference cookies to remember settings;
and (iii) standard web analytics cookies to measure Platform usage and performance.
2. Managing cookies. Users can manage cookie preferences through their browser settings;
disabling cookies may limit Platform functionality.
‍
H. Security
1. Safeguards. Company uses commercially reasonable administrative, technical, and
physical safeguards designed to protect personal information against unauthorized access,
use, or disclosure, appropriate to the sensitivity of the information.
2. Breach notification. If Company becomes aware of a breach of security safeguards
creating a real risk of material harm, Company will notify affected individuals and the
Office of the Privacy Commissioner of Canada as required by PIPEDA, and will notify
affected Brokerages promptly to support their own regulatory obligations.
‍
I. Access, Correction, and Complaints
1. Access and correction requests. A User may request access to, or correction of, their
personal information held by Company by contacting the Privacy Officer identified in
Section K. Company will respond within the time required by applicable law.
2. Complaints. A User with a privacy complaint may contact the Privacy Officer. If
unresolved, a complaint may be directed to the Office of the Privacy Commissioner of
Canada.
‍
J. Children
1. Not directed to children. The Platform is not directed to, and Company does not
knowingly collect personal information from, individuals under the age of majority in
their province of residence.
‍
K. Contact and Privacy Officer
1. Privacy Officer. Company's designated Privacy Officer with respect to the Platform is
Derek Hooper, reachable at derekh@myabode.ca.
‍
L. Changes to This Policy
1. Updates. Company may update this Policy from time to time. Material changes will be
posted on the Platform and, where reasonably practicable, communicated to registered
Users by email. Except where applicable law requires Company to obtain a User's fresh
consent before making a change (for example, before using personal information for a
new purpose), a User's continued use of the Platform after a change takes effect
constitutes acceptance of the updated Policy; a User who does not agree to a change
should stop using the Platform.