Privacy Policy
Effective October 17, 2026
This policy explains the personal information Zevy handles when you use the website. For privacy questions or requests, use the contact information in the website footer.
Information we collect
When you sign in, we receive account identifiers and contact details such as your name and email address; you may provide a phone number and profile details. We store information you choose to save or submit, including favourite homes, named searches, search alert preferences and notifications, property views or shares, showing and detail requests, messages, inquiries, offer drafts, and the date and wording of an offer acknowledgement. Before sending an offer draft for agent review, you may upload front and back photos of government-issued ID for each buyer. Sign-in services use cookies or similar browser storage to maintain your session; a pending action may be held temporarily in your browser while you sign in. Standard service logs may contain technical request information used to operate and secure the website.
How we use it
We use this information to run accounts, show your saved activity, connect you with an assigned agent, respond to requests, display rebate illustrations, maintain offer drafts, verify buyer identity for an offer review, and protect the service. ID photos are stored separately from public listing images and are not sent in emails. If email delivery is configured, the site may send transactional notifications about requests, inquiries, messages, and saved search matches or listing changes to the relevant user, agent, or administrator. Users who choose text alerts confirm their mobile number by code before it is used for saved search notifications through the configured SMS provider. Admins and Agents can also receive sign-in codes by email. If they choose SMS verification, their confirmed mobile number is stored encrypted and shared with the configured SMS provider solely to deliver verification codes.
Who can see it
You can see your account information and saved activity while the relevant feature is available. You, your assigned agent and site administrators can access uploaded ID photos through signed-in access controls. Assigned agents can see information needed to assist their clients, including offer drafts and acknowledgements. Site administrators can see client requests and offer records. If the offer feature is turned off, user access to offer drafts is hidden while assigned agents and administrators retain access. Service providers used for sign-in, hosting, database storage, property data, or configured email delivery may process information as needed to provide those functions. We do not publish your private messages, ID photos or offer drafts as public property listings.
VOW compliance records
By accepting the VOW terms, you consent to the collection and use of your verified identity, terms acceptance, session and listing activity for access control, security and compliance, and to disclosure to PropTx/the Association for auditing or legal purposes. For restricted MLS listing access, we record your verified identity, versioned terms acceptance, access renewal and authenticated listing requests and retrievals. Access requires explicit renewal at least every 90 days. Compliance records are retained for at least 365 days and at least 180 days after access validity expires, whichever is later; a legal hold can extend this period. PropTx, the relevant Association and authorized representatives may receive these records for auditing or legal purposes. Access to the VOW by Association representatives is permitted to verify compliance. Passwords remain securely hashed; reusable session tokens and plaintext passwords are not included in audit exports. Account deletion or session expiry does not erase records still required for compliance.
Retention and safeguards
Information remains in the site’s systems as needed to operate accounts and handle requests, and may be retained where necessary for recordkeeping or legal obligations. Uploaded ID photos are kept in private storage until an agent or administrator deletes them after review or a deletion request is processed. Access controls restrict ID photos to the buyer, assigned agent and administrator according to their roles. No online system can guarantee absolute security. Contact us if you need to correct information, ask about retention, or request deletion, subject to applicable requirements.
Your choices
You may choose whether to create an account or submit requests and offer drafts. You can remove favourites and saved searches from your account and change each search’s alert frequency, delivery method, and status change preference. You may ask for access to, correction of, or deletion of other personal information through the website’s contact details. Signing out ends your active session on that device; browser storage may persist until you clear it.
Email activity
Our emails use tracked links and a small hosted image to measure link activity and estimated opens. We associate these events with the email and, when available, your account so we can improve communications and help with your requests. Email privacy tools and security scanners can preload images or follow links, so these events do not necessarily mean a person opened or clicked an email. You can block remote images in your email application and manage optional property alerts through the preferences or unsubscribe links.
Website statistics and diagnostics
We use random browser and session identifiers to measure page views, engagement, device information and interaction patterns. We record IP addresses and visit times, and use a locally stored IP-location database to estimate countries and cities. IP locations are approximate and can reflect a VPN, mobile carrier or shared network. Visitor IPs are not sent to a geolocation API. Admin-only maps consolidate these approximate locations.
On the homepage, map search and listing pages, click positions and scroll-depth samples are grouped into heatmaps. We do not collect typed text, form values, screenshots or session replay. Private account and dashboard activity is excluded from interaction analytics. Do Not Track and Global Privacy Control disable visitor analytics and heatmaps. Operational web-server and error logs remain necessary to run and protect the service.
Browser, network, failed-resource and server errors are recorded with limited technical context. Request bodies, cookies and authorization headers are not logged by this feature, and common secrets and email addresses are redacted from diagnostic messages. Repeated errors may be grouped with occurrence counts. Detailed traffic, IP, interaction and error records are retained for up to one year and restricted to administrators. Blocking scripts or clearing browser storage can prevent or reset interaction tracking.
Links and updates
External links, including the RECO guide and property or map services, have their own privacy practices. We may update this policy as the site changes and will post the updated version here with an effective date.