Privacy Policy

North Desk is run by Avenue North Realty Inc., a real estate brokerage in Ottawa, Ontario, Canada. We are responsible for the information in North Desk under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact is Eli Skaff, Broker of Record, at eli@eliskaff.com or (613) 231-3000.

• Your account: your name, email, phone, photo, email signature, team, role and settings. Your password is handled by our sign-in provider and stored only in scrambled form.
• Clients and leads: the contact details and notes you or your team enter or import, such as names, phone numbers, emails, addresses, what they're looking for, consent records and history.
• Emails with saved contacts only: when you connect Gmail, emails between you and people saved as contacts are added to their page, with earlier quoted text removed.
• Marketing graphics: the graphics you make with Ava (with your name, phone, photo and logo) are stored as pictures with a private, hard-to-guess link so you can post them or put them in an email. To pick the best photo and write a caption, Ava sends the deal's photos and details to Claude.
• Calendar: the bookings you make in North Desk, and whether invited clients said yes, no or maybe.
• Your work in North Desk: notes, calls and texts you log, tasks, deals, documents you upload, and your business plan.
• Requests to Ava: what you type or say to Ava. Your conversations with Ava are kept for 30 days so you can look back at them, and only you can see them.
• Basic usage: how much you use Ava (for your monthly allowance) and a log of changes made in North Desk, so we can show who changed what.

• Any other email in your inbox. North Desk reads new messages only to check whether they're to or from a saved contact. Everything else is never stored.
• Emails with contacts marked "Don't log emails", for example friends and family. They're never logged, never go in your Inbox, and aren't read by Ava.
• Your own calendar events. They're shown when you look and never stored.
• Recordings of your voice. North Desk keeps only how many seconds were used.
• Government ID. ID checks stay in the brokerage's FINTRAC tool.

Only to run North Desk for you and your brokerage: keeping your client records, reminders and calendar, sending the emails you approve, and letting Ava answer and draft for you using your own data, with the same access you have.

• We never sell or rent your information or your clients' information.
• We never use it for advertising.
• We never use it, or let our providers use it, to train AI models.
• Ava never sends anything to a client on her own. You always see it and say yes first.
• Emails sent from North Desk (campaigns and one-to-one emails) record when they're opened and which links are clicked, so you can see it on the client's page. Opens are approximate (some email apps open every email by themselves). Every campaign has an unsubscribe link that takes effect at once.
• Ava reads offers, signed agreements, amendments, waivers and trade records only when you upload one or ask her to read one from your connected Gmail. The document is sent to Claude to read; nothing from it is saved until you check it and confirm. Ava can make mistakes, so every detail is shown beside the words it came from for you to check.

You can connect your own Google account for Gmail and Google Calendar. Each permission is asked for only when you turn that feature on. Here is each one and why:

Google Contacts: North Desk doesn't ask for access to your Google Contacts today. If we add contact syncing, it will be a separate permission you choose to turn on, and this policy will be updated first.

Your Google sign-in keys are encrypted before they're stored. People never read your Gmail unless you ask us to for support, it's needed for security, or the law requires it. Google data is used only for the features you see in North Desk and is never transferred except to run those features.

North Desk's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

These service providers process information only to provide their service to us, under agreements that protect it:

• Supabase: Our database, sign-in and file storage (for example signed offers you upload). (Canada (Central))
• Vercel: Runs the North Desk website and app. Requests reach it through Vercel's worldwide network, which keeps short request logs. (Montréal, Canada)
• Amazon Web Services (SES): Sends the email campaigns and newsletters you choose to send, from news.avenuenorth.ca. (Canada (Central))
• Anthropic (Claude): Powers Ava: your questions and the client details needed to answer them are sent to Claude. Anthropic's commercial terms don't allow it to train its models on this information. (United States)
• OpenAI: Turns what you say to Ava into text when you talk to her. Each thing you say is sent once you stop talking; OpenAI doesn't keep the audio and doesn't use it to train its models. (United States)
• Microsoft Azure Speech: Ava's speaking voice, and the backup for turning speech into text. Nothing is kept. (Canada (Central))
• Resend: Sends North Desk's own emails to you and your team, like new lead alerts, reminders and the morning brief. (United States)
• Google: Gmail, Google Calendar and address lookups, when you connect or use them. Only the address you type is sent for a lookup. (Google's data centres)

We don't share information with anyone else, except where the law requires it.

• Your North Desk data is stored in Canada. Some providers above process parts of it in the United States, as listed, so it may be subject to the laws there.
• Everything travels encrypted (HTTPS), and the database and files are encrypted at rest. Google sign-in keys and any personal Claude key you add are encrypted again before they're stored.
• Access goes by role: agents see their own clients, team leaders see their team's, assistants see only the agents they work with, and the broker can't see other agents' clients. Ava has exactly the same access as the person using her.
• Changes are recorded in a history that shows who changed what and when.

• Client records stay until you or your brokerage delete them. Deleted contacts can be restored for 30 days, then they're removed for good.
• Ava conversations: 30 days. Ava's daily notes: 14 days. Text conversations read from screenshots: the screenshots aren't kept, and what was read is kept 30 days unless you add it to a client.
• Email attachments you send are removed once the email goes.
• Backups are kept for 7 days.
• When an agent leaves, their account is closed and their clients are handled under the brokerage's agreement with them.

• Disconnect Google any time in Settings, under Gmail or Google Calendar (or Privacy and data). North Desk deletes its keys for your account. You can also remove access in your Google Account settings.
• Keep someone's emails private with "Don't log emails" on their page, and delete what was already logged.
• Ask for deletion in Settings, Privacy and data, or by emailing eli@eliskaff.com.

Under PIPEDA, you, and any client whose information is in North Desk, can:

• ask what personal information we hold about you and get a copy;
• ask us to correct it;
• ask us to delete it, unless the law or a real estate record we must keep requires otherwise;
• withdraw consent, subject to legal or contract limits.

Contact us at eli@eliskaff.com. We answer within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Emails agents send from North Desk go out from their own Gmail. Canada's Anti-Spam Legislation (CASL) applies to commercial messages. North Desk keeps each client's consent record, warns before an email to someone without consent, and never emails anyone who unsubscribed. Agents are responsible for having consent for the messages they send.

If we change how we handle information, we'll update this page and its effective date, and tell North Desk users before the change applies.