Privacy Policy

MyNest360 is built and operated by Quotograph Inc. (“we”, “us”, “our”). We are responsible for the personal information we handle through the service, and we handle it in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law.

If you have any question about this policy or about your information, you can reach the individual accountable for our privacy practices directly at tajbrah@quotograph.io, or through our support page. Full contact details are in the contact section below.

You can use most of MyNest360 without an account. Creating one at /account with an email address and password, or by signing in with Google, lets your saved listings and advisor introductions follow you to another device, and is required to view MLS® sale prices and listing history (see PropTx and MLS® data).

When you have an account, we store your email address, the listings you save, and the advisor introductions you send. We also record your sign-ins and, while you are signed in, the pages you visit. Everything else stays on your own device, whether or not you have an account: your shortlist as shown on the saved page, your searches, your progress, and the buyer profile an advisor reads before a first call. There is no self-serve account deletion in the current build; to have your account and its data deleted, contact us and we will do it.

A large part of MyNest360 works entirely on your device. Your browser or the app stores this information locally, and it is not transmitted anywhere simply by being saved. It includes:

• the listings you save and the searches you run;
• your buyer profile, such as a budget range, the down payment you have available, whether you are pre-approved, and your timing;
• your progress through the home-buying checklist and any notes you add;
• a display preference such as light or dark theme.

Because this information lives on your device, no one, including us, can read it, and there is no server-side copy to be lost or disclosed. It also means it is not backed up, does not follow you to another device on its own, and is removed if you clear your browser data or uninstall the app. Your profile page shows what is currently stored and lets you delete any of it.

MyNest360 does not use advertising or analytics cookies. During its pre-release period some deployments sit behind a shared preview password; on those, we set a single secure, temporary cookie that only records that the password was entered correctly. It contains no identifier and nothing derived from you, expires after seven days, and disappears entirely once the preview password is removed. Clearing your cookies removes it. We set no other cookies.

Some of MyNest360’s tools send what you type to our server as you type it, so they can calculate a result and send it back. This includes the search box and the affordability, lender, offer and cost tools, which use figures such as your income, down payment, monthly debts and the price ceiling you set. We use these figures only to perform the calculation or search you asked for and return the answer; we do not store them in a database.

You can also submit requests through forms: a quote request to a trade, an inspection booking, an insurance quote, an advisor introduction, a viewing request, or a trade’s application to join the network. These forms collect the contact details and information you enter, such as your name, email address and sometimes a phone number, along with the details of your request. Most of these are processed and returned to you rather than delivered to anyone. Quote requests to a trade and inspection bookings are the two that can be sent onward by email where email is configured; in that case the details on the form are sent to complete the request, and a confirmation is emailed to you.

To answer a search or place a request, our server briefly keeps the text you searched as a short-lived cache entry, and counts requests against your IP address to protect the service from abuse. Neither is used to build a profile of you.

We do not sell your personal information, and we do not share it for advertising. The third parties involved in running MyNest360 are limited to the following, and your browser is technically restricted to contacting only the services listed here.

• Maps. Map tiles are loaded by your device from a map provider, and a tile request necessarily includes your IP address and the area of the map you are viewing. Depending on how a deployment is configured, tiles come from a basemap we host ourselves on our own Azure Blob Storage, built from OpenStreetMap data, or from MapTiler. Map label lettering on the website is loaded from Protomaps’ static asset host. The mobile app receives map tiles with their labels already drawn on them.
• Listing photographs. Listing photos come from the PropTx MLS feed. On the website, our server fetches them, so the photo host sees a request from us rather than from you. In the mobile app, your device fetches the photos directly and caches them on the device, so your IP address reaches that host.
• Location and data services. Address suggestions, geocoding, nearby amenities, interest rates and civic datasets are provided by Photon, Nominatim, Overpass, the Bank of Canada’s Valet API and the City of Toronto’s open data portal. These are all called from our server, so the text or coordinates you searched reach them, but your IP address does not.
• Email delivery. Where email is configured, we use Resend to send the quote-request and inspection-booking emails described above, and the confirmations that go with them. Only the details needed to send those messages are shared.
• Hosting. Our hosting provider receives and can log the requests your device makes to the service, as any web host does.
• MLS® feed (PropTx). Listings are supplied to us by PropTx’s syndication service for the Toronto Regional Real Estate Board. This is a one-way feed into the app; nothing about you is sent to PropTx or the board, except as described in PropTx and MLS® data.

We also disclose personal information where required by law, or to protect the rights, safety and security of our users, the public or MyNest360.

To show MLS® listing data, including sale prices and listing history, PropTx’s Virtual Office Website (VOW) rules require us to register you first. The related MLS® / VOW terms of use set out the consent and the restrictions on how that data may be used.

To register you, we collect your name, your email address, which you confirm by opening an emailed link before access is granted, and your account credentials, and we keep a record of registered users and of their access to the MLS® data, because the VOW rules require us to maintain one.

Your personal information and those records, including records of your access to and use of the data, may be shared with PropTx, and with the applicable real estate board, for the purposes of auditing and verifying compliance with MLS® rules and policies, and for legal purposes.

These records are kept only for accounts that register to view MLS® data, and only for as long as the VOW rules require. If you never register for that data, none of this applies to your account.

We do not use third-party analytics, advertising, attribution, session replay, crash reporting or A/B testing tools, and the website loads no third-party tracking scripts, tags or pixels. Nobody outside MyNest360 receives your activity.

We do keep two of our own logs, held in our own database and shared with no one else. When you sign in, we record your account email, the IP address the request came from, the browser and operating system your browser reports, and the time. As you move around the site while signed in, we record the pages you open along with the same details. These let us see how the service is used and protect the sign-in system from abuse. Sign-in records are kept for 180 days and page-visit records for 90 days, after which they are deleted automatically, and they are visible only to our administrators.

The mobile app stores your saved listings, your buying-process progress and notes, your post-firm checklist, any areas you draw on the map, and your recent searches on the device. Each has a control in the app that clears it, and uninstalling the app removes all of it. Your progress and checklist are sent to our server only so it can recalculate a plan and send it back; they are not stored there. Your saved listings, map areas and recent searches are never sent.

The app requests only network access. It does not ask for or use your location, camera, photo library, contacts or microphone, and it contains no tracking. Its map opens on a fixed point in downtown Toronto, shown on screen as a default location rather than yours.

MyNest360 is about buying residential property in Ontario. It is not directed at children, contains nothing designed for or likely to appeal to a child, and carries no content aimed at anyone under the age of majority. We do not knowingly collect personal information from children, and the service does not collect anyone’s age. If you believe a child has provided us with personal information, please contact us and we will delete it.

Under PIPEDA you have the right to ask whether we hold personal information about you, to be told what we hold and how it has been used and disclosed, to access it, and to have it corrected if it is wrong. You may also ask us to delete the information held under your account, and you may withdraw your consent at any time, subject to legal or contractual limits.

Because most of what MyNest360 stores lives on your device, much of this is already in your hands: you can view and delete it yourself from your profile page and, in the mobile app, from the controls on each item. For information held under your account, or anything you have sent us, write to us using the details below and we will respond.

To make a request, email us and tell us what you are asking for. We may need to confirm your identity before acting, and we will respond within the time PIPEDA allows. If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada.

Consent. Using the app without an account consents only to the on-device storage described above; nothing about you leaves your device until you act. Submitting a form is consent to handle that submission as described in this policy, and each form shows you what it is about to send before you send it. Creating an account is consent to store your email, saved listings and advisor introductions, and to keep the sign-in and page-visit records described above. You can withdraw consent by not submitting further forms, by clearing your on-device data, and, for what your account holds, by asking us to delete it.

Retention. Information held under your account is kept for as long as your account exists and is deleted on request. Sign-in records are kept for 180 days and page-visit records for 90 days. On-device information has no fixed schedule and is cleared by you. Emails you send us are kept in our inbox for as long as we reasonably need them.

Security. We protect your information with measures appropriate to its sensitivity: connections are encrypted with HTTPS, session cookies are signed and not readable by page scripts, account passwords are stored only in hashed form and never in the clear, and access credentials are held only in server-side configuration. No method of transmission or storage is completely secure, but we take reasonable steps to guard against loss, misuse and unauthorised access.

Depending on the providers a given deployment uses for hosting, email delivery and map tiles, your information may be processed in Canada, the United States, or both. While it is in another country, it may be subject to lawful access requests by the courts, law enforcement and national security authorities of that country.

If we become aware of a breach of our security safeguards that creates a real risk of significant harm to you, we will notify you promptly by email, using the address associated with your account or the address you gave us, and will report the breach as required by law.

Taj Brah, at Quotograph Inc., is the individual accountable for the privacy practices described in this policy. For any privacy question, request or complaint, contact:

Taj Brah, Quotograph Inc.
tajbrah@quotograph.io
or through our support page (info@quotograph.io).

If you are not satisfied with our response, you may escalate your complaint to the Office of the Privacy Commissioner of Canada.

We may update this policy as the service changes. When we do, we update this page and its effective date. The terms of use cover the rest of how MyNest360 works, including which parts of it are live data and which are still a demonstration.