Privacy notice

Scope

This notice describes how Cedar Keep Whistler Home Watch Inc. (“CedarKeep”, “we”, “us”) collects, uses, shares, and protects personal information. It applies to:

• Visitors to our marketing website at cedarkeepwhistler.ca.
• Prospects who submit a form on our website (request access, agent enquiry, or newsletter signup).
• Owners who sign a service agreement with CedarKeep and use our app at app.cedarkeepwhistler.ca.
• People mentioned by owners in the course of receiving the service — for example, a houseguest whose name appears in a concierge request, or a contractor referenced in a work order.

If you are none of the above and personal information about you has reached us through another path, please contact us using the information in Section 14.

The short version

This summary is here to orient you. It does not replace the full notice below, and where the two differ, the full notice governs.

• What we collect. Your contact details, information about your property (including access codes), the photographs and notes from each inspection, your messages to us, records of the work we coordinate, and basic technical information about your device. Access codes are encrypted on our devices before storage; our servers cannot read them.
• Who sees it. CedarKeep’s authorised people, and the service providers listed in Section 5 who run our infrastructure on our behalf. We share with a vendor only what the job needs. We never sell your information, and we never use it for advertising.
• Where it lives. Canada is home, but most of our providers are in the United States, so your information is stored and processed there. Section 5 lists each one and what it handles.
• AI. We use AI in two places — inspection summaries and the concierge — through Anthropic. A person at CedarKeep approves every action before it happens.
• Your rights. You can ask to see your information, correct it, delete it, or withdraw consent. Section 9 explains how.
• Reaching us. Email our Privacy Officer at privacy@cedarkeepwhistler.ca.

1. Who we are and how to reach us

CedarKeep is operated by:

Cedar Keep Whistler Home Watch Inc. (BC1595525)
6207 Eagle Drive
Whistler, BC V8E 0C6
Canada

For all privacy questions, requests, and complaints, contact CedarKeep’s Privacy Officer:

• Email: privacy@cedarkeepwhistler.ca
• Mail: the address above, marked Attention: Privacy Officer

We respond within thirty days of receiving a request, in line with PIPEDA’s timeline for access and correction.

2. What information we collect

We group the information we collect into the categories below. Not every category applies to every person — for example, if you only visit our marketing site without submitting a form, we collect only the technical information described at the end of this section.

Identity information. Your full name, email address, phone number, and mailing address. Collected when you submit a form on our website or sign up for the service.

Property information. The civic address of your Whistler property, its type and characteristics (heating type, hot tub, alarm system, and similar details), and the access information we need to perform inspections and coordinate work — gate codes, lockbox codes, alarm codes, parking instructions. Collected during onboarding and updated as your situation changes.

Inspection records. Photographs of the interior and exterior of your property, checklist results, timestamped notes, geolocation captured at the moment of each checkpoint, and the AI-generated written summary of each visit. Collected during scheduled inspections.

Communications. Messages you send to our AI concierge, plus emails and text messages exchanged with us. Before you become an owner, communications are typically handled through our lead-capture system; after you become an owner, communications happen within the app and through email or SMS we send you directly. Collected each time you reach out or we reach out to you.

Service records. Details of work orders, contractor estimates, your approvals, and vendor information. We also store the vendor's invoices or receipts for completed work and show them to you in the app as proof of the cost charged; as with your property documents, we store these files but do not read, summarise, or give advice on their contents. Collected when work is coordinated on your property.

Property documents. Files you upload to your property's document vault — or that our team uploads on your behalf — such as insurance policies, appliance manuals, warranties, the deed, or vendor contacts. We collect these only when you or we add them, so you have one trustworthy place for your property paperwork. We store these files; we do not read, summarise, or give advice on their contents — CedarKeep provides document storage, not tax, legal, or insurance advice. Access codes do not belong here and should not be uploaded — those are kept separately (see "Property information" above). You can delete your own documents at any time; if your service ends, we make your documents available for you to download for a period and then delete them.

Payment information. When you store a payment card, the card details are handled by Square, our payment processor; we never see full card numbers. We keep only what we need to run the service: whether a card is on file, the card brand and last four digits where available, and transaction records. We also keep a record of any refund — its amount, date, and status, issued through Square — and show it to you alongside the original charge; a refunded charge is never shown as paid. Collected when you set up paid services and each time a charge or refund occurs. How this payment data is processed and stored is described in Section 5.

Device and notification information. If you turn on push notifications, we store a device token — an opaque identifier your phone's operating system issues so that notifications can be delivered to the CedarKeep app on your device — together with your notification preferences. A push notification contains only a short title and status message, a link to the relevant screen in the app, and identifiers for the item it concerns; it never contains your photographs, your documents, or your access codes. Notifications are delivered by Apple on iPhones and iPads, and by Google on Android devices (see Section 5). You control notifications — globally and by type — in the app under Account → Notifications, and you can turn them off at any time.

Technical information. Your IP address, device type, browser, operating system, and timestamps for sign-in and app use. Collected automatically as you use our website or the app.

Saving photos to your device (iOS app). If you choose to save an inspection photo from the app to your device's photo library, the app uses the operating system's add-only permission — it can add that photo, and cannot see, read, or modify anything already in your library.

Marketing-site form submissions. When you submit a form on cedarkeepwhistler.ca — request access, the agent enquiry, or the newsletter signup — we capture the fields on that form together with information about the submission (the form name, the page URL, the submission timestamp). This information is stored in our lead-capture and customer-relationship system, GoHighLevel, before any account is created.

3. Why we collect it

We collect personal information for the following purposes:

1. To provide the service — performing inspections, generating reports, coordinating maintenance, responding to concierge requests, and processing payments.
2. To maintain safety and security — verifying who has access to your property, and maintaining records of entries.
3. To support insurance and documentation needs — maintaining records that support your insurance claims and our own defence in the event of a dispute.
4. To communicate with you — replying to your messages, sending service updates, and providing necessary notifications.
5. To improve the service — internal analysis of how the service is used, on an aggregate and anonymous basis. We never identify individuals in shared analysis.
6. To meet legal obligations — tax, regulatory, and contractual.

We do not collect personal information for any of the following:

• We do not sell or rent personal information to third parties — ever.
• We do not engage in targeted advertising.
• We do not profile individuals for purposes other than providing the service.

4. How we use AI

We use artificial intelligence in two specific places in our service:

• Inspection summaries. Within thirty seconds of each inspection ending, AI generates a written summary of what was checked, what was clear, and what needs attention.
• Concierge. Our 24/7 AI concierge answers your questions about your property and about Whistler, and captures any requests you make for action.

Our AI provider is Anthropic (the makers of Claude). AI processing happens via Anthropic’s API, on servers in the United States.

When you interact with the concierge, the information sent to Anthropic includes the message you have just sent, the prior conversation in that thread, your property record, and relevant entries from our internal knowledge base. Personal identifiers (your name, your property address) may form part of the context provided to the AI.

When an inspection is submitted, the structured checkpoint results, notes, and photo captions are sent to Anthropic to generate the summary.

Anthropic does not retain your data to train its models. This is the contractual default for Anthropic’s API and the basis on which we use the service.

Every action that affects your property is approved by a person at CedarKeep before it is taken. The AI does not autonomously execute work, dispatch trades, or commit funds. The AI drafts, summarises, and converses; a human decides and acts.

If you object to AI processing of your personal information, you may request to use the service without AI features. We will accommodate this where operationally feasible.

5. Where your data is stored

CedarKeep is a Canadian company. Several of the services we rely on are based outside Canada. The following table sets out where each type of personal information is stored:

While stored or processed outside Canada, your personal information is subject to the laws of the host country, including the possibility of foreign government access through legal process.

We chose these providers for their security practices and operational reliability, not for where they are based. We do not have direct control over the legal regimes that apply to providers operating outside Canada.

We mitigate this exposure by:

• Encrypting personal information in transit and at rest.
• Limiting access to authorised CedarKeep personnel.
• Choosing providers that meet established privacy and security standards (SOC 2 or equivalent).
• Reviewing our subprocessor list periodically and updating this notice when the list changes.

By using our service, you consent to this cross-border storage and processing. At signup, you are also asked to acknowledge this consent separately from your signature on the service agreement.

Payments. We use Square as our payment processor to handle subscriptions and charges. When you store a payment card, the card details are collected and held by Square — we never hold full card numbers. We keep only what we need to run the service: whether a card is on file, the card brand and last four digits where available, and transaction records (amounts, dates, status, and any refunds). Square processes this information on our behalf and stores it on servers in the United States; by using our paid services, you consent to this cross-border processing. GoHighLevel, which we use for marketing leads, customer-relationship management, and communications, is not involved in processing your payments.

Notifications. When notifications are turned on, delivering them means passing a device token and a short message to the operating-system push service for your device — Apple's service on iPhones and iPads, Google's on Android. As noted in Section 2, the message carries only short status text and identifiers, never your photographs, documents, or access codes.

Email. We use Resend to send you transactional email — messages that are part of the service itself, such as a copy of your signed service agreement. Resend processes the recipient address and message content on our behalf, on servers in the United States. This capability is provisioned but not yet active; it turns on once our sending account is configured, and we list it here so this notice is complete when it does.

6. Who we share data with

We share personal information only as follows:

• With service providers who process data on our behalf, listed in Section 5. These providers are bound by contract to use your data only for the services they provide to us, and to protect it with measures equivalent to ours.
• With vendors coordinating maintenance work on your property — limited to what the vendor needs for the job: property address, scope of work, access details, and (where appropriate) your contact information. Vendors are vetted and bound by confidentiality.
• With insurance providers, if you request that we provide documentation in support of a claim — for example, photographs and timestamps demonstrating the condition of your property before damage occurred.
• As required by law, including in response to court orders, warrants, or other legally binding requests. Where the law permits, we will notify the affected owner.
• In a business transition — if CedarKeep is sold, merged, restructured, or wound down, personal information may be transferred to the successor entity or to a trustee, subject to the protections described in this notice.

We do not share personal information for marketing or advertising purposes. We do not sell personal information.

7. How long we keep it

We retain personal information only as long as we need it for the purposes set out in Section 3, and for the periods required by Canadian law.

You may request earlier deletion at any time (see Section 9). Some information must be retained longer where required by law or where it relates to an unresolved dispute; in that case we will keep only what is strictly necessary, and we will tell you what we have kept and why.

8. Consent

CedarKeep collects and processes your personal information on the basis of your consent. Consent is captured in two ways:

• Implied consent. You give us implied consent when you choose to use our service. By submitting a form on our website, signing up for the app, or otherwise providing information, you are consenting to the collection and use of that information for the purposes described in this notice.
• Express consent. For specific purposes that go beyond what is strictly necessary to provide the service — most notably, the cross-border storage of your personal information in the United States — we ask you to confirm consent explicitly. At signup, you check a box acknowledging this notice and the cross-border-storage provision. This consent is recorded separately from your signature on the service agreement.

You may withdraw your consent for non-essential processing at any time. Some processing is essential to the service — for example, the storage of inspection records — and cannot be withdrawn without ending the service.

To withdraw consent, email privacy@cedarkeepwhistler.ca. We will confirm the consequences of withdrawal before proceeding, so you can make an informed choice.

9. Your rights

You have the following rights with respect to your personal information:

• The right to access. You may request a copy of the personal information we hold about you. We respond within thirty days.
• The right to correction. Most corrections can be made directly in the app. Where the app does not allow direct editing (for example, of historical records), you may request correction by email.
• The right to withdraw consent. See Section 8.
• The right to request deletion. Subject to the retention periods in Section 7 and any legal obligations we have, we will delete your personal information within thirty days of a written request.
• The right to complain. You may complain to CedarKeep’s Privacy Officer. If you are not satisfied with our response:
  • In Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (oipc.bc.ca).
  • In the United States: the privacy regulator in your state of residence — for example, the California Privacy Protection Agency for California residents.

To exercise any of these rights, email privacy@cedarkeepwhistler.ca. We may verify your identity before fulfilling a request, to protect your information against unauthorised access.

10. How we protect your data

We protect personal information through:

• Encryption of data in transit (HTTPS) and at rest (database-level encryption at our hosting provider).
• Client-side encryption of property access codes. Smart-lock codes, key-safe combinations, and alarm codes are encrypted on our operations device before they reach our servers, using hardware-backed keys (Apple Secure Enclave). Our servers store only ciphertext and hold no key that can decrypt it — a compromise of our database would not expose your codes. Revealing a code in the field requires an enrolled device and biometric authentication, and is logged internally before the code is shown.
• Strong authentication for owner accounts — magic-link and password options, with industry-standard password hashing.
• Row-level access controls in our database, so that each owner’s data is accessible only to that owner and to authorised CedarKeep personnel.
• Server-side handling of sensitive operations. API keys, secrets, and credentials are never exposed in code that runs in your browser.
• Logging and monitoring for suspicious activity.
• Periodic review of which staff members have access to which data.

No security measure is perfect. If a breach affects your personal information and creates a real risk of significant harm, we will notify you, and report to the appropriate privacy regulator, as soon as feasible — the standard set by PIPEDA’s breach-reporting rules — and within any other timeframe required by applicable law.

11. Children’s data

CedarKeep is a service for adult property owners. We do not knowingly collect personal information from minors. If we learn that we have collected information from a minor, we will delete it promptly. If you believe we have inadvertently collected information about a minor, please contact us at privacy@cedarkeepwhistler.ca.

12. Cookies and tracking technologies

We use cookies and similar technologies only for:

• Essential functionality — signing you in, maintaining your session, and remembering your preferences.
• Error monitoring — Sentry uses identifiers to group errors and help us improve reliability.

We do not use cookies for advertising, behavioural tracking across other websites, or sale to third-party data brokers.

If we add a privacy-respecting analytics tool in the future (for example, Plausible, which does not use cookies), we will update this notice as described in Section 13.

13. Changes to this notice

We may update this notice from time to time. When we do:

• We update the “Last updated” date at the top of the notice.
• For material changes — a new third-party processor, a new category of data collected, or any change that affects your rights — we notify you in the app and by email at least thirty days before the change takes effect.
• For minor changes — clarifications or typo fixes — we publish the updated notice without separate notification.

You can request a record of past changes at any time by contacting privacy@cedarkeepwhistler.ca.

14. Contact

For privacy questions, requests, or complaints:

• Email: privacy@cedarkeepwhistler.ca
• Mail: Cedar Keep Whistler Home Watch Inc., 6207 Eagle Drive, Whistler, BC V8E 0C6, Canada — Attention: Privacy Officer

If your concern is not resolved to your satisfaction:

• In Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (oipc.bc.ca).
• In the United States: the privacy regulator in your state of residence.