Privacy Policy

Last updated: March 25, 2026

AIMS (“we”, “us”, “our”) is a lead management platform for licensed real estate agents and brokerages in Canada. This policy explains what data we collect, how we use it, and your rights.

1. What Data We Collect

From Meta (Facebook / Instagram) Lead Forms

When someone submits a lead form on an agent’s Facebook or Instagram ad, we receive their name, email address, and phone number via Meta’s Leadgen API.

From Agent Accounts

We store the following when an agent connects their Meta account:

Meta ad account ID
Facebook Page ID
Meta user ID
OAuth access token (encrypted at rest — see Section 5)

SMS Messages

When agents communicate with leads via SMS through our platform, we store message content, phone numbers, timestamps, and delivery status.

2. How We Use Your Data

Lead contact information is used solely to enable the agent who received the lead to follow up via SMS or phone.
Meta account data is used to create and manage ad campaigns on the agent’s behalf, within their own ad account.
SMS messages are stored to provide agents with conversation history and enable AI-assisted follow-up.

We do not sell, rent, or share personal data with third parties. Data is only accessible to the organization (agent or brokerage) that owns the ad account that generated the lead.

3. Opt-Out and Unsubscribe

Leads can stop receiving SMS messages at any time by replying STOP, UNSUBSCRIBE, CANCEL, END, or QUIT. When we receive an opt-out keyword:

All outbound messaging to that lead is immediately blocked.
A confirmation message is sent: “You have been unsubscribed and will no longer receive messages.”
The lead can re-subscribe at any time by replying START.

4. Data Deletion

For Leads

Leads can request data deletion by contacting the agent directly or by emailing us at sho@aimsuitedata.com. Upon request, we delete all stored contact information, messages, and associated records.

For Agents (Meta Data Deletion)

When an agent removes AIMS from their Meta account, Meta sends us a data deletion callback. We immediately clear the stored access token and mark the connection as disconnected. A confirmation code and status URL are returned to Meta for tracking.

Agents can also disconnect their Meta account from within AIMS at any time via Settings → Meta Ads → Disconnect.

5. Data Security

Meta access tokens are encrypted at rest using AES-256-GCM with a per-encryption random initialization vector. Plaintext tokens are never logged or returned to the client.
All incoming Meta webhooks are verified using HMAC-SHA256 signature validation before processing.
Data is isolated per organization using Row Level Security at the database level. No organization can access another’s data.
The database is hosted on Supabase (PostgreSQL) with encryption at rest enabled.

6. Data Retention

Lead data and messages are retained for as long as the agent’s account is active, or until the agent deletes the lead. When an organization’s account is terminated, all associated data is deleted.

7. Canadian Privacy Law (PIPEDA)

AIMS operates in compliance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). We collect only the personal information necessary to provide our service, obtain consent through the lead form submission process, and provide clear mechanisms for opting out and requesting deletion.

8. Contact

For privacy inquiries or data deletion requests, contact us at: sho@aimsuitedata.com