Privacy Policy
This Privacy Policy explains how AAREAS Interactive Inc. ("AAREAS", "we", "us", "our") collects, uses, shares, and protects personal information when you use the Homepix customer portal and related services (the "Service"). Our registered office is 1120 Finch Avenue West, Suite 300, Toronto, Ontario, Canada, M3J 3H7.
We are based in Canada and handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and, where they apply, the EU/UK General Data Protection Regulation (GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). Our primary audience is North America; if we expand elsewhere, additional local rules may apply.
- Whose information this covers & our role
- Information we collect
- How we use information & legal bases
- Cookies & similar technology
- How we share information
- AI-assisted features & automated decisions
- Aggregated & de-identified data
- Where your data is stored
- How long we keep it
- Security & breach notification
- Your rights & choices
- US state privacy rights (California and similar)
- EU/UK information
- Children
- Changes to this policy
- Contact us
1. Whose information this covers & our role
This policy covers Customer account holders and their team members. Home buyers and visitors who view a Customer's embedded floor plans or storefront are not account holders, and we collect only limited technical information about those visits (see Section 2). Manufacturer and plant contacts we store for production coordination are also covered.
Our role. For Customer account and platform data, AAREAS is the controller. Where a Customer collects or handles the personal data of their own buyers or contacts using the Service, the Customer is the controller of that data and AAREAS acts as a processor on the Customer's behalf; business customers who need one may request a Data Processing Addendum (DPA) at info@aareas.com.
2. Information we collect
| Category | What it includes | Why |
|---|---|---|
| Account & profile | First and last name, company name, company website, business hours, email address, phone number | Create and run your account |
| Credentials & security | Password (stored only as a secure one-way hash), two-factor (SMS) status, verified-email/phone status, trusted-device token (hashed), login timestamps | Sign-in and account security |
| Billing | Subscription plan, billing status, and a reference ID to your Stripe customer and subscription. We do not collect or store your full card number — card details are entered on Stripe. | Process your subscription |
| Customer content | Media you upload, pricing/markup settings, storefront and embed configuration | Provide the Service you configure |
| Usage & logs | Server request logs, and embed/virtual-design open events — including the website address (origin) that displays your embed, the model, and the outcome. These open events do not record a buyer's identity. | Operate, secure, and report on the Service |
| Support | Messages and information you send us | Respond to you |
You do not have to provide this information, but without it you may not be able to use the Service.
3. How we use information & legal bases
We use personal information to operate the Service, and we rely on the following legal bases (where GDPR or similar law applies):
| Purpose | Legal basis |
|---|---|
| Create your account, authenticate you, and provide two-factor security | Performance of our contract with you |
| Operate the Service (pools, pricing, media, storefronts, embeds) | Performance of our contract |
| Process subscriptions and payments through Stripe | Performance of our contract; legal obligation (tax/accounting) |
| Secure the Service, prevent abuse, and enforce our Terms | Legitimate interests (security and integrity of the Service) |
| Provide support and improve the Service | Legitimate interests; your consent where required |
| Send marketing/commercial electronic messages | Your consent (CASL); withdraw anytime |
| Comply with legal obligations | Legal obligation |
We do not sell your personal information. We send commercial messages only in line with CASL and give you a way to unsubscribe.
4. Cookies & similar technology
The portal uses only strictly necessary cookies. It does not use advertising or third-party analytics cookies. If we add any non-essential cookies in the future, we will ask for your consent first. Disabling necessary cookies will prevent sign-in.
| Name | Type | Purpose | Kept for |
|---|---|---|---|
aareas_session | Cookie (HTTP-only) | Keeps you signed in. Set only after you sign in. | 8 hours, or until you sign out |
aareas_device | Cookie (HTTP-only) | Remembers a trusted device for two-factor authentication. We store only a hash of it. | 30 days |
dp-theme | Browser storage | Remembers your light or dark theme choice. | Until you clear it |
dp-cookie-ok | Browser storage | Remembers that you closed the cookie notice. | Until you clear it |
dp-embed-href | Browser storage | Remembers the web page address you typed on the embed page. | Until you clear it |
coChargeKind, coPlan | Browser session storage | Tracks your checkout while you are on the Stripe payment page. | Removed after checkout |
Payments use Stripe’s hosted checkout page. Stripe may set its own strictly necessary cookies on its own site during payment, under its own privacy policy.
Web fonts and icons are served from our own servers. Some model photos load from the home manufacturers’ image servers, which, like any web request, receive your IP address and browser information when those images load.
Note: our public marketing website, aareas.com, is separate and may use analytics cookies under its own privacy policy.
5. How we share information
We share personal information only with service providers (sub-processors) that help us run the Service, and only as needed:
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Subscription billing & payments | Name, email, payment details you enter on Stripe; we keep only reference IDs |
| Amazon Web Services (S3, US East) | Private storage of media and attachments | Files you or our staff upload |
| Twilio | Two-factor authentication by SMS | Your phone number (only if 2FA is enabled) |
| Email relay (SMTP) | Transactional email | Recipient email address and message content |
We maintain this list of sub-processors and will give notice (for example, by updating this policy with a new date) before a new sub-processor begins processing personal data, so you can object where you have the right to. We may also disclose information to comply with the law, enforce our Terms, protect rights and safety, or as part of a business transfer (such as a merger or acquisition), with appropriate safeguards. We do not sell your personal information.
6. AI-assisted features & automated decisions
Some features (for example, auto-filling a plan request from a manufacturer web page) use an AI model that AAREAS hosts on its own infrastructure. When you use such a feature, the page text you point it at is processed on our systems to extract fields. This content is not sent to any third-party AI provider and is not stored as part of the feature's output. We treat that text and the model's output as untrusted data.
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing; these AI features are best-effort aids that a person reviews.
7. Aggregated & de-identified data
We may create aggregated or de-identified information that does not identify you (for example, usage statistics and trends) and use and disclose it for any lawful purpose, including operating, analyzing, and improving the Service. We maintain and use such information only in a form that does not reasonably identify you.
8. Where your data is stored
Account and business data is stored in Canada. Uploaded media and attachments are stored in the United States (AWS US East region). Some providers listed above operate globally. This means your information may be processed in Canada, the United States, and other countries, which may have different data-protection laws. Where personal data protected by the EU/UK GDPR is transferred outside the EEA/UK, we rely on an adequacy decision where one applies, or otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum), together with additional safeguards.
9. How long we keep it
We keep personal information only as long as needed:
| Data | Typical retention |
|---|---|
| Account & profile data | While your account is active, and up to 90 days after closure (then deleted or anonymized), unless you ask us to delete it sooner |
| Billing & payment records | As required by tax/accounting law (commonly up to 7 years) |
| Security, request & embed-open logs | Up to 12 months |
| Support messages | Up to 24 months after the matter is resolved |
We may keep information longer where the law requires or to establish, exercise, or defend legal claims.
10. Security & breach notification
- Passwords are stored only as salted one-way hashes (bcrypt);
- Traffic is encrypted in transit with TLS;
- Sessions use signed, HTTP-only cookies;
- Uploaded files are held in a private storage bucket, not publicly listable;
- Access is gated by role, and each Customer's data is isolated from others;
- Optional two-factor authentication protects sign-in.
No system is perfectly secure. If we become aware of a personal-data breach that affects you, we will notify you and, where required, the relevant authority (for example, within 72 hours under the GDPR) without undue delay, and describe the likely consequences and the steps we are taking.
11. Your rights & choices
Depending on where you live, you may have the right to access, correct, update, or delete your personal information, to withdraw consent, to object to or restrict certain processing, and to data portability. You can update much of your profile in the portal, or contact us to exercise a right; we will verify your identity before acting and respond within the time the law allows (generally one month under the GDPR). You can opt out of non-essential email at any time. If you are in Canada, you may also contact the Office of the Privacy Commissioner; in the EU/UK, your local data-protection authority.
Deletion on request. You can ask us to delete your personal information at any time. We will delete it unless we are required or permitted by law to keep certain records (for example, billing and tax records, or information needed to establish or defend legal claims), and we will tell you if such an exception applies.
12. US state privacy rights (California and similar)
If you are a resident of California or another US state with a privacy law, you have rights to know what personal information we collect (the categories are in Section 2), to access and delete it, to correct it, and to opt out of "sale" or "sharing" and of targeted advertising. We do not sell or share your personal information as those terms are defined, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. To make a request, contact info@aareas.com; you may use an authorized agent where the law allows.
13. EU/UK information
If you are in the EU or UK, AAREAS is the controller of your account data, our legal bases are in Section 3, transfers are covered in Section 7, and you may lodge a complaint with your local supervisory authority. [Placeholder — if we actively offer the Service to individuals in the EU or UK, we will appoint and name an Article 27 EU/UK representative and a data-protection contact here.]
14. Children
The Service is for business use and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. We will post the updated version with a new date and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect means you accept the updated policy.
16. Contact us
AAREAS is accountable for the personal information under its control. To exercise your rights, or for any privacy question or complaint, contact our Privacy Officer:
Privacy Officer
AAREAS Interactive Inc.
1120 Finch Avenue West, Suite 300
Toronto, ON, M3J 3H7, Canada
Phone: 416.661.2244
Email: info@aareas.com
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.