Privacy Policy:

Zula - Privacy Policy

Version 1.0 • Effective Date: May 22, 2026 • Vancouver, British Columbia, Canada

Legal Entity

Zula Lead Intelligence Inc. (“Zula”, “we”, “us”, “our”)

Registered Office

Vancouver, British Columbia, Canada

Contact

matin@zulalead.com

Website

zulalead.com

Governing Legislation

PIPEDA (S.C. 2000, c. 5); BC Personal Information Protection Act (PIPA)

Privacy Officer

Matin Nej — matin@zulalead.com

Our commitment to your privacy

Zula is committed to protecting the privacy of every individual whose personal information we process. This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have. We operate under Canadian privacy law and hold ourselves to the highest standards of data stewardship.

1. Introduction & Scope

1.1 Purpose of This Policy

This Privacy Policy describes how Zula Lead Intelligence Inc. collects, uses, discloses, retains, and protects personal information in connection with the operation of the Zula platform (zulalead.com), the Zula Command Centre, our lead intelligence services, our marketing activities, and all associated products and services (collectively, the “Services”).

1.2 Who This Policy Applies To

This Privacy Policy applies to:

Subscribers and users of the Zula platform, including individuals on paid plans, free trials, and beta programs.
Visitors to the Zula website (zulalead.com).
Individuals whose property-related information appears in Zula’s lead intelligence data, derived from publicly accessible records.
Business contacts and partners who interact with Zula, including individuals at brokerages, property management companies, and data providers.
Job applicants and independent contractors who provide personal information to Zula.

1.3 Governing Legislation

Zula processes personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (PIPA). Where there is a conflict between this Policy and applicable legislation, the legislation prevails.

1.4 Consent

By accessing or using the Services, creating an account, or providing personal information to Zula, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. Where required by law, we will obtain express consent before collecting, using, or disclosing sensitive personal information. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting our Privacy Officer at matin@zulalead.com. Withdrawal of consent may affect our ability to provide the Services.

2. Definitions

"Personal information" means information about an identifiable individual, as defined under PIPEDA. It does not include the name, title, business address, or business telephone number of an employee of an organization.
"Subscriber" means any individual or entity that creates an account or subscribes to any Zula plan.
"Lead Intelligence" means property-related data, ownership records, market signals, and algorithmic scores derived from publicly accessible sources and delivered through the Platform.
"Data Sources" means publicly accessible records including the Land Title and Survey Authority of BC (LTSA), BC Assessment Authority, municipal permit databases, court records, and other lawfully accessible registries.
"Platform" means the Zula web application, Command Centre, APIs, and all associated software and tools.
"Privacy Officer" means the individual designated by Zula to oversee privacy compliance, currently Matin Nej (matin@zulalead.com).
"Third-Party Append" means any process by which a Subscriber adds personal contact information to Lead Intelligence using external tools or services independent of Zula.

3. Information We Collect

3.1 Information You Provide Directly

When you create an account, subscribe to a plan, contact us, or use our Services, you may provide:

Account information: Full name, email address, and telephone number.
Professional credentials: Name, address, and licence number of your real estate brokerage, your real estate licence number, and your registered geographic service area.
Billing information: Payment card details (processed and stored by our third-party payment processor; Zula does not store card numbers directly).
Platform usage data: Deal activity records, contact notes, task items, documents, and pipeline data entered into the Command Centre.
Communications: Messages, emails, and feedback submitted through our website, support channels, or in-platform communication tools.
Referral and testimonial data: Testimonials, case studies, or referral information provided with your consent.

3.2 Information We Collect Automatically

When you visit our website or use the Platform, we automatically collect:

Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and language preference.
Usage and interaction data: Pages visited, features used, buttons clicked, session duration, referral URLs, and navigation paths within the Platform.
Cookies and tracking technologies: We use cookies and similar tracking technologies (pixels, local storage) to facilitate Platform functionality, remember preferences, and analyse usage. See Section 10 for our full Cookie Policy.
Location data: Approximate geographic location derived from your IP address (city-level only; we do not collect precise GPS coordinates).

3.3 Information Derived from Public Records

Zula’s lead intelligence is derived from publicly accessible government and professional records. This data may include:

Property records: Property addresses, legal descriptions, lot and plan numbers, and zoning classifications.
Ownership records: Names of registered property owners as recorded in public title registries such as the Land Title and Survey Authority of BC (LTSA).
Assessment data: Property assessments, assessed values, and property classifications from BC Assessment Authority.
Permit and construction data: Building permit applications, renovation permits, occupancy permits, and related municipal filings.
Market transaction signals: MLS listing history where publicly accessible, including listing dates, price changes, days on market, and listing status.
Court and estate records: Publicly filed court records, probate filings, and estate records where lawfully accessible.

Zula deliberately omits personal email addresses and personal phone numbers from standard Lead Intelligence deliveries. This is a deliberate design decision to mitigate privacy and regulatory risk for both Zula and our Subscribers.

3.4 Information from Third Parties

We may receive personal information from the following third-party sources:

Payment processors: Our payment processor provides us with transaction confirmation data (not full card numbers).
Data partners: Where Zula has a signed data-sharing agreement with a property management company or brokerage, we may receive property portfolio and vacancy data subject to the terms of that agreement.
Social login providers: Basic profile information from LinkedIn or Google if you choose to authenticate using a social login (we only receive information you have authorised the platform to share).

4. How We Use Your Information

4.1 Purposes of Collection and Use

We use personal information for the following purposes, each of which constitutes a reasonable purpose under PIPEDA:

Purpose

Data used

Legal basis

Retention

Provide and operate the Platform and Services

Account info, credentials, usage data, User Data

Contractual necessity; consent

Duration of subscription + 24 months

Deliver Lead Intelligence and Lead Batches

Public record data, algorithmic scores, property data

Legitimate interest; publicly available information

Duration of subscription

Process payments and billing

Billing info (via payment processor)

Contractual necessity

As required by tax law (7 years)

Communicate with you about your account, service updates, and support

Name, email, communications

Contractual necessity; consent

Duration of subscription + 12 months

Send marketing communications about Zula products and features

Name, email

Express consent (CASL)

Until consent withdrawn

Improve and develop the Platform, algorithms, and new features

Aggregated usage data, anonymised interaction data

Legitimate interest

Indefinitely (anonymised only)

Detect, prevent, and address fraud, security issues, and abuse

IP address, device data, usage patterns

Legitimate interest; legal obligation

24 months

Comply with legal obligations, respond to legal process, and enforce our Terms

All categories as required

Legal obligation

As required by law

Generate aggregated, non-identifiable market insights and analytics

Anonymised and aggregated data only

Legitimate interest

Indefinitely

Administer referral programs and promotional offers

Name, email, referral records

Consent; contractual necessity

Duration of program + 12 months

4.2 Algorithmic Processing

Zula uses proprietary algorithms and machine learning models to analyse publicly available property and market data and to generate predictive lead scores. This algorithmic processing analyses property-level and market-level signals only. Zula does not use personal information about identified individuals (such as financial status, credit history, or personal behaviour patterns) as inputs to its lead scoring algorithm. The algorithm evaluates property characteristics, market history, permit activity, listing patterns, and comparable transaction data.

4.3 No Automated Decision-Making Affecting Individuals

Zula’s algorithmic scoring is applied to properties and market signals, not to individuals. No individual’s legal rights, employment, credit, or access to services is affected by Zula’s algorithmic processing. Lead Intelligence is provided to Subscribers as market intelligence only and does not constitute a decision about any individual.

5. How We Share Your Information

5.1 We Do Not Sell Personal Information

Zula does not sell, rent, trade, or otherwise make available the personal information of our Subscribers, website visitors, or individuals identified in Lead Intelligence to any third party for their independent marketing purposes.

5.2 Categories of Recipients

We may share personal information with the following categories of recipients, strictly for the purposes described in Section 4:

Payment processors: We use third-party services to process payments (e.g., Stripe). These processors receive only the payment data necessary to complete transactions and are bound by their own privacy policies and PCI-DSS compliance obligations. Zula does not store full payment card numbers.
Infrastructure and service providers: We use cloud hosting, email delivery, analytics, and customer support tools that may process personal information on our behalf. All service providers are bound by written data processing agreements requiring them to protect personal information and use it only for the purposes we specify.
Data partners (under signed agreements only): Where we have a signed Partnership Agreement with a property management company, brokerage, or data provider, we may share limited data as specified in that agreement. No personal information is shared under any Partnership Agreement without a signed data processing agreement that complies with PIPEDA.
Legal and regulatory authorities: We may disclose personal information to law enforcement, regulatory authorities, courts, or other governmental bodies where required by law, subpoena, court order, or regulatory request, or where we reasonably believe disclosure is necessary to protect the rights, safety, or property of Zula, our Subscribers, or the public.
Business transfers: If Zula is involved in a merger, acquisition, sale of assets, or reorganisation, personal information may be transferred to the successor entity, subject to the privacy protections in this Policy. We will notify affected individuals of any such transfer.
Aggregated and anonymised data: We share aggregated, anonymised, non-identifiable data that cannot reasonably be used to identify any individual. This includes market trend reports, aggregate platform usage statistics, and anonymised algorithmic performance metrics.

5.3 Cross-Border Transfers

Zula is based in British Columbia, Canada. Our cloud infrastructure providers may process data in Canada and in other jurisdictions, including the United States. Where personal information is transferred outside of Canada, we ensure that appropriate safeguards are in place, including written contractual obligations requiring the recipient to protect personal information to a standard comparable to Canadian privacy law. By using the Services, you consent to the transfer of your personal information to jurisdictions outside of Canada for the purposes described in this Policy.

5.4 No Disclosure of Subscriber Identity to Property Owners

Zula does not disclose the identity, contact information, or account details of any Subscriber to any property owner, homeowner, or individual whose information appears in Lead Intelligence. What a Subscriber does with Lead Intelligence after receiving it is the Subscriber’s sole responsibility and is governed by our Terms and Conditions.

6. Data Retention

6.1 Retention Periods

We retain personal information only as long as reasonably necessary for the purposes for which it was collected, or as required by law. Our general retention schedule is as follows:

Data category

Retention period

Basis

Deletion method

Active Subscriber account data

Duration of subscription

Contractual necessity

Secure deletion upon request

Account data after cancellation

24 months post-cancellation

Dispute resolution; legal compliance

Automated purge

Billing and transaction records

7 years from transaction date

Canada Revenue Agency requirements

Secure archival then deletion

Platform usage and analytics data

36 months

Service improvement

Anonymisation after retention period

Marketing consent records

Duration of consent + 36 months

CASL record-keeping obligations

Secure deletion

Lead Intelligence records

Duration of subscription

Contractual necessity

Removed from Subscriber access upon cancellation

Support and communication records

24 months from last interaction

Service quality; dispute resolution

Secure deletion

Cookie and tracking data

See Cookie Policy (Section 10)

Consent; legitimate interest

Automatic expiry

Aggregated, anonymised data

Indefinitely

Not personal information

N/A

6.2 Deletion on Request

You may request deletion of your personal information at any time by contacting our Privacy Officer at matin@zulalead.com. We will process deletion requests within 30 days and confirm completion in writing. Certain information may be retained where required by law (e.g., tax records) or where necessary to resolve disputes, enforce agreements, or comply with legal obligations. Where retention is necessary, we will inform you of the specific basis and expected duration.

6.3 Anonymisation

Where personal information is no longer required for identified purposes but the underlying data has value for aggregate analytics or algorithm improvement, Zula will anonymise the data so that it can no longer be used to identify any individual. Anonymised data is not personal information under PIPEDA and may be retained and used indefinitely.

7. Your Privacy Rights

7.1 Rights Under PIPEDA and BC PIPA

Canadian privacy law provides you with the following rights regarding your personal information held by Zula:

Right of access: You may request access to the personal information Zula holds about you. We will respond to access requests within 30 days and provide the information in a commonly used electronic format.
Right of correction: You may request that Zula correct any inaccurate or incomplete personal information we hold about you. We will make corrections within 30 days of receiving sufficient information to verify the correction.
Right of deletion: You may request that Zula delete your personal information, subject to legal retention requirements. See Section 6.2 for the deletion process.
Right to withdraw consent: You may withdraw your consent to the collection, use, or disclosure of your personal information at any time by contacting matin@zulalead.com. Withdrawal of consent may affect our ability to provide the Services. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
Right to opt out of marketing: If you have provided consent for Zula to send you marketing communications, you may unsubscribe at any time using the unsubscribe mechanism in any marketing email, or by contacting matin@zulalead.com. We will process unsubscribe requests within 10 business days as required by CASL.
Right to complain: If you believe Zula has handled your personal information improperly, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (www.oipc.bc.ca).

7.2 Exercising Your Rights

To exercise any of your rights, contact our Privacy Officer at matin@zulalead.com with a description of your request. We may ask you to verify your identity before processing a request. We will respond to all requests within 30 days. If we cannot fulfil a request within 30 days, we will notify you of the reason for the delay and the expected completion date.

7.3 Rights of Property Owners Identified in Lead Intelligence

Individuals whose property information appears in Zula’s Lead Intelligence (derived from publicly accessible records) have the right to:

Request information about whether Zula holds data relating to their property and the source of that data.
Request correction of any inaccurate property-related data.
Request that their property information be excluded from future Lead Intelligence deliveries (an “opt-out” request). Zula will process opt-out requests within 30 days and maintain a permanent suppression list.
File a complaint with the Office of the Privacy Commissioner of Canada or the BC OIPC if they believe their privacy has been violated.

Property owner requests should be directed to matin@zulalead.com with the subject line “Property Owner Privacy Request” and include the property address for identification purposes.

8. Data Security

8.1 Security Measures

Zula implements commercially reasonable technical, administrative, and physical safeguards to protect personal information from unauthorised access, disclosure, alteration, destruction, and misuse. Our security measures include:

Encryption in transit: All data transmitted between your browser or device and our servers is encrypted using TLS 1.2 or higher.
Encryption at rest: Sensitive data stored in our databases is encrypted using industry-standard encryption algorithms.
Access controls: Platform access is protected by password authentication. We strongly encourage Subscribers to use strong, unique passwords. We may implement multi-factor authentication for additional security.
Least-privilege access: Internal access to personal information is restricted to authorised Zula personnel on a need-to-know basis, governed by role-based access policies.
Infrastructure security: Our cloud infrastructure is hosted by reputable providers with SOC 2, ISO 27001, or equivalent security certifications.
Regular security reviews: We conduct periodic reviews of our security practices and address identified vulnerabilities promptly.
Vendor management: All third-party service providers that process personal information on our behalf are bound by written data processing agreements that include confidentiality and security obligations.

8.2 Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to any individual, Zula will:

Notify the Office of the Privacy Commissioner of Canada as soon as feasible after determining that the breach has occurred, as required by the mandatory breach reporting provisions of PIPEDA.
Notify all affected individuals as soon as feasible, providing a description of the breach, the types of personal information involved, the steps Zula has taken to reduce the risk of harm, and recommended steps the individual can take to protect themselves.
Keep a record of all breaches of security safeguards for a minimum of 24 months as required by PIPEDA.

8.3 No Absolute Guarantee

While we take data security seriously and implement industry-standard protections, no method of electronic transmission or storage is completely secure. Zula cannot guarantee absolute security and is not liable for any breach resulting from circumstances beyond our reasonable control, including sophisticated cyberattacks, zero-day vulnerabilities, or force majeure events.

9. Third-Party Links & Services

9.1 Third-Party Websites

The Platform and our website may contain links to third-party websites, products, or services that are not owned or controlled by Zula. We are not responsible for the privacy practices, content, or security of any third-party website. We encourage you to review the privacy policy of every third-party website you visit.

9.2 Third-Party Integrations

Zula may offer optional integrations with third-party tools such as CRM systems, email marketing platforms, or calendar services. If you enable a third-party integration, you may be sharing personal information with that third party under their own privacy policy. Zula is not responsible for the data practices of third-party integrations that you voluntarily enable.

9.3 Social Login

If you use a social login provider (such as Google or LinkedIn) to authenticate with Zula, we receive only the information that the provider makes available and that you authorise. We do not receive or store your social media password. The information received is used solely for authentication and account creation.

10. Cookies & Tracking Technologies

10.1 What We Use

Zula uses cookies and similar technologies on our website and Platform. Cookies are small text files stored on your device that help us provide and improve the Services.

Cookie type

Purpose

Duration

Can you opt out?

Strictly necessary

Authentication, security, load balancing, session management

Session / 24 hours

No — required for Platform functionality

Functional

Remembering preferences, language settings, display options

Up to 12 months

Yes — via browser settings

Analytics

Understanding how visitors use our website and Platform (e.g., page views, feature usage)

Up to 24 months

Yes — via cookie consent banner

Marketing

Tracking the effectiveness of our advertising campaigns (used on our website only, not within the Platform)

Up to 12 months

Yes — via cookie consent banner

10.2 Analytics Tools

We may use third-party analytics services such as Google Analytics, Mixpanel, or similar tools to understand how visitors interact with our website and Platform. These tools use cookies and collect anonymised usage data. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. We do not use analytics tools to identify individual visitors by name or email.

10.3 Managing Cookies

You can control cookies through your browser settings by blocking or deleting cookies. Please note that disabling strictly necessary cookies may affect your ability to use the Platform. We will respect your cookie preferences as indicated through our cookie consent banner, where applicable.

10.4 Do Not Track

Zula does not currently respond to browser “Do Not Track” signals. We will update this Policy if we implement DNT support in the future.

11. Children’s Privacy

The Zula Platform is not directed to individuals under the age of 19 (the age of majority in British Columbia). We do not knowingly collect personal information from anyone under 19. If we become aware that we have collected personal information from an individual under 19, we will take immediate steps to delete that information. If you believe a minor has provided personal information to Zula, please contact matin@zulalead.com immediately.

12. Subscriber Responsibilities Regarding Privacy

12.1 Subscriber as Independent Data Controller

When a Subscriber receives Lead Intelligence from Zula and uses it to contact or prospect individuals, the Subscriber acts as an independent data controller under PIPEDA and applicable privacy legislation. Zula’s role is limited to providing publicly sourced property intelligence. The Subscriber is solely and exclusively responsible for:

Establishing a lawful basis under CASL for any commercial electronic message sent to individuals identified through Lead Intelligence.
Complying with the National Do Not Call List (DNCL) for any telemarketing activity.
Handling any personal information obtained through Third-Party Append in accordance with PIPEDA and BC PIPA.
Responding to access, correction, or deletion requests from individuals they have contacted.
Reporting any breach of personal information in the Subscriber’s custody to affected individuals and the Privacy Commissioner as required by PIPEDA.
Ensuring all direct mail, digital communications, and prospecting activities comply with applicable professional regulations including BCFSA rules and real estate board codes of conduct.

12.2 No Transfer of Zula’s Privacy Obligations to Subscribers

These Terms create no data processing, data sharing, or joint controller relationship between Zula and any Subscriber with respect to the Subscriber’s own outreach activities. Zula has no visibility into, control over, or responsibility for what a Subscriber does with Lead Intelligence after it is delivered. Zula’s privacy obligations extend only to the data within Zula’s own custody and control.

12.3 Protecting User Data in the Command Centre

Subscribers are responsible for the security and confidentiality of User Data they enter into the Command Centre, including client contact records, deal notes, and uploaded documents. Subscribers should use strong passwords, not share account credentials, and log out of the Platform when not in use. Zula is not responsible for any unauthorised access to a Subscriber’s account resulting from the Subscriber’s failure to safeguard their credentials.

13. Public Records — Data Provenance & Lawful Basis

13.1 Source of Lead Intelligence Data

Zula’s Lead Intelligence is derived exclusively from publicly accessible, lawfully available data sources including:

Land Title and Survey Authority of British Columbia (LTSA)
BC Assessment Authority
Municipal open data portals and building permit registries
Provincial and federal court records where publicly filed
Publicly accessible MLS listing data and market transaction history
Other lawfully accessible government and professional registries

13.2 Lawful Basis for Processing Public Record Data

Under PIPEDA, personal information that is publicly available (as prescribed by the Regulations Specifying Publicly Available Information under PIPEDA, SOR/2001-7) may be collected, used, and disclosed without consent for purposes that are directly related to the purpose for which the information was made publicly available. Zula collects and processes public property records for the purpose of real estate market intelligence and analysis, which is directly related to the purpose for which land title, assessment, and permit records are made publicly available by government authorities.

13.3 Accuracy of Public Record Data

Zula derives its data from third-party government and professional registries. While we make commercially reasonable efforts to ensure accuracy, we are not responsible for errors, omissions, or delays originating from these source registries. We encourage individuals who identify inaccuracies in data sourced from public records to notify us at matin@zulalead.com so we can investigate and correct our records where appropriate.

13.4 Property Owner Suppression List

Property owners who do not wish their property information to be included in Zula’s Lead Intelligence may submit a suppression request to matin@zulalead.com. We will add the property to our permanent suppression list within 30 days. Suppressed properties will be excluded from all future Lead Intelligence deliveries. The suppression list is maintained indefinitely.

14. Marketing Communications

14.1 CASL Compliance by Zula

Zula complies with Canada’s Anti-Spam Legislation (CASL) in all of its own marketing communications. We will only send you commercial electronic messages where we have obtained your express consent or where we have a valid basis for implied consent under CASL. Every marketing email we send includes a clear and prominently displayed unsubscribe mechanism. We process unsubscribe requests within 10 business days.

14.2 Types of Communications

We may send the following types of communications:

Transactional emails (not marketing): Account confirmations, password resets, billing notifications, service alerts, and security notices. These are transactional messages required for the operation of your account and are not subject to CASL unsubscribe requirements.
Marketing emails (consent required): The Zula Market Pulse newsletter, product announcements, feature updates, promotional offers, and event invitations. These require your express consent and include an unsubscribe option.
Service-related communications: Personalised lead quality reports, market insights, and usage recommendations. These are delivered as part of your subscription service.

14.3 Consent Records

Zula maintains records of all marketing consent obtained, including the date, time, method, and content of the consent request, as required by CASL. These records are retained for the duration of the consent plus 36 months.

15. Changes to This Privacy Policy

15.1 Right to Amend

Zula may update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations.

15.2 Notification of Material Changes

For material changes that significantly affect how we collect, use, or disclose personal information, we will provide at least 14 days’ notice via email to your registered address and through an in-platform notification. We will also update the “Last Updated” date at the top of this Policy. For non-material changes (such as formatting corrections or clarifications), we may update the Policy without advance notice.

15.3 Continued Use

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with a material change, you may cancel your subscription before the change takes effect.

16. Contact Information & Privacy Officer

How to reach us

For any questions, concerns, access requests, correction requests, deletion requests, suppression requests, or complaints regarding this Privacy Policy or Zula’s handling of personal information, please contact our Privacy Officer.

Privacy Officer

Matin Nej

matin@zulalead.com

Subject line

Mailing address

Zula Lead Intelligence Inc., Vancouver, BC, Canada

Response time

Within 30 days of receipt

Website

zulalead.com/privacy

16.1 Complaints to Regulators

If you are unsatisfied with Zula’s response to a privacy concern, you have the right to file a complaint with:

Office of the Privacy Commissioner of Canada — www.priv.gc.ca — 1-800-282-1376
Office of the Information and Privacy Commissioner for British Columbia — www.oipc.bc.ca — 250-387-5629

Zula is committed to transparency, accountability, and the protection of personal information. If you have any questions about this Privacy Policy, we encourage you to reach out. We are here to help.

Document

Version

1.0 — Initial Release

Effective date

May 22, 2026

Next scheduled review

November 2026

This Privacy Policy was prepared as a working framework for Zula Lead Intelligence Inc. It does not constitute legal advice. Zula recommends review by a qualified British Columbia privacy lawyer before public deployment.