Privacy Policy

Effective date: August 5, 2026
Last updated: August 5, 2026

1. About this Privacy Policy

This Privacy Policy explains how Gnowise Inc., operating the Luka platform under the name “Luka” (“Luka,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information.

This Privacy Policy applies to:

• askluka.ca and any related Luka websites;
• Luka accounts and account-management functions;
• Luka’s property-intelligence, valuation, financial-analysis, document-analysis, listings, portfolio, monitoring, reporting, transaction, referral, voice, and artificial-intelligence features;
• communications with Luka;
• related applications, plugins, APIs, and services that link to this Privacy Policy.

This Privacy Policy does not govern independent third parties that maintain their own privacy policies.

2. Privacy Officer

Luka has designated a person responsible for privacy compliance.

Privacy Officer: Legal
Email: legal@gnowise.com

Questions, complaints, access requests, correction requests, withdrawal-of-consent requests, and deletion requests may be directed to the Privacy Officer.

3. Information We Collect

Depending on how you use Luka, we may collect the following categories of information.

3.1 Account information

This may include:

• name;
• email address;
• encrypted or securely hashed authentication information;
• Google sign-in identifier, where Google sign-in is used;
• account status;
• language and communication preferences;
• user role;
• declared knowledge or familiarity levels;
• presentation and accessibility preferences;
• consent selections;
• credit balance, subscription, and transaction status.

Luka does not receive your Google password.

3.2 Property and listing information

This may include:

• property address;
• unit number;
• postal code;
• municipality and province;
• geographic coordinates;
• property type and style;
• bedrooms, bathrooms, living area, lot area, parking, age, condition, and other property characteristics;
• listing identifiers, listing price, listing status, and listing history;
• property photographs or documents that you choose to provide;
• valuation, rent, liquidity, forecast, climate, zoning, permit, transaction, and related property-intelligence results.

Some property information may come from public records, licensed data providers, listing feeds, municipal sources, or other third-party sources.

3.3 Financial and transaction information

You may provide information such as:

• purchase price;
• down payment;
• mortgage amount, term, rate, and amortization;
• income, expenses, assets, liabilities, or cash reserves;
• estimated closing costs;
• rental income and operating costs;
• offer dates, closing dates, conditions, and transaction deadlines;
• portfolio budgets and investment objectives;
• insurance, financing, appraisal, or inspection outcomes.

Do not submit Social Insurance Numbers, complete bank-account credentials, payment-card numbers, medical records, or other information that Luka does not specifically request.

3.4 Documents and extracted information

You may upload documents such as:

• inspection reports;
• appraisal reports;
• status certificates;
• reserve-fund studies;
• purchase agreements;
• financing documents;
• insurance documents;
• permits;
• property reports;
• other user-selected documents.

Luka may extract text and structured findings from uploaded documents.

Unless a different retention option is clearly presented and selected, Luka is designed to delete original uploaded documents after extraction or processing. Extracted text, findings, hashes, metadata, or report references may be retained where needed to provide the service, maintain an audit trail, create a report, or satisfy your selected retention settings.

Documents that are scanned, image-only, encrypted, handwritten, or technically complex may require optical character recognition or specialized processing and may not be processed accurately.

You must have the right and authority to upload any document or personal information relating to another person.

3.5 Questions, conversations, and voice interactions

We may collect:

• questions submitted to Luka;
• chat messages;
• feedback;
• user corrections;
• voice transcripts, where voice features are used;
• interaction context needed to generate a response;
• selected property or case context.

Voice features may rely on third-party speech-processing or AI providers. Do not use voice input to provide highly sensitive information.

3.6 Outcomes and learning information

Where you choose to record an outcome, we may collect information such as:

• whether an offer was made, accepted, or rejected;
• inspection findings;
• appraisal results;
• financing approval or decline;
• insurance decline or surcharge;
• transaction closing;
• achieved sale price or rent;
• vacancy period;
• renovation cost;
• permit outcome;
• later resale outcome.

You may be offered separate choices such as:

• Private use: information remains limited to your cases;
• Aggregate learning: de-identified information may contribute to aggregate analysis;
• Research improvement: de-identified information may be used to improve methods under the applicable retention and governance rules.

Luka does not represent that de-identification eliminates every theoretical re-identification risk.

3.7 Payment information

Payments may be processed by a third-party payment processor such as Stripe.

Luka may receive:

• transaction identifier;
• payment status;
• subscription status;
• billing name or address;
• card brand and limited card details, such as the last four digits;
• refund, chargeback, or failed-payment information.

Luka generally does not receive or store complete payment-card numbers.

3.8 Technical and usage information

We may automatically collect:

• IP address;
• browser and device type;
• operating system;
• date and time of access;
• pages or features used;
• security and authentication events;
• error and performance information;
• provider latency and service status;
• cookie or session identifiers;
• approximate location inferred from IP address;
• audit and rate-limit information.

We do not use time spent on a section as an automatic measure of your knowledge or competence.

3.9 Communications and referrals

We may collect information when you:

• contact support;
• request a demonstration;
• subscribe to permitted communications;
• provide feedback;
• request an advisor or service-provider introduction;
• submit a referral.

Luka does not permit anonymous users to submit another person’s contact information through referral features. You must have permission before providing another person’s information.

4. How We Use Information

We may use personal information to:

1. create, authenticate, secure, and administer your Luka account;
2. provide property, listing, valuation, rent, financial, climate, zoning, document, portfolio, transaction, and related intelligence;
3. respond to your questions;
4. personalize vocabulary, ordering, explanation depth, and interface preferences;
5. preserve deterministic conclusions, warnings, evidence, and professional boundaries;
6. verify or revise property attributes when you dispute a valuation;
7. generate reports and portable analysis packages;
8. monitor selected properties and transaction deadlines;
9. retry incomplete or degraded analyses;
10. process payments, credits, subscriptions, refunds, and account status;
11. provide customer service;
12. send service, security, monitoring, deadline, and account communications;
13. send marketing communications where permitted and where appropriate consent exists;
14. investigate fraud, misuse, security incidents, or violations of our Terms of Use;
15. maintain operational logs, audit records, rate limits, and service reliability;
16. calculate aggregate product, accuracy, reliability, and cost statistics;
17. improve Luka’s models, methods, interfaces, and services where permitted;
18. comply with legal, regulatory, contractual, tax, accounting, or security obligations;
19. establish, exercise, or defend legal claims;
20. complete a business transaction, reorganization, financing, sale, or transfer, subject to appropriate protections.

We will not use personal information for a materially incompatible new purpose without providing notice and obtaining consent where required.

5. Artificial Intelligence and Automated Analysis

Luka uses deterministic calculations, rules, external data, statistical methods, and artificial-intelligence services.

AI-generated content may be incomplete, inaccurate, outdated, misleading, or unsuitable for your circumstances. AI output is not a substitute for independent verification or professional advice.

Where relevant, information supplied to an AI provider may include:

• your question;
• selected case facts;
• property information;
• extracted document text;
• calculations;
• evidence records;
• prior conversation context;
• instructions necessary to generate a response.

Luka is designed to limit unnecessary personal information sent to AI providers. However, information you voluntarily include in a question or uploaded document may be processed by those providers.

AI providers are not permitted through Luka’s internal architecture to directly access Luka’s databases, database credentials, or arbitrary database tables. Database searches are performed through controlled and allow-listed mechanisms.

Luka does not permit AI-generated text by itself to create or publish verified property facts, empirical priors, outcomes, or reviewed local knowledge.

Luka may use automated systems to generate estimates, rankings, warnings, or explanations. These outputs are informational only and are not decisions made by a lender, insurer, appraiser, government, lawyer, accountant, engineer, real-estate professional, or other regulated professional.

Where applicable law provides rights concerning automated decisions, you may contact the Privacy Officer to request information about the personal information used and the principal factors or reasons involved.

6. Consent

We obtain consent in a manner appropriate to the sensitivity of the information and the purpose for collection, use, or disclosure.

Consent may be:

• express;
• implied where legally permitted;
• provided through account settings;
• provided through a feature-specific control;
• withdrawn, subject to legal or contractual restrictions.

Withdrawing consent may prevent Luka from providing some or all services. Withdrawal does not invalidate processing already lawfully completed.

We do not condition access to a service on consent to unnecessary collection, use, or disclosure where prohibited by law.

7. When We Disclose Information

We may disclose information to the following categories of recipients.

7.1 Service providers

These may include providers of:

• website and shared-hosting infrastructure;
• cloud hosting;
• database and storage services;
• authentication;
• email delivery;
• payment processing;
• customer support;
• security and fraud prevention;
• analytics and performance monitoring;
• AI and language-model processing;
• voice transcription or generation;
• document extraction and OCR;
• mapping and geocoding;
• property, listing, valuation, climate, zoning, permit, and market data.

Service providers are permitted to process information only for authorized purposes, subject to contractual, technical, and legal controls appropriate to the circumstances.

7.2 Property and professional services

At your request, we may disclose information needed to facilitate contact with:

• real-estate professionals;
• mortgage professionals;
• appraisers;
• inspectors;
• lawyers;
• accountants;
• insurance professionals;
• contractors;
• other advisors or service providers.

Those providers are independent parties and may have their own privacy obligations and policies.

7.3 Legal and safety disclosures

We may disclose information where reasonably necessary to:

• comply with a law, subpoena, warrant, court order, or regulatory demand;
• protect Luka, users, or the public;
• investigate fraud, abuse, security incidents, or unlawful conduct;
• enforce agreements;
• establish, exercise, or defend legal rights.

7.4 Business transactions

Information may be disclosed in connection with a proposed or completed:

• financing;
• merger;
• acquisition;
• reorganization;
• sale of assets;
• insolvency proceeding;
• transfer of business.

We will seek appropriate confidentiality and privacy protections.

8. Cross-Border Processing

Luka and its service providers may process or store information outside your province or outside Canada.

When information is processed in another jurisdiction, it may be accessible to courts, regulators, law-enforcement agencies, or national-security authorities under the laws of that jurisdiction.

We use contractual, organizational, and technical safeguards appropriate to the sensitivity of the information. Cross-border processing does not eliminate our accountability under applicable Canadian privacy law.

9. Cookies and Similar Technologies

Luka may use cookies, local storage, session storage, and similar technologies for:

• authentication;
• account security;
• session continuity;
• language and interface preferences;
• fraud prevention;
• rate limiting;
• feature operation;
• performance measurement;
• permitted analytics.

Essential cookies may be required for Luka to operate.

Where consent is legally required for non-essential technologies, Luka will request that consent through an appropriate mechanism.

Luka does not use the administrator AI assistant to store chat history in browser local storage or session storage.

10. Marketing Communications

We may send promotional electronic communications only where permitted by law.

Marketing communications will include appropriate sender identification and an unsubscribe mechanism. Unsubscribe requests will be processed as required by law.

You may continue to receive non-promotional communications concerning:

• your account;
• security;
• payments;
• requested reports;
• monitoring;
• transaction deadlines;
• service changes;
• legal notices.

11. Retention

We retain information only for as long as reasonably necessary for the identified purposes, subject to legal, security, accounting, contractual, dispute-resolution, and backup requirements.

Retention periods may vary depending on:

• whether your account remains active;
• the feature used;
• your selected retention or consent scope;
• whether information forms part of a report or integrity manifest;
• fraud and security requirements;
• statutory limitation periods;
• tax and accounting obligations;
• unresolved complaints or disputes.

Where appropriate, information may be:

• deleted;
• anonymized;
• aggregated;
• archived with restricted access.

Deletion from active systems may not result in immediate deletion from encrypted backups. Backup information will remain protected and will be removed or overwritten through the normal backup lifecycle.

12. Security

We use administrative, technical, and physical safeguards appropriate to the nature and sensitivity of the information.

Measures may include:

• encrypted communications;
• password hashing;
• secure authentication and session controls;
• role-based access;
• administrator restrictions;
• database credential separation;
• read-only database permissions;
• signed gateway requests;
• request replay protection;
• rate and response-size limits;
• file-containment controls;
• activity logging;
• provider circuit breakers;
• bounded data processing;
• retention and deletion processes.

No internet transmission, shared-hosting service, software system, AI provider, or storage system can be guaranteed completely secure. You provide information at your own risk.

You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly of suspected unauthorized access.

13. Privacy and Security Incidents

We maintain procedures to assess and respond to suspected privacy and security incidents.

Where required by law, we may:

• maintain an incident record;
• notify affected individuals;
• notify a privacy regulator;
• take steps to reduce the risk of harm;
• provide information concerning protective measures.

14. Your Privacy Rights

Subject to applicable law and permitted exceptions, you may request:

• access to personal information about you;
• correction of inaccurate or incomplete information;
• deletion of information;
• withdrawal of consent;
• information about how your information has been used or disclosed;
• a portable copy of eligible computerized information in a structured and commonly used format;
• information about qualifying automated-decision processes;
• review of a privacy complaint.

We may need to verify your identity before fulfilling a request.

We may refuse or limit a request where permitted or required by law, including where disclosure would reveal another person’s information, confidential commercial information, privileged information, security information, or information that cannot legally be deleted.

We may retain a record of a deletion or access request as evidence of compliance.

15. Account Deletion

Where account deletion is available, it initiates deletion or de-identification of eligible account information and user-owned records.

Deletion may not include:

• information we must retain by law;
• payment and accounting records;
• security, fraud, and abuse-prevention records;
• information needed to resolve a dispute;
• independently sourced public or licensed property information;
• information already validly de-identified or aggregated;
• records retained with another person’s independent account;
• backup copies pending normal deletion.

Account deletion is permanent and may prevent recovery of reports, cases, documents, outcomes, credits, and preferences.

16. Children

Luka is not intended for children under 18.

We do not knowingly collect personal information directly from children under 18 without legally valid authorization. A parent or guardian who believes a child has provided personal information may contact the Privacy Officer.

17. Third-Party Websites and Services

Luka may contain links to or integrations with third-party websites or services.

We do not control and are not responsible for their:

• privacy practices;
• security;
• accuracy;
• availability;
• terms;
• content.

Review the third party’s policies before submitting information.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• legal or regulatory changes;
• new or modified features;
• changes in service providers;
• changes in data practices;
• security or operational improvements.

The updated version will show a revised “Last updated” date.

Where changes are material, we will provide additional notice or obtain consent where required.

19. Questions and Complaints

Contact the Privacy Officer first so that we may investigate and respond.

Privacy Officer: Legal
Email: legal@gnowise.com

You may also have the right to contact the applicable federal or provincial privacy regulator.

20. Controlling Language

This Privacy Policy may be available in English and French.

If the versions conflict, the controlling version will be determined in accordance with applicable law. Nothing in this section limits language rights that cannot legally be waived.