Privacy policy — DRAFT

This is a working draft for the initial OSASI member review period, not a finalized privacy policy. It describes the current application workflow and identifies matters still to be settled before a public launch. Last updated: September 28, 2026.

Scope: invitation requests, optional AI expressions of interest, account access, and private application review at marketplace.osasi.org (formerly review.osasi.org). Other OSASI tools and any future hosted AI service require separate review.

Who is responsible

To be finalized: the legal operator, its jurisdiction, and a designated privacy contact have not yet been established.

Optional expression of interest in OSASI-hosted AI models

We are exploring hosting one or more dedicated open-weight AI models for participating members, running on infrastructure we operate rather than relying on a commercial provider’s hosted AI service.

The optional expression of interest (EOI) helps us assess interest, potential uses, and hosting requirements. We use the answers you choose to provide for this planning and to follow up about the initiative. Expressing interest does not commit you to participating or paying, and leaving this section blank does not affect consideration of your invitation request.

Completing the EOI does not provide permission to access your MLS account or use your MLS, client, or appraisal data in a future AI service. The proposed service is still being explored; its data practices will be explained separately before participants provide data to it.

Information you provide

When you request an invitation, we collect your name, email address, role, interests, and the explanation you submit. You may optionally provide your MLS or real estate board, country and state/province, and the interfaces you use.

If you complete the optional AI expression of interest, we also collect the organization, location, participation interests, likely usage, possible contribution range, and comments you choose to provide. A possible contribution is an indication of interest, not a payment or financial commitment. We do not ask for payment details on these forms.

Please provide MLS and portal names only. Do not send passwords, access codes, client records, confidential appraisal information, or information about others through these forms.

Why we use it

We use information you submit to consider and respond to your request, manage invitations and account access, plan support for members' MLS systems, and provide important OSASI updates. These may include changes affecting access, service availability, security, privacy practices, or the initial member review period. We use optional EOI answers to assess interest in hosting dedicated open-weight AI models, understand potential uses and requirements, and follow up about that initiative.

Leaving the optional MLS or AI questions blank does not prevent consideration of your invitation request. Submitting an EOI does not commit you to participating or paying.

Service providers and access

The current application workflow uses Netlify for website hosting, form submissions, and application review storage; Supabase for account authentication and invitations; and Brevo for application acknowledgements, administrator notifications, and login-related email. Authorized administration also involves receiving and reviewing messages in OSASI's email service.

These providers process information needed to deliver their services. The administrator notification includes the applicant's name and email and a link to the private review page. Access to application review is restricted to the authorized administrator account.

To be finalized: provider processing locations, international transfers, and any additional service providers or support access. This draft does not promise that information stays in one country.

MLS suggestions and AI

MLS suggestions come from a public organization directory. Search text is filtered in your browser rather than sent to an external search or AI service. Your submitted answer remains part of your private application; it is not automatically added to the public suggestions.

The current application workflow does not send your answers to an AI model for processing or training. The proposed hosted AI service is still being explored. Its data practices will need to be explained separately before participants provide data to that service.

Cookies and technical information

Sign-in uses authentication cookies to recognize an authorized session. Hosting, authentication, and email providers may also process technical information such as connection details, delivery events, and security or error logs to operate the services.

To understand which pages are used, the site counts page views with GoatCounter, a privacy-focused analytics service. It sets no cookies and does not collect names, email addresses, or anything you type. For each page view it records the page address, the referring site, browser and screen size, and an approximate country; your IP address is used only to derive the country and is not stored. It also counts when a file is downloaded or shared from a tool, recording only the page and the file type, never the file name or its contents. Sign-in and administrator pages are not counted.

To be finalized: a site-wide inventory of cookies and email tracking, including any choices needed for nonessential tracking.

Retention and safeguards

Application records, account records, email messages, and delivery records exist in different systems. Access controls and encrypted web connections help protect information, but no service can guarantee absolute security.

To be finalized: retention and deletion periods for applications, EOI responses, accounts, email, delivery records, and backups. Automatic deletion of application records is not currently implemented.

Your choices and requests

You may ask to access or correct information you provided, withdraw optional EOI participation, or request deletion or account closure through your existing OSASI contact during this initial member period. A dedicated privacy contact is still to be designated. We may need to verify your identity. We will explain any information that must be retained and any limitations required by applicable law. Withdrawing information necessary for account administration may affect our ability to provide account access.

To be finalized: the responsible person, applicable response deadlines, and complaint routes for the operator’s jurisdiction. Regional provisions, including Canada, the United States, the EU/EEA, and the UK, have not yet been settled.

Changes

We will date this policy and publish updates here. If a proposed new use of information requires additional notice or consent, that should be addressed before the new use begins.