Privacy Policy

This policy applies to the LeaseVault web application, the tenant portal, and the public marketing pages at leasevault.ca.

For tenant records, the landlord who created the account is the organisation responsible for that personal information. LeaseVault acts as the service provider that stores and processes those records on the landlord's instructions. For account registration, billing and marketing data, LeaseVault is the organisation responsible.

We handle personal information in line with the principles of the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario privacy expectations for residential tenancy records.

• Account details: name, email address, role, password credentials held in hashed form.
• Property and tenancy records: addresses, unit configuration, lease dates, rent amounts, utility split ratios.
• Tenant information entered by a landlord: names, contact details, occupancy dates, payment history.
• Financial records: rent charges and payments, receipts, expense entries, CRA category assignments, uploaded invoices.
• Documents: leases, notices, certificates of service, inspection media, maintenance attachments.
• Communications: portal messages, email replies, delivery and read confirmations.
• Billing records: subscription plan, status and a customer reference issued by Stripe.
• Limited technical records needed to operate and secure the service, such as authentication events and error logs.

We use this information to operate the platform: generating rent ledgers and receipts, issuing utility invoices, tracking Ontario compliance dates, producing CRA T776 style exports, compiling Landlord and Tenant Board evidence packages, delivering portal and email notifications, and supporting your account.

We also use aggregate, de-identified usage information to improve the product. We do not use tenant records for advertising, profiling or resale.

We share information only with the providers required to deliver the service. Each is bound by contract to use the data solely to provide that service.

We do not sell personal information. We disclose records to a third party outside this list only where required by law, a court order, or a lawful tribunal request.

LeaseVault runs on SOC 2 Type II certified cloud infrastructure, with database and file storage located in Canada where the region is available. Data is encrypted at rest and protected by TLS in transit. Some providers, including Stripe and email delivery, may process limited data outside Canada and remain subject to Canadian privacy obligations through contract.

Documents and files

• Leases, identification, receipts, inspection media and vault records are held in private storage. They are not publicly listed and are not indexed by search engines.
• Viewing or emailing a document produces a cryptographically signed link that expires automatically.
• Revoking a recipient's access immediately invalidates links shared with them earlier.
• Uploads are size limited and validated against the actual file contents, so a file renamed to look like a PDF or image is rejected.

Account separation

• Access rules are enforced inside the database, not only in the application interface, so records cannot be reached by altering a web request.
• A landlord sees only records belonging to their own account and to co-landlords they have explicitly invited.
• A tenant sees only their own unit. Other tenants' leases, ledgers, tickets and utility shares are not visible to them.
• Marketing and referral analytics record a timestamp and campaign code only. We do not record IP addresses or browser fingerprints for that purpose.

Payments

• Subscription billing is processed by Stripe, a PCI-DSS Level 1 certified provider.
• Card numbers, security codes and banking credentials never reach LeaseVault servers or database. We retain only a customer reference issued by Stripe.
• Plan level, trial state and paid access can only be changed by verified billing events, never from the browser.

Record keeping and Ontario compliance

• Ledger entries, charges, notices and proof of service are date stamped as they are created.
• Rent increase timing follows Residential Tenancies Act rules, including the twelve month interval and ninety day notice minimum.
• Landlord and Tenant Board evidence packages are compiled from live records rather than from an editable document.

We keep records only as long as they are needed for the purposes described above or for the statutory periods below, whichever is longer. When a period ends, records are deleted or irreversibly de-identified.

If a landlord closes an account, tenant records tied to that account are removed on the same schedule. A tenant who wants their information corrected or removed should contact their landlord first, since the landlord controls those records.

You retain full ownership of the property, tenant and financial records you create. We never claim ownership of them.

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or incomplete.
• Export: download your ledgers, receipts, expenses and documents at any time.
• Deletion: request permanent deletion, subject to the retention periods above.
• Withdraw consent: unsubscribe from non-essential email at any time.

Requests are answered within thirty days. Write to privacy@leasevault.ca. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

LeaseVault is intended for adults entering residential tenancy agreements. We do not knowingly collect information from children. Please do not upload health records, government identification numbers or other sensitive information unless it is genuinely required for the tenancy.

If a breach of security safeguards creates a real risk of significant harm, we will notify affected account owners and the appropriate regulator without undue delay, and describe what happened and what you should do.

We may update this policy as the platform evolves. Material changes are announced in the application before they take effect. Questions about this policy can be sent to privacy@leasevault.ca. See also our Terms of Service.