Privacy policy

The short version

LandlordKit is a compliance tool for Ontario landlords. To calculate notice dates and fill official Landlord and Tenant Board forms, it holds information about your properties, your tenancies, and your tenants. That last category is personal information about people who are not our customers, and we treat it accordingly: we collect the minimum the forms require, we do not sell it, we do not use it to train anything, and we run no third-party analytics on the pages that display it.

Who is responsible for what

You, the landlord, decide what tenant information to enter and why. Under Canadian privacy law you are the organization accountable for that information. We process it on your behalf, to provide the service to you, and for no other purpose. If one of your tenants asks us directly about their information, we will refer them to you, because we cannot verify their identity or your relationship with them.

What we collect

Account information

• Your name and email address.
• A hash of your password. We never store the password itself and cannot recover it.
• If you enable two-factor authentication, the shared secret and your backup codes.
• Session records, including IP address and browser user agent, so you can see and end your own sessions and so we can rate limit sign-in attempts.

Portfolio information

• Properties, units, and their rent control status and first occupancy dates.
• Tenancies: lease dates, rent amounts, the date of the last lawful increase, and standard lease request and provision dates.
• Tenant contacts: name, and optionally email address and phone number. Nothing else is asked for, because nothing else is needed to fill a notice.
• Rent ledger entries: what each tenancy was charged and what it paid, with the date and the method the money arrived by. Entered by hand, or confirmed by you from a bank connection you set up. We never collect your tenants' rent for you and hold no card or bank account details for them. (Your own subscription payment is separate, and described below.)
• If, and only if, you connect a bank: the deposits from that one account that match or could match a rent payment, with the date, the amount, the direction, and the description your bank supplied. On a rent deposit that description is usually a tenant's name, which is why it is listed here rather than treated as a technical detail. Every other transaction in the account is discarded as it arrives and is never written down.
• Notice records, each with a frozen snapshot of the data used to generate it. That snapshot is the audit trail, and it is the point of the product.

If you only left us an email address

The form on our home page asks visitors who are not ready to create an account for an email address so we can write when an Ontario rule changes. If that is all you have given us, then that address, the page you gave it on, and the date is the entirety of what we hold about you. We do not add a name, an IP address, or anything else, we do not pass it to anyone, and we do not send advertising to it. Write to privacy@landlordkit.ca and we will delete it.

What we do not collect

• No payment card details. If you subscribe, payment is taken on a page hosted by Stripe and your card number never reaches us. We hold a customer reference and whether the subscription is current, nothing more.
• No banking credentials. If you connect a bank, you sign in to it on Plaid's own page and your banking password never reaches us. We hold a read-only access key, encrypted, and the last four digits of the account. Never a full account number, never a balance, and nothing that could move money.
• No social insurance numbers, dates of birth, credit checks, or identity documents. There is nowhere in the product to put them.
• No third-party advertising or analytics trackers.

Why we hold it

Solely to provide the service: calculating compliance dates, filling the official forms, keeping the audit trail behind them, and letting you sign in securely. We also use your email address to send you transactional messages such as password resets, address confirmation, and team invitations.

Where it is stored

The database that holds everything described above runs in Canada, and so does the application itself: every page you load, every form you submit, and the daily reminder job all run on servers in Montréal, Canada. Your records are read and written in Canada rather than being sent elsewhere to be processed.

Two things still leave the country, and we would rather say so than imply otherwise. Email is delivered by a provider in the United States, so any message we send you passes through it. And the files that make up the web page itself (the code and styling, never your records) are served from a global network so that pages load quickly wherever you are.

• Supabase: Database hosting, which holds all portfolio and tenant records. Located in Canada (ca-central-1).
• Vercel: Application hosting. Every page, form submission and background job that reads or writes your records runs here. Located in Montréal, Canada (yul1, ca-central-1).
• Resend: Transactional email: password resets, address confirmation, team invitations, and the daily compliance reminder. Located in the United States.
• Stripe: Subscription billing. If you subscribe, your name, email address and payment details are handled by Stripe. Located in the United States.
• Plaid: An optional bank connection, so rent deposits can be matched against the ledger without being typed in. Nothing reaches Plaid unless you connect a bank yourself. Located in the United States and Canada.

We are not claiming this arrangement satisfies any particular legal test for data residency. It describes where the work happens.

The bank connection, in detail

The rule for it was settled before any of it was built, and it is deliberately strict: transactions are filtered as they arrive, and only those that match or plausibly match a rent payment are stored at all. The rest are never written down, not even as a count of how many there were. Matching your rent deposits does not require us to keep a record of your shopping.

Only the one account you choose is read, and only the most recent months of it. Nothing the connection finds is added to your ledger by itself: each deposit waits until you say which tenancy it belongs to. Disconnecting stops the access and deletes the transactions gathered from it, while the payments you had already confirmed stay on your ledger, because those are your own record of money you received.

How long we keep it

For as long as your account is open. Notice records are deliberately durable: voiding a notice marks it voided and never deletes it, because a compliance audit trail with gaps in it is not an audit trail. When you delete your organization, its properties, units, tenancies, tenant contacts, notice records and any bank connection with the transactions it gathered are deleted along with it, permanently and without a recovery window. Export first if you want a copy.

An email address left on the home page is separate from all of that. It is not attached to any account, so it is not in the export and deleting an organization does not remove it. We keep it until you ask us to delete it.

Your rights

You can see everything we hold for your organization at any time, without asking us: the settings page exports the complete contents of your account as a JSON file, including every tenant record and every notice snapshot. You can correct any of it directly in the app, and you can delete your organization and your account yourself.

If you would rather make a formal request for access, correction, or deletion, or if you want to complain about how we have handled personal information, write to privacy@landlordkit.ca. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

Security

• All traffic is encrypted in transit.
• Passwords are stored as hashes, and optional two-factor authentication is available on every account.
• The application connects to the database as a restricted role that cannot alter the schema.
• Sign-in, password reset, and second-factor attempts are rate limited across the whole deployment.
• Team invitations are stored as hashes, so a leaked backup contains no working invitation links.

No system is perfect. If we discover a breach that creates a real risk of significant harm, we will notify affected customers and the Privacy Commissioner as Canadian law requires.

Changes

If this policy changes in a way that materially affects you, we will tell you by email before the change takes effect. The date at the top of this page always reflects the current version.

Contact

Questions about this policy go to privacy@landlordkit.ca.