Privacy Policy

Plain-English summary

ProperLease is a software tool for landlords to manage their own rental properties. To work, we need to store information you put in: your account details, your properties, your tenants, the documents you upload, and a record of the rent payments you log.

We do not sell that information. We do not share it with advertisers. We do not analyze it for purposes unrelated to running the service. We use the small number of third-party companies listed below to host, secure, bill, and email you, and we hold each of them to the same standard we hold ourselves.

Who is responsible for your data

ProperLease (referred to as we, us, or ProperLease) operates the website at properlease.app and the iOS / Android apps. We are the data controller for the personal information you provide directly to us as a customer.

When you, as a landlord, upload information about your tenants (their names, contact details, government IDs, lease documents, and so on), ProperLease acts as a data processor on your behalf. You remain the data controller for that tenant information, and you are responsible for having a lawful basis to collect and store it. See the section on tenant data below.

Privacy questions or requests can be sent to hello@properlease.app. For users in Quebec, the same address reaches our designated Privacy Officer under An Act respecting the protection of personal information in the private sector (Law 25).

What we collect

Account information

Your email address, full name, and password (stored as a cryptographic hash, never as plain text). Optionally a phone number and mailing address. The country and currency you operate in. Your subscription plan.

Property and tenancy data you enter

Information about your properties (address, type, deposits, utilities), your tenants (name, contact details, occupancy unit), and your leases (start and end dates, rent amount, deposit amount, terms).

Documents you upload

Tenant government IDs, insurance certificates, signed lease agreements, move-in and move-out condition reports, proof of income, co-signer agreements, and any other documents you choose to upload to the tenant document vault.

Financial activity

The rent payments you log, the expenses you track, and the utility bills you record. This is operational data you enter, not transactional data we collect by watching your bank account.

Payment information

Subscription payments are handled by Stripe. We never see or store your full credit card number. Stripe shares with us a customer ID, the last four digits of your card, the card brand, and the expiry date. Refer to Stripe's privacy policy at stripe.com/privacy for how they handle your card data.

Technical information

When you use the site, our servers automatically receive standard web log information: your IP address, browser user-agent, and the pages you visit. We use this for security (detecting abuse) and to debug errors. We do not use it for behavioral profiling or ad targeting.

Why we have it

The legal bases under which we process your personal data:

• Contract performance. We process your account information, property and tenant data, and document uploads because they are necessary to provide the service you signed up for. Without them, the app cannot function.
• Legitimate interest. We process technical information (IP, browser, error logs) to keep the service secure, debug issues, and prevent fraud. The processing is limited to what is needed for these purposes.
• Legal obligation. Tax records, payment history, and certain financial information may be retained as required by Canadian and US tax law.
• Consent. Optional features (for example, marketing emails) operate on consent that you can withdraw at any time from your Account page.

Where your data lives

ProperLease runs on cloud infrastructure located in Oregon, USA (specifically AWS US-West-2, operated by our database and storage provider). Your data is encrypted while it travels between your browser and our servers (TLS 1.3) and while it sits at rest (AES-256). Every landlord's account is isolated at the database level so other users cannot see your records, even by accident.

For users in jurisdictions that require disclosure of cross-border data transfer (including Quebec under Law 25, and residents of the European Union), this Privacy Policy serves as that disclosure. The transfer is necessary for service delivery and is governed by Standard Contractual Clauses with each sub-processor where applicable.

What we can't read

Some fields are encrypted a second time, before they ever reach the database, with a key that belongs to your account alone. The key is held by a separate service and is never stored next to your data. Today that covers your property address and the other property details, and your tenants' names, phone numbers, notes, and document locations. Tenant email addresses are not yet on this list, because we need them in plain form to send reminders on your behalf; we're working on that.

In practice, this is what our own database holds for a tenant named Sarah Jenkins at 123 Main St:

The example is illustrative: the real values are longer and change every time a field is saved, even for identical text. Running SELECT name FROM tenants in our database console returns "column does not exist", because the readable column is gone. Decryption happens only inside the request that serves your own signed-in session.

Companies that help us run ProperLease

We use a small number of third-party providers to operate the service. Each is contractually required to protect your data to a standard equivalent to ours.

How long we keep it

We keep your data for as long as your account is active. When you delete your account, we delete the associated records and uploaded documents from our active systems within 30 days.

Some categories are kept longer for legitimate reasons:

• Financial records (subscription payments, invoices) are retained for seven years to comply with Canadian Revenue Agency and IRS record-keeping requirements.
• Tenant documents uploaded by you are retained for as long as you keep the tenant on file, then auto-deleted seven years after the tenant's lease ends. The seven-year window aligns with tax-record retention for rental income.
• Backups may take up to 90 days to fully expire after deletion from active systems.

Your rights

Depending on where you live, you have some or all of the following rights with respect to your personal information:

• Access a copy of the information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your account and the associated personal data.
• Export your data in a portable format (CSV / PDF) at any time.
• Object to certain processing, or restrict how we use your data.
• Withdraw consent for optional processing at any time.

To exercise any of these rights, write to hello@properlease.app. We will respond within 30 days. If you are not satisfied with our response, you may contact your local data protection authority (the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your EU member-state DPA, as applicable).

A note on tenant data

ProperLease's landlord customers upload information about their tenants (names, contact details, government-issued IDs, and so on) as part of normal property-management workflows. The landlord is the data controller for that information, and ProperLease processes it on their behalf as a data processor.

If you are a tenant whose landlord uses ProperLease and you want to exercise your rights with respect to your information, your first step is to ask your landlord directly. You may also contact us at hello@properlease.app and we will work with your landlord to respond. For users in jurisdictions that grant tenants direct rights against processors, we will respond on the same timeline as our customers.

Children's information

ProperLease is not directed to anyone under the age of eighteen. We do not knowingly collect personal information from a child. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you have an account) and post a notice on the site at least 30 days before the change takes effect. Continued use of ProperLease after a change indicates that you accept the revised policy.

How to contact us

For any privacy-related question, including to exercise your rights, contact us at hello@properlease.app. We are based in Ontario, Canada.