How we handle your data.

TenantBay Inc. ("TenantBay," "we," "us," or "our") is a property management software platform incorporated and operating in Toronto, Ontario, Canada. Our handling of personal information is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, to Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and other provincial privacy legislation.

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you visit our website, create or use a TenantBay account, submit a form, sign a document through TenantBay, or otherwise interact with our platform or services (collectively, the "Service").

Two different relationships. For the personal information of our customers, the individual landlords and team members who hold a TenantBay account, we act as the organization accountable for that information and this Privacy Policy governs directly. For the personal information of tenants, prospective tenants, applicants, vendors, and other third parties that a customer enters into the platform, the customer is the party accountable for that information (its "controller"), and TenantBay acts as a service provider ("processor") handling it on the customer's documented instructions. If you are a tenant, applicant, or vendor and want to access, correct, or delete records a landlord holds about you, please contact that landlord directly; we will support them in responding to your request. Business customers who require a written data processing agreement (DPA) may request one at privacy@tenantbay.com.

We collect personal information in the following categories, depending on how you interact with the Service:

• Account and identity information: name, email address, phone number, hashed password credentials, role, account status, and authentication metadata including OAuth tokens from Google or Facebook login.
• Property and operations data: property addresses, unit details, rent amounts, occupancy status, listing information, visit schedules, inspection records, issue logs, maintenance notes, and utility records.
• Tenant, applicant, and contact data: names, email addresses, phone numbers, lease dates and terms, deposit records, onboarding status, inquiry history, communications, screening notes, and move-in/move-out records entered by landlord customers.
• Financial and subscription data: plan type, billing cycle, payment method type (not full card numbers), Stripe customer and subscription identifiers, invoice history, payment status, and transaction metadata. Full payment card data is processed directly by Stripe and is not stored on TenantBay servers.
• Documents and media: lease agreements, signed PDFs, e-signature records (including signer identity and signing timestamp), uploaded identity documents, listing images, receipts, and files stored or generated within the platform.
• AI and automation inputs: prompts, conversation messages, AI tool results, lead content processed for prescreening, workflow trigger logs, and AI feature usage records.
• Integration and channel data: Meta page identifiers, Facebook and WhatsApp access tokens and webhook metadata, lead messages ingested from connected social or marketplace integrations, and SMS channel metadata.
• Support and contact form data: messages submitted through our public contact form or support channels, and RepairBay vendor registration details.
• Device, usage, and security data: IP address, browser type, operating system, device identifiers, pages viewed, feature usage, session timestamps, referral source, and anti-abuse signals used for security and product improvement.

We collect personal information through the following means:

• Directly from you: when you register, set up your account, enter property or tenant records, submit forms, upload documents, contact support, or use AI features.
• From your tenants and applicants: when you or they submit inquiry forms, lease signing requests, maintenance requests, or other inputs through landlord-provided links or channels.
• From third-party integrations: when you connect Facebook, WhatsApp, Google, or other platforms, we receive data according to the permissions you grant those services.
• Automatically: through cookies, server logs, and analytics tools when you visit and interact with our website or platform. See the “Cookies and Tracking” section below for details.

We use personal information for the following purposes, on the basis of consent and accountability described in the “Consent and Accountability” section below:

• Provide, operate, maintain, secure, and improve the TenantBay platform and its features.
• Authenticate users, manage accounts, sessions, roles, and access permissions.
• Store, display, and process data for properties, tenants, leases, payments, inquiries, visits, issues, and repairs on behalf of landlord customers.
• Process subscription payments, generate invoices, manage billing cycles, and handle payment failures.
• Send transactional messages, account alerts, security notifications, and service-related communications.
• Deliver AI-assisted features including portfolio summaries, conversational Q&A, lead prescreening, search, and automation workflows.
• Facilitate document generation, PDF creation, e-signature delivery, and signed document storage.
• Ingest, route, and display multi-channel inquiry messages (WhatsApp, Facebook, SMS, phone) within the platform inbox.
• Connect landlords with RepairBay vendors, facilitate job posting and bidding, and track maintenance costs.
• Analyze usage patterns, diagnose technical issues, and improve platform performance and reliability.
• Detect, investigate, and prevent fraud, abuse, unauthorized access, and policy violations.
• Comply with applicable laws, respond to lawful regulatory or governmental requests, and enforce our terms and policies.
• Send marketing communications where you have provided consent, consistent with CASL (see the “Marketing Communications and CASL” section below).

We have designed our privacy practices around the ten fair-information principles of PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. As a newly launched platform, we are actively building out our privacy program and are committed to strengthening it over time. Where Quebec's Law 25 applies to a customer's use of the Service, we work to support its additional requirements, such as transparency about automated processing and designating a person responsible for the protection of personal information.

We aim to collect only the information necessary for the identified purposes, and we seek consent appropriate to the sensitivity of the information, whether express or, where permitted, implied by the context of your interaction with the Service. Where we rely on your consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may limit your ability to use certain features of the Service.

We do not sell personal information. We may share personal information in the following circumstances:

• Service providers and sub-processors: infrastructure, cloud database, authentication, email delivery, SMS, analytics, AI model providers, payment processing (Stripe), and support tooling. These parties are contractually bound to handle data only as instructed and to maintain appropriate security.
• Authorized platform participants: when the Service is designed to deliver information to specific recipients, such as lease signers receiving signature-request emails, vendors receiving job postings, or tenants receiving messages through the platform.
• Third-party integrations you connect: data shared with Google, Facebook/Meta, WhatsApp, or other services you authorize through the integration settings. Their use of that data is governed by their own privacy policies.
• Legal and regulatory obligations: we may disclose information when required by law, regulation, court order, or lawful government request, or when we reasonably believe disclosure is necessary to protect rights, safety, or property of TenantBay, its users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, sale of business assets, or similar transaction, personal information may be transferred to a successor entity, subject to equivalent privacy protections.
• With your consent: for any other purpose disclosed at the time of collection or with your explicit authorization.

TenantBay relies on a limited set of vetted sub-processors to operate the Service. Each receives only the data necessary to perform its function, is bound by confidentiality and data-protection obligations, and is permitted to process data only on our instructions. The following list is current as of the effective date and is representative rather than exhaustive:

• Cloud database and authentication: a managed cloud database and authentication provider holds the core application database and manages account credentials, hosted in Canadian regions.
• File and document storage: a cloud storage provider holds lease agreements, signed PDFs, uploaded documents, and listing images.
• Payment processing: Stripe, Inc. processes subscription payments and handles payment card data directly under PCI DSS Level 1 standards; only the card brand and last four digits are returned to and stored by TenantBay.
• Social login: Google and Meta (Facebook) sign-in, used solely to authenticate users who choose social sign-in.
• AI inference: a third-party large-language-model provider generates AI outputs from the data you submit to AI features. Data is transmitted to the provider only to produce the requested output for your account; we do not use your Customer Data to train AI models, and we use AI providers under terms that do not permit them to train their models on data submitted through their API.
• Communications: account and transactional emails (such as sign-in confirmations and password resets) are sent through our authentication provider; where we enable additional notification email, it is sent through a third-party email delivery provider. Lead intake from connected WhatsApp, Facebook, SMS, and phone channels is routed through TenantBay's own messaging infrastructure.
• Address and mapping: a third-party provider supplies address autocomplete and geocoding for property entry.
• Analytics (marketing site only): a third-party web analytics provider measures aggregated, IP-anonymized traffic on our public website and is not used inside the authenticated application.

A current list of sub-processors is available on request at privacy@tenantbay.com, and our Security page describes how data is hosted and protected. Where a sub-processor is located outside Canada, the transfer is addressed in the “International Data Transfers” section below.

TenantBay uses cookies and similar technologies to operate the platform, maintain sessions, and understand usage. Categories of cookies we use:

• Strictly necessary: authentication tokens and session identifiers required to log in and use the Service. These cannot be disabled without breaking core functionality.
• Functional: preferences, settings, and UI state stored locally to improve your experience.
• Analytics: anonymized or aggregated usage data to understand feature adoption, diagnose issues, and improve the product. You may opt out of analytics tracking by contacting us or using browser-level controls.

Most browsers allow you to control cookies through their settings. Disabling cookies may affect your ability to use TenantBay.

We implement administrative, technical, and organizational measures appropriate to the sensitivity of the information we process. These include:

• Row-level database security: your records are isolated from other customers at the query layer, not just the application layer. Another landlord's account cannot access your data under any circumstances.
• Encrypted transmission: all data is transmitted over HTTPS/TLS.
• Access controls: internal access to customer data is restricted on a need-to-know basis and subject to access logging.
• Password security: passwords are hashed using industry-standard algorithms and are never stored in plain text.
• Payment security: full payment card data is handled exclusively by Stripe under PCI DSS Level 1 compliance. TenantBay does not store raw card numbers.

No system is perfectly secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly if you suspect unauthorized access to your account.

In the event of a security breach that creates a real risk of significant harm to affected individuals, we will notify affected parties and, where required, report to the Office of the Privacy Commissioner of Canada, consistent with PIPEDA's mandatory breach reporting requirements. We will keep records of security breaches as required by law.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, maintain your account, resolve disputes, enforce our agreements, and meet legal and regulatory obligations. General retention principles:

• Active accounts: data is retained while your account remains open and for a reasonable period thereafter to allow account reactivation and to comply with legal obligations.
• Financial records: billing and transaction records are retained for a minimum of 7 years in accordance with Canadian tax and accounting requirements.
• Signed documents: lease agreements and e-signature records may be retained for the duration legally required for landlord-tenant records in the applicable jurisdiction.
• Deleted accounts: upon account deletion, we will delete or anonymize personal information within a commercially reasonable period, except where retention is required by law.
• AI inputs: conversational AI session data is not retained for model training purposes and is subject to the retention policies of our AI service providers.

Subject to applicable law and our legitimate operational needs, you have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to legal retention requirements and obligations that remain in effect after account closure.
• Withdrawal of consent: withdraw consent to non-essential data processing at any time, with the understanding that this may limit certain Service features.
• Opt-out of marketing: unsubscribe from marketing communications at any time using the unsubscribe link in the email or by contacting us directly.
• Challenging our practices: file a complaint or challenge our compliance with PIPEDA principles by contacting our privacy team. If unresolved, you have the right to escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, email privacy@tenantbay.com. We will respond within 30 days and may require identity verification before processing sensitive requests.

Our marketing practices are designed to follow Canada's Anti-Spam Legislation (CASL). We aim to send commercial electronic messages, such as promotional emails and product announcements, only where we have your express or implied consent as defined under CASL. Every commercial message will identify TenantBay, provide our contact information, and include a clear and functional unsubscribe mechanism that we will give effect to within the timeframe required by law. Transactional messages related to your account, security, billing, or active use of the Service are not subject to CASL opt-in requirements.

TenantBay's AI features, including the portfolio assistant, lead prescreening, daily digest, and AI search, process data you have entered into the platform to generate outputs. Key commitments:

• Your customer data and tenant records are not used to train AI models operated by TenantBay or its AI service providers.
• To generate an AI response, the relevant portfolio data is transmitted to our AI inference provider for processing. See the “International Data Transfers” section below.
• AI outputs are generated based on your portfolio data and are not shared with other TenantBay customers.
• AI-generated outputs may be inaccurate or incomplete. You are responsible for reviewing AI outputs before acting on them, particularly for legal notices, lease decisions, or payment enforcement.
• AI message usage is tracked per account for billing purposes on applicable plans.

TenantBay is headquartered in Canada and stores its primary records, including the application database, document storage, and backups, in Canadian regions of its cloud providers. Certain sub-processors may process limited data in the United States or other jurisdictions. When personal information is transferred or stored outside Canada, it may be accessible to foreign courts, law enforcement, and regulatory authorities under the laws of those jurisdictions. We take steps to ensure transferred information receives a comparable level of protection, including through contractual data-protection obligations with our service providers. By using the Service, you acknowledge that your information may be transferred to and processed in jurisdictions outside your country of residence.

Users outside Canada. TenantBay is designed for and directed at landlords operating in Canada, and our practices are built around Canadian privacy law. We do not market the Service to individuals in the European Economic Area, the United Kingdom, or other regions with distinct data-protection regimes. If you access the Service from outside Canada, you do so on your own initiative and are responsible for compliance with your local laws; by using the Service you consent to your information being collected, transferred to, and processed in Canada and the other jurisdictions described in this policy.

TenantBay is intended for use by adults aged 18 and older. We do not knowingly collect or solicit personal information from individuals under 18. If you believe a minor has provided personal information through the Service without appropriate authorization, please contact us immediately at privacy@tenantbay.com and we will take steps to delete that information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. We will notify you of material changes by posting a notice within the Service, sending an email to the address associated with your account, or updating the effective date at the top of this page. Your continued use of TenantBay after the updated policy takes effect constitutes your acceptance of the changes. We encourage you to review this policy periodically.

TenantBay Inc. has designated an individual who is responsible for our privacy practices and for responding to your privacy requests. For privacy questions, access or correction requests, consent withdrawals, concerns, or complaints, contact us at privacy@tenantbay.com or use our contact form. Our mailing region is Toronto, Ontario, Canada.

We take every privacy concern seriously and will work with you in good faith to resolve it. If your concern is not resolved to your satisfaction, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, for Quebec residents, the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.