MyRents.ca← Back to App
PIPEDA Compliant • Canadian Data ResidencyAWS Montreal (ca-central-1)

Privacy Policy

Effective Date: October 2026 • MyRents.ca ("MyRents", "we", "us", or the "Platform")

🇨🇦

Canadian Residency

Primary relational databases and payment ledgers reside strictly on Canadian soil in AWS Montreal.

🔒

Zero Bank Credentials

Non-custodial architecture. We never request, store, or access online banking passwords or MFA tokens.

🛡️

Zero Ad Trackers

No tracking cookies, marketing pixels, or third-party behavioral analytics. Your portfolio is private.

1. Overview, Scope & Processing Roles

MyRents.ca operates an automated, non-custodial rent reconciliation and ledger management platform built for Canadian residential property owners and managers. This Privacy Policy details how personal information is collected, processed, disclosed, and safeguarded under the federal Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and substantially similar provincial private-sector privacy statutes (such as British Columbia PIPA, Alberta PIPA, and Quebec Law 25).

Data Processing Roles (Landlord as Controller, MyRents as Processor)

Under Canadian privacy legislation, distinct roles apply depending on the category of data subject:

  • Landlord Account Information: For the credentials, account settings, and contact information of registered landlords and property managers, MyRents acts as the primary Data Custodian / Organization.
  • Tenant Personal Information: For tenant personal data (including tenant legal names, rental amounts, lease dates, unit identifiers, and banking sender aliases) inputted into the Platform by landlords, the registered landlord acts as the primary Data Custodian / Controller. MyRents acts strictly as a non-custodial Data Processor / Service Provider storing, matching, and organizing records on the landlord's behalf. Inquiries regarding tenancy lease records should be directed to the responsible landlord or property manager.

2. Information We Collect

In accordance with PIPEDA Principle 4 (Limiting Collection), we collect only the minimal data points necessary to reconcile bank transfers and maintain suite ledgers:

  • Landlord Authentication Details: Your email address, encrypted password hash, and profile authentication tokens provided via Magic Link or Google OAuth.
  • Property & Tenancy Records: Building street addresses, suite designations, tenant names, lease terms, monthly rent amounts, security/key deposit records, optional tenant contact numbers/emails, and bank transfer sender aliases.
  • Inbound Notification Metadata: When Interac e-Transfer autodeposit confirmation notices are forwarded to your assigned routing key (e.g., mr-usr_xxxx@myrents.ca), our automated parser extracts strictly: deposit date, payment amount, sender display name, bank reference number (e.g., C1AxmUjFMmHs), and transaction memo.
  • Essential Technical State: Browser session storage (`sessionStorage`/`localStorage`) used strictly to maintain active authentication sessions and preserve user interface preferences (such as expanded property accordions).

3. Information We Never Collect or Touch

  • Zero Online Banking Credentials: We never request, capture, or store bank account passwords, security questions, debit card PINs, or two-factor authentication codes.
  • Zero Custody of Rental Funds: MyRents is not a money services business (MSB) or escrow agent. Funds transfer peer-to-peer or financial-institution-to-financial-institution via standard Interac autodeposit rails.
  • Zero Personal Inbox Access: We do not connect to your Gmail, Outlook, or iCloud inbox via IMAP or mailbox-wide OAuth scopes. We only receive emails specifically forwarded by your configured mail rules to your private routing key.
  • Zero Third-Party Advertising Trackers: We do not deploy advertising pixels, behavioral tracking beacons (such as Meta Pixel or Google Analytics), or data-broker monitoring tags.
  • Zero Sensitive Identity Documents: We do not collect or store Social Insurance Numbers (SINs), government-issued photo identification scans, or full personal bank account transit numbers.

4. Purposes of Processing (PIPEDA Principle 2)

We process personal information strictly for designated administrative purposes:

  • Reconciling incoming forwarded Interac e-Transfer notices against active suite rosters.
  • Attributing early payments arriving within the final 7 calendar days of the month to the correct target rental cycle.
  • Maintaining itemized historical payment ledgers and computing portfolio collection percentages.
  • Dispatching optional automated administrative notifications (such as the 1st-of-month rent roll digest and 5th-of-month overdue alerts) to the registered landlord.
  • Detecting duplicate bank reference numbers to prevent erroneous double-crediting.

We will never sell, rent, monetize, or trade landlord or tenant personal information to third-party data brokers, marketing firms, insurance underwriters, or tenant screening registries.

5. Sub-Processors, Edge Transit & Cross-Border Transfers

We engage vetted infrastructure service providers bound by contractual confidentiality and security commitments:

Sub-ProcessorProcessing FunctionPrimary Residency
Supabase (PostgreSQL)Encrypted relational database storage and authenticationCanadian Soil (AWS Montreal, ca-central-1)
Resend Inc.Inbound MX routing, parser webhook delivery & transactional alertsUnited States / Global Edge Transit
Vercel Inc.Serverless edge application compute and automated background cronsGlobal Edge Network
Google LLCOptional Google OAuth sign-in verification (profile/email token only)Global Identity Network
Statutory International Data Transit & Foreign Law Disclosure:

In compliance with Office of the Privacy Commissioner of Canada (OPC) guidelines on cross-border data flows: while all database records and tenant ledgers reside permanently on Canadian soil (AWS Montreal), inbound email routing and serverless edge functions operate across distributed networks in the United States and globally. Data in transit through these edge networks may temporarily be subject to the lawful access requests of courts, law enforcement, or national security authorities in those jurisdictions pursuant to applicable foreign laws (such as the US CLOUD Act).

6. Security Safeguards & Mandatory Breach Reporting

We employ bank-grade technical and organizational safeguards in accordance with PIPEDA Principle 7:

  • Encryption in Transit: Mandatory TLS 1.3 encryption across all public web endpoints and webhook ingestion pipelines.
  • Encryption at Rest: Database tables, configuration keys, and audit logs encrypted using industry-standard AES-256.
  • Row-Level Security (RLS): Granular PostgreSQL Row-Level Security policies enforced at the database layer, isolating each landlord's records from all other users.
  • Least-Privilege API Authentication: Administrative operations (such as account purge routines and cron executions) require cryptographically signed Bearer tokens.

Mandatory Breach Notification Protocol: In accordance with Division 1.1 of PIPEDA, if MyRents experiences a security incident involving personal information that creates a Real Risk of Significant Harm (RROSH) to an individual, we will notify the Office of the Privacy Commissioner of Canada and affected users as soon as feasible.

7. Data Retention & Right to Erasure (PIPEDA Principle 9)

We retain personal information only for as long as your account remains active or as required for operational verification.

Immediate Cascading Purge: You maintain the right to erase your data at any time directly through the dashboard by opening Settings → Delete Account. Executing this action triggers a permanent cascading deletion across Canadian database clusters, wiping authentication credentials, registered buildings, tenant files, ledgers, and audit logs.

Statutory Access Requests: Landlords may request an export or inspection of their personal records at any time. Under PIPEDA, we will respond to formal access requests within the statutory thirty (30) day response window.

8. Unmatched & Non-Banking Inbound Log Handling

If an email forwarded to your routing key does not match supported Interac bank notification patterns (such as commercial newsletters or verification notices):

  • Non-banking emails are automatically classified as DROPPED_NON_INTERAC without financial parsing.
  • Verification messages (such as automated Gmail confirmation codes) display direct confirmation links in your Inbound Logs feed.
  • Landlords maintain full control to mark any logged record as Ignored or restore it to active status at any time.

9. Privacy Officer Contact & Statutory Recourse

We have designated an internal Privacy Officer responsible for overseeing our privacy compliance program and addressing user inquiries:

Designated Privacy Officer

MyRents.ca Privacy & Data Governance Team

support@myrents.ca

Recourse to the Privacy Commissioner of Canada:

If you are not satisfied with our response to a privacy inquiry or access request, you have the statutory right under federal law to lodge a formal complaint with the Office of the Privacy Commissioner of Canada (OPC):

  • Website: www.priv.gc.ca
  • Toll-Free Telephone: 1-800-282-1376
  • Mailing Address: 30 Victoria Street, Gatineau, Quebec, K1A 1H3