1. Introduction

Anchor Lease Technologies Inc. ("Anchorlease," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our platform and services ("Service"). This policy complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Information We Collect

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service.
• Generate legal forms, tax reports, and other documents you request.
• Power AI advisory features with relevant context from your data.
• Send rent reminders, notifications, and service-related communications.
• Process payments and manage subscriptions.
• Detect and prevent fraud, abuse, and security threats.
• Comply with legal obligations.

4. Data Sharing and Third Parties

We share your information only with the following:

• Supabase: Our database and authentication provider. Data is hosted in secure, SOC 2 compliant data centers.
• Plaid: Bank account connection service. When you choose to connect a bank account, Plaid acts as a secure intermediary between your bank and our service. We only receive limited account metadata (account name, type, last four digits). We do not receive full account numbers. Plaid access tokens are encrypted at rest on our servers using AES-256-GCM and are never exposed to client-side code. You may disconnect your bank connection at any time, at which point the associated token is deleted from our systems.
• Stripe: Payment processing. Stripe handles all payment card information directly and is PCI DSS Level 1 certified.
• Resend: Transactional email delivery service (e.g., verification codes, rent reminders, signing notifications). Resend receives only the recipient email address and email content, and does not access other personal data.
• AI Service Providers: We may send anonymized or contextual data to AI model providers to power advisory features. No personally identifiable information is shared beyond what is necessary for the query.
• Legal Compliance: We may disclose information if required by law, court order, or governmental regulation.

We do not share your information with any other third parties for marketing or advertising purposes.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Authentication: Secure session management with Supabase Auth.
• Access Control: Row-level security (RLS) ensures users can only access their own data.
• Infrastructure: Hosted on enterprise-grade cloud infrastructure with regular security audits.

While we strive to protect your information using commercially acceptable means, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

• We retain your data for as long as your account is active or as needed to provide the Service.
• Bank connection data: When you disconnect a bank connection, the associated encrypted access token and account metadata are immediately deleted from our systems, and a revocation request is sent to Plaid.
• When you delete your account, all associated data — including personal information, bank connections, and lease records — is permanently removed within 30 days.
• Lease and payment records may be retained for up to 7 years in accordance with Ontario legal and tax record-keeping requirements.
• We may retain certain anonymized, aggregated data for analytical purposes.
• Legal and regulatory obligations may require us to retain certain records for specified periods.

7. Your Rights (PIPEDA)

Under Canadian privacy law, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your account and associated data.
• Withdrawal of Consent: Withdraw your consent to certain data processing activities.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise these rights, contact us at support@anchorlease.ca.

8. Cross-Border Data Transfers

Our service uses cloud infrastructure located in the United States and Canada (including AWS and Supabase). Your data may be stored or processed outside of Canada. We ensure your data is protected during transfer and storage through encryption, access controls, and contractual agreements with our service providers.

9. Cookies and Tracking

• Essential Cookies: Used for authentication and session management. These are necessary for the Service to function.
• Analytics: We may use anonymized analytics to understand usage patterns and improve the Service.
• We do not use third-party advertising cookies or tracking pixels.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete such information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: