Privacy Policy

Last Updated: October 18, 2026

1. Introduction

Anchor Lease Technologies Inc. ("Anchorlease," "we," "us," or "our") protects the personal information of the landlords, tenants and rental applicants who use our platform ("Service"). This policy explains what we collect, how we use and share it, and the choices you have. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

  • Your own account: we are responsible for your account information and how the Service uses it.
  • Information a landlord enters about others: when a landlord enters or receives information about tenants, applicants, guarantors or others, the landlord decides why it is collected and is responsible for it. We store and process it on the landlord’s behalf to provide the Service.
  • Privacy Officer: our Privacy Officer is accountable for this policy. Contact support@anchorlease.ca with "Privacy" in the subject line.

2. Information We Collect

2.1 Information You Provide

  • Account Information: name, email address, phone number, and password (our sign-in provider keeps only a one-way hash of it).
  • Property Information: property addresses, unit numbers, property types, rental amounts.
  • Tenant Information: tenant names, contact details, lease terms, rent and payment records, messages and repair requests.
  • Financial Information: receipts, expense records, tax-related data. Payment card details are processed directly by Stripe and are never stored on our servers.
  • Bank Account Information: where the feature is offered and you choose to connect a bank account, we receive limited account metadata through Plaid, including account name, account type, last four digits (mask), and financial institution. We do not receive or store full bank account numbers.
  • Documents: uploaded leases, legal forms, receipts, and other files.
  • Electronic Signatures: the signer’s name and signature, the time of signing, and where available their IP address and device or browser, kept as the audit trail of the signed document.
  • Forwarded e-Transfer Emails: if you forward Interac e-Transfer notifications to your Anchorlease address, we keep the sender’s email address, the subject, amount, sender name, date and reference number, to suggest which rent payment it matches. We do not keep the email body.
  • Phone Verification: if you verify a phone number, it is sent to Twilio to deliver the code.
  • Communications: messages sent through the platform, AI chat history, support requests.
  • LTB Catalogue Searches: The full name or file number you enter, together with optional date filters, is used to retrieve and display entries from Ontario’s public order catalogue.

2.2 Information Collected Automatically

  • Usage Data: pages visited, features used, time spent, click patterns.
  • Device Information: browser type, operating system, device type, screen resolution.
  • Log Data: IP address, access times, referring URLs.
  • Push Notifications: if you turn them on, the push subscription for that device’s browser.

2.3 Rental Inquiries and Applications

  • Listing inquiries: your name, contact details, move-in date, number of occupants, whether you have pets, viewing time and message. Sent only to that home's landlord.
  • Rental applications: your name, contact details, employment and household monthly income, current and past addresses, current landlord or references, move-in details, whether you could provide a guarantor, your own declaration about LTB records, and the proof of income you upload. We do not ask you to upload identity documents.
  • Only the landlord receiving the inquiry or application sees this information, and only for this rental decision. Anchorlease stores it on the landlord's behalf and does not give it to other landlords or third parties. A formal credit or background report is arranged separately by a third party with your consent.

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service.
  • Generate legal forms, tax reports, and other documents you request.
  • Answer your questions in AI features, using what you type and the records needed for the answer.
  • Keep audit trails of signatures, notices and payments recorded in the Service.
  • Send rent reminders, notifications, and service-related communications.
  • Process payments and manage subscriptions.
  • Detect and prevent fraud, abuse, and security threats.
  • Comply with legal obligations.

We do NOT sell your personal information. We do NOT use your data for advertising. Your data is used exclusively to provide and improve the Service.

4. Data Sharing and Service Providers

We share personal information only as follows:

  • Between a landlord and their tenant: features built for both sides show each of them the relevant records, such as the lease, rent records, messages, repair requests and notices. A landlord sees what tenants and applicants send them.
  • Hosting, database and file storage: cloud providers host our website and keep your account data, sign-in details and uploaded files.
  • AI features: what you type in an AI feature, and the records needed for the answer, go to an AI model provider; under its cloud terms, customer data is not used to train its models.
  • Maps, address lookup and site statistics: a maps provider suggests addresses and shows listing commute and nearby information, and analytics providers measure how the site is used.
  • Payments: a payment processor handles payments and handles payment card details directly; we never store them.
  • Bank connection (where offered, and only if you connect an account): a bank-connection provider gives us only limited account metadata, never full account numbers.
  • Email and SMS delivery: providers send our emails and phone verification codes, and one receives the e-Transfer notification emails you forward to us.
  • Error reporting: an error-reporting provider helps us fix problems and does not send personal identifiers by default.
  • Push notifications: if you turn them on, your browser’s push service delivers them and can see their content.
  • Official open-data lookup (LTB catalogue): for an LTB search, the name or file number you enter is sent to Ontario’s open data catalogue.
  • Independent websites you open yourself (such as tenant screening services): we do not send them your information, and their own terms apply when you use them.
  • Legal Compliance: We may disclose information if required by law, court order, or governmental regulation.

See the service provider details: name, role, information involved and where it is processed

Service providers that process information on our behalf may use it only to provide their services to us. Independent websites (such as tenant screening services) are governed by their own terms. We do not share information with anyone for their own marketing or advertising.

5. Data Security

How we protect your data:

  • Encryption: data is encrypted in transit with TLS, and our database platform encrypts stored data with AES-256.
  • Authentication: Secure session management with Supabase Auth.
  • Access Control: row-level security (RLS) limits each user to the data they are allowed to see, such as a landlord and their own tenants. Before each release we check that anonymous access reads no private data.
  • Records: legal records such as signed copies, service records and their audit trails cannot be edited after they are written.

No method of transmission or storage is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify you and report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

6. Data Retention

  • We retain your data for as long as your account is active or as needed to provide the Service.
  • Bank connection data: When you disconnect a bank connection, the associated encrypted access token and account metadata are immediately deleted from our systems, and a revocation request is sent to Plaid.
  • Deleting your account: we delete your account together with its properties, leases, rent records, documents and signed copies. Stored files are queued for removal and deleted within 30 days. Download anything you need first; as a landlord you must keep your own tax records (the CRA generally requires six years).
  • Fire safety records: if a property in your account holds fire safety records that must be kept, the account cannot be deleted until our support team arranges their retention.
  • Tenants: when a landlord deletes their account or a property, the tenant can no longer see the records shared from it. Tenants should keep their own copy of their lease.
  • We may retain certain anonymized, aggregated data for analytical purposes.
  • Legal and regulatory obligations may require us to retain certain records for specified periods.
  • Listing inquiries and viewing bookings: deleted automatically after one month; with a viewing, one month after the viewing. Notification emails already delivered to the landlord's mailbox are outside our control.
  • Rental applications: uploaded proof of income is deleted automatically 6 months after the application closes; the rest of the application 2 years after it closes. An application closes when the landlord decides; if the landlord never decides, when it was submitted; if it was never submitted, when its link expired. To delete yours sooner, contact the landlord who received it or email support@anchorlease.ca.
  • LTB search inputs and returned results are used temporarily during request and page processing. This feature does not save them to Anchorlease’s database, search history or search-result cache. Public source metadata may be briefly cached. Application-check marks saved earlier, including who saved them and when, remain in your account’s application records. This statement does not cover request logs maintained by the third-party catalogue or document host.

7. Your Rights (PIPEDA)

Under Canadian privacy law, you have the right to:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete information.
  • Deletion: Request deletion of your account and associated data.
  • Withdrawal of Consent: Withdraw your consent to certain data processing activities; some features may stop working if you do.
  • Complaint: File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise these rights, contact us at support@anchorlease.ca. We respond within 30 days. If you are a tenant or applicant and a landlord entered your information, you can also contact that landlord.

8. Cross-Border Data Transfers

Our main service providers (Supabase and the AWS infrastructure it runs on, Vercel, Google, Stripe, Resend, Mailgun, Twilio and Sentry) store or process data mainly in the United States. Your information may therefore be stored or processed outside Canada, and may be accessible to authorities there under local law. We protect it with encryption, access controls and contracts with these providers.

9. Cookies and Analytics

  • Essential Cookies: Used for authentication and session management. These are necessary for the Service to function.
  • Analytics: Google Analytics (which uses cookies) and Vercel Analytics measure how the site is used. Pages reached by a private link, such as signing, invitations, rental applications and password resets, are not measured.
  • We do not use advertising cookies. You can block analytics cookies in your browser settings.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete such information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before the changes take effect. If a change involves a new purpose of use or a new party we share information with and your consent is required, we will ask for your consent separately; other changes apply once they take effect.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact our Privacy Officer:

Privacy Officer and general questions: support@anchorlease.ca

Appendix: service providers

This table lists the providers that process information on our behalf, and the independent websites we link to. Last updated: 2026-10-08

  • Supabase

    Database, sign-in and file storage. Supabase holds SOC 2 Type 2 certification — that is our provider’s certification, not ours.

    Information received or involved
    The data you store in the Service, your sign-in details and the files you upload.
    Where it is processed
    Servers in the United States, on AWS.

  • Vercel

    Hosts the website, and measures page use and performance with Vercel Analytics and Speed Insights.

    Information received or involved
    Requests made when you visit the site, and page use and performance data.
    Where it is processed
    Mainly the United States (see section 8).

  • Google Cloud Vertex AI (Gemini)

    Gemini models on Google Cloud Vertex AI power AI features. Under Google Cloud’s terms, customer data is not used to train its models.

    Information received or involved
    What you type in an AI feature and the records needed for the answer.
    Where it is processed
    Mainly the United States (see section 8).

  • Google Maps and Places

    Suggest addresses and show listing commute and nearby information.

    Information received or involved
    Addresses used for address suggestions and for listing commute and nearby information.
    Where it is processed
    Mainly the United States (see section 8).

  • Google Analytics

    Measures site usage (uses cookies).

    Information received or involved
    Site usage data. Pages reached by a private link, such as signing, invitations, rental applications and password resets, are not measured.
    Where it is processed
    Mainly the United States (see section 8).

  • Stripe

    Payment processing. Stripe holds PCI DSS Level 1 certification.

    Information received or involved
    All payment card information, handled directly by Stripe and never stored by us.
    Where it is processed
    Mainly the United States (see section 8).

  • Plaid

    Bank account connection, where offered.

    Information received or involved
    We receive only limited account metadata (account name, type, last four digits), never full account numbers. Plaid access tokens are encrypted on our servers and deleted when you disconnect.
    Where it is processed
    Not stated separately in this policy.

  • Resend

    Sends our emails, for example verification codes, rent reminders and signing notices.

    Information received or involved
    The recipient’s address and the email content.
    Where it is processed
    Mainly the United States (see section 8).

  • Mailgun

    Receives the e-Transfer notification emails you forward to us and passes them to our servers.

    Information received or involved
    The e-Transfer notification emails you forward.
    Where it is processed
    Mainly the United States (see section 8).

  • Twilio

    Sends phone verification codes.

    Information received or involved
    The phone number you verify.
    Where it is processed
    Mainly the United States (see section 8).

  • Sentry

    Error reports that help us fix problems.

    Information received or involved
    Error reports. It does not send personal identifiers by default, and some sensitive fields are removed before sending.
    Where it is processed
    Mainly the United States (see section 8).

  • Browser push services (such as Apple, Google and Mozilla)

    Deliver the notifications you turn on.

    Information received or involved
    The notification content, which they can see.
    Where it is processed
    Not stated separately in this policy.

  • Ontario’s Data Catalogue (data.ontario.ca)

    Provides the CKAN API behind the LTB order catalogue search.

    Information received or involved
    For an LTB search, our server sends the name or file number you enter to its CKAN API. Anchorlease applies the date filters. Opening an official order PDF connects your browser directly to the third-party document hosting service, which handles access requests under its own rules.
    Where it is processed
    Not stated separately in this policy.

  • SingleKey, Openroom

    Tenant screening providers: separate websites we link to.

    Information received or involved
    We do not send them your information; if you use them, you deal with them directly under their terms.
    Where it is processed
    Decided by each website under its own terms.