Privacy Policy

Keytrus (we, us), based in Saskatoon, Saskatchewan, runs keytrus.ca and the Keytrus property management app. This policy explains how we handle personal information under Canada’s Personal Information Protection and Electronic Documents Act(PIPEDA) and, where they apply, provincial privacy laws such as Québec’s Law 25 and the private-sector privacy laws of Alberta and British Columbia.

We handle personal information in two ways:

• For our own purposes, such as your account, billing, security and support. Here we decide how the information is used.
• On behalf of landlords and property managers. Information an organization puts into Keytrus about its properties, tenants, leases and payments belongs to that organization. We process it to provide the Service to them. If you are a tenant, your landlord is responsible for that information. You can contact them, or us, about it (see section 9).

• Account details: name, email address, phone number (optional), and profile photo if you add one. Passwords are handled by our sign-in provider, Clerk. We never see your password. If you sign in with Google, we receive your name, email address and profile photo from Google.
• Organization details: business name, city, province and contact information.
• Property and tenancy records: property addresses and units, leases, rent amounts and schedules, payments, deposits, expenses, documents, inspection notes and photos.
• Tenant information entered by a landlord: name, email address, phone number, emergency contact, and move-in and move-out dates.
• Maintenance and messages: maintenance requests, photos and videos, quotes, job details, and messages between users.
• Vendor information: business details, services offered, service areas, and insurance and licence details submitted for verification.
• Billing information: plan, invoices and payment status. Card details go directly to Stripe. We never receive your full card number.
• Bank connection data (only if you connect a bank): through Plaid, we receive read-only account and transaction details, such as deposit amounts, dates and descriptions, to match incoming rent. You sign in to your bank with Plaid. We never see your banking password.
• Technical information: IP address, browser and device type, pages used, and error and security logs.

• To provide Keytrus and the features you use.
• To sign you in, keep accounts secure, and prevent fraud and abuse.
• To process subscriptions and send invoices and receipts.
• To match bank deposits to rent requests, if you turn that on.
• To send service messages, such as notifications about rent, maintenance, messages and account security.
• To review vendors before they can quote on work.
• To answer support requests.
• To fix problems and improve Keytrus, using aggregated or de-identified data where we can.
• To meet our legal obligations, such as tax and accounting rules.

We do not sell personal information, use it for advertising, or share it with data brokers. We only use it for a new purpose after telling you, and asking for your consent where the law requires.

We rely on your consent to handle your personal information. In most cases consent is implied when you use a feature that needs the information. For example, adding a property address lets us show it on your map. We ask for express consent for more sensitive uses, such as connecting a bank account.

Landlords and property managers who enter information about tenants, team members or others are responsible for giving them any notice and getting any consent the law requires.

You can withdraw consent at any time, subject to legal or contractual limits, by changing your settings, disconnecting a bank, or emailing us. Some features may stop working if you do, and we will explain what that means.

• Inside your organization: team members see what their role and permissions allow.
• Between people in a tenancy: tenants see their own lease, rent, documents and requests. Landlords see the tenants on their leases.
• With vendors:invited vendors see the details of the job they are asked to quote on. They see a tenant’s contact details only if the owner chooses to share them.
• With service providers who run parts of Keytrus for us (see section 6). They may use the information only to provide their service to us.
• When the law requires it, such as a valid court order, or to protect someone’s safety in an emergency.
• In a business transfer: if Keytrus is merged or sold, information may move to the new owner under the same protections. We will tell you if this happens.

Our main database and uploaded files are stored in Canada. Some service providers process information outside Canada, mainly in the United States:

• SupabaseDatabase and file storageCanada (Montréal)
• ClerkSign-in, passwords and account securityUnited States
• VercelHosting and running the web appUnited States
• StripeSubscription payments and invoicesUnited States
• PlaidRead-only bank connections, only if you connect a bankUnited States
• MapboxShowing your properties on a mapUnited States
• GoogleSign-in, only if you choose Google; our support inboxUnited States

We choose providers that protect information to a standard comparable to Canadian law, bound by contract to do so. Information held outside Canada is subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities.

• We keep account and organization information while the account is open.
• After an organization or account is closed, we keep its data for 90 days so it can be restored or exported. After that we delete it or make it anonymous.
• We keep billing and tax records for as long as Canadian tax law requires, which is generally six years.
• Deleted data may stay in encrypted backups for a short time until they expire.
• Landlords decide how long to keep the tenancy records in their organization, subject to their own legal obligations.

• Information is encrypted in transit (HTTPS) and at rest.
• Database access rules keep each organization’s data separate, and give each user only what their role allows.
• Bank connection credentials are kept on our servers only. They are never sent to a browser and are never visible to users.
• Access by Keytrus staff is limited to what is needed to run and support the Service.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and other regulators such as Québec’s Commission d’accès à l’information where their laws apply.

You have the right to:

• Ask what personal information we hold about you, and get a copy of it.
• Ask us to correct information that is wrong or incomplete.
• Withdraw your consent (see section 4).
• Ask us to delete your information, unless the law requires us to keep it.
• In Québec, receive your information in a commonly used technology format, and be told about decisions made only by automated processing. Keytrus does not make such decisions about you.

To make a request, email help@keytrus.ca. We may need to confirm your identity. We will answer within 30 days, and there is no charge. If your request is about information a landlord entered, we may pass it to them and help them answer.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy regulator (in Québec, the Commission d’accès à l’information; in Alberta or British Columbia, the provincial Information and Privacy Commissioner).

We use only the cookies and browser storage Keytrus needs to work:

• Sign-in cookies set by Clerk, to keep you signed in securely.
• Browser storage for preferences such as light or dark mode.
• Cookies set by Stripe on its checkout and billing pages, to process payments and prevent fraud.

We don’t use advertising cookies or third-party tracking. If you block cookies, you won’t be able to sign in.

We send service emails you need to use Keytrus, such as sign-in codes, invitations, receipts, security alerts and notifications. We only send marketing email with your consent, as Canada’s Anti-Spam Legislation (CASL) requires, and every marketing email has an unsubscribe link. When a landlord invites a tenant, team member or vendor, the invitation is sent on that landlord’s behalf.

Keytrus is for adults. Accounts are not for anyone under 18, and we don’t knowingly collect personal information from children through accounts. A landlord may record household members on a lease as their tenancy requires. That information is handled on the landlord’s behalf, as described in section 1.

We will update this policy when our practices or the law change. If a change is significant, we will tell you by email or in the app before it takes effect, and ask for your consent again where the law requires. The date at the top shows the latest version.

Our Privacy Officer is responsible for how Keytrus handles personal information and for this policy. Contact them at help@keytrus.ca(subject line “Privacy”), or by mail at Keytrus, Attn: Privacy Officer, Saskatoon, Saskatchewan, Canada.