Privacy Policy

Keylane is operated by Keylane Software Inc. ("Keylane", "we", "us"), a Canadian corporation based in Winnipeg, Manitoba. We are accountable for the personal information under our control. Our Privacy Officer can be reached at admin@keylane.ca.

The categories of personal information we collect depend on your role.

From landlords: full name, email address, phone number (optional), organization name, mailing or property addresses, Stripe Connect account identifier (we do not see card numbers), uploaded documents (leases, addendums, insurance certificates, etc.), photos uploaded to listings or inspections, message content, and metadata about your use of the Service.

From tenants: full name, email address, phone number (optional), the unit you are leasing, signature images you create through the in-app e-signature flow, photos and descriptions submitted with maintenance requests, message content, payment status, and metadata about your use of the portal.

From trades: business name, contact name, email, phone, service-area information, category list, and compliance documents (insurance and WSIB certificates).

From all users: technical information automatically captured at the request layer (IP address, user agent, page route), error reports if the app crashes, and product analytics events (pageview-level, no field-level scraping).

• To provide the core Service: account creation, lease management, document storage, e-signature, messaging, maintenance, rent payments, and contractor workflows.
• To process and reconcile payments (credit card via Stripe; Interac e-Transfer notification matching).
• To send transactional and operational email (invitations, signature requests, maintenance updates, renewal offers, payment receipts).
• To respond to support requests sent through the contact form or directly to admin@keylane.ca.
• To maintain platform security, prevent fraud, and meet legal and audit obligations.
• To improve the Service via aggregate analytics and error monitoring.

We do not sell personal information. We do not use personal information for targeted advertising.

By creating an account or using the Service, you consent to the collection, use, and disclosure of your personal information for the purposes above. Where consent is required for specific integrations (for example, tenant screening or rent reporting to a credit bureau), we will request explicit, separate consent at the point of collection. You may withdraw consent at any time, subject to legal or contractual restrictions, by emailing admin@keylane.ca; in some cases withdrawing consent will prevent us from continuing to provide the Service.

The following sub-processors handle personal information on our behalf:

• Supabase (Postgres database, authentication, file storage, real-time): primary data store. Hosted in the Canadian region (ca-central-1, Toronto).
• Vercel (application hosting and content delivery): processes requests at the edge. May process IP-level metadata.
• Stripe (payment processing and Stripe Connect): handles cardholder data we never see. Stripe is the controller of cardholder data.
• Resend (transactional email and inbound email parsing for Interac auto-reconciliation): processes your email address and message content as needed to deliver mail.
• Anthropic (Claude AI inference for the in-app helper): when you use the Ask Keylane chat panel, your messages and a minimal user-context system prompt are sent to Anthropic in the United States. Anthropic does not train on this data per their API terms.
• Sentry (error monitoring, EU-hosted): may receive stack traces and request context if the app errors. We do not deliberately attach personal information to error reports.
• PostHog (product analytics, EU-hosted): pageview-level events tied to your user id. No field-level content is captured.

As partner integrations come online, the following providers will also be sub-processors with their own explicit consent flow:

• SingleKey (tenant screening, Canada). Used only when a tenant explicitly consents to a screening report.
• FrontLobby (rent reporting to Equifax Canada). Used only when a tenant explicitly opts in to credit reporting.
• Square One Insurance (Canada). Referral link only; no data shared without your action.
• voip.ms (Canada). Used to send SMS notifications when SMS opt-in launches.

Most of your personal information is stored in Canada (Supabase ca-central-1). The following sub-processors may process limited personal information outside Canada: Anthropic (United States), Sentry (European Union), PostHog (European Union), Vercel (global edge). When personal information leaves Canada, it may be subject to legal regimes that differ from PIPEDA. We have selected providers we believe meet equivalent privacy protections.

We retain personal information only as long as needed for the purposes for which it was collected, to comply with legal obligations, or to resolve disputes. Specifically:

• Active account data is retained as long as your account is active.
• Closed-account data is retained for up to 24 months for audit, dispute, and regulatory purposes, then deleted.
• Soft-deleted conversations are purged after 30 days by a daily cron job.
• Inbound Interac notification emails (parsed and queued) are retained for 90 days then purged.
• Payment records are retained for 7 years to meet Canadian tax record requirements.
• Backups roll on a 30-day cycle.

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Withdraw consent for specific uses (subject to legal and contractual constraints).
• Request deletion of your personal information, subject to retention requirements above.
• Receive an export of your personal information in a portable format.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe we have mishandled your data.

To exercise any of these rights, use our contact form and select "Privacy or data request" as the topic, or email admin@keylane.ca. We will respond within 30 days.

We use industry-standard safeguards: TLS in transit; encryption at rest at the storage layer; row-level security in our database to enforce per-organization isolation; least-privilege service roles; audit logging on sensitive actions. No security control is perfect. If we become aware of a privacy breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

We use only the cookies necessary to operate the Service: authentication session cookies (Supabase Auth), a CSRF token for form submissions, and a small trade-portal session cookie for the contractor flow. We do not set third-party advertising or tracking cookies.

Keylane is not intended for use by anyone under the age of majority in their province of residence. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact admin@keylane.ca and we will delete it.

Transactional email (invitations, signature requests, payment receipts, maintenance updates, renewal offers) is required for the Service and is sent under the implied consent associated with the account. Marketing email (if and when we send any) is sent only with your express consent and every message includes an unsubscribe link.

We may update this policy from time to time. Material changes will be communicated to landlords by email and posted at this URL with a new "Last updated" date.

Questions or complaints about this policy or our handling of personal information:

Privacy Officer
Keylane Software Inc.
Winnipeg, Manitoba, Canada
admin@keylane.ca