Privacy Policy

Elite Tenants Inc. is a corporation incorporated in Ontario, Canada, with its principal place of business in Toronto, Ontario. We operate the website and applications at elitetenants.com.

Privacy Officer (designated under PIPEDA s.4.1):
Richard Campbell
Elite Tenants Inc.
[Registered office address — to be inserted]
privacy@elitetenants.com

You may contact our Privacy Officer at any time with questions, complaints, access requests, correction requests, or requests to withdraw consent. We acknowledge requests within 10 calendar days and respond fully within 30 calendar days.

Different parts of this policy apply depending on which service you use. Most users only use one.

Tenant credit-building. Tenants who want their on-time rent payments reported to Canadian credit bureaus (TransUnion Canada). We connect to your bank read-only via Plaid, detect monthly rent payments, verify them, and submit Metro 2-format records to the bureau.

Tenant screening. Prospective tenants who consent to be screened for a specific rental unit. We collect identity, address history, employment, income, and declarations through a guided questionnaire; pull a credit report from TransUnion with your express written consent; calculate a proprietary “Elite Score” based on credit, debt-service ratio, rental history, and tenure; and share the resulting report with the specific landlord who invited you (or whose listing you applied to).

We collect only what we need for the service you use (data minimization).

Identity & contact

• Full legal name, preferred name, date of birth, phone number, email address
• Last four digits of your Social Insurance Number (SIN), where you choose to provide it. We do not currently collect or store the full nine-digit SIN. If, in future, the credit bureaus require us to transmit the full SIN to ensure accurate consumer matching, we will collect it only with renewed express consent and store it encrypted at the column level using industry-standard cryptographic key management.
• For screening: address history (current + prior addresses with dates and previous landlord contact), employment history (employer, role, dates, monthly income, supervisor contact), self-reported declarations (e.g. past bankruptcy, eviction, criminal record)

Financial & bank data

• Plaid bank connection: read-only access to transaction history, account holder name, and institution. We never see or store your banking credentials, login, or password. We cannot initiate transfers from your account. Your access token is encrypted at rest and revoked when you disconnect.
• Plaid Income verification (optional): for screening, you may opt to verify your income through Plaid Income, which infers verified monthly income from 90 days of bank deposits. We store only the derived monthly income figure and the verification timestamp.
• Stripe billing: if you subscribe to a paid plan, Stripe processes your card. We never store card numbers; we receive only a tokenised customer reference and subscription status from Stripe.

Credit bureau data

• For screening: with your express written consent, we request your credit report from TransUnion Canada. We receive your credit score, a list of trades (creditors with balances, payment history patterns, and trade types), recent credit inquiries, and certain risk factors. We use this data to calculate your Elite Score and to derive a Total Debt Service ratio using Canadian banking-standard rules. We retain this data only for the period set out in Section 9.
• For credit-building: we transmit your verified rent payments and required identifying details (name, address, DOB, account number, payment history) to TransUnion Canada in the Metro 2 format on the agreed reporting cadence.

Lease & document data

• Your signed lease agreement (PDF). We use AI to assist in extracting the rent amount, lease term, and parties, and an admin reviews any flagged extraction. The PDF is stored in private, access-controlled storage with short-lived signed URLs.
• Optional supporting documents you choose to upload during screening (e.g. paystubs, pay stubs, bank letters).

Consent records (legally required)

• The version of our consent text you agreed to, the timestamp, your IP address, and your user-agent string. This is your legal receipt that you agreed to the specific scope of data sharing for a specific landlord on a specific date.

Operational & security data

• App activity logs (sign-ins, key actions, IP addresses) — retained for security, fraud detection, and incident response.
• Audit logs of credit-data access (every read, view, export, pull, cache hit, purge) — retained indefinitely as a regulatory requirement.
• Error and performance data via Sentry (when enabled) — used to fix bugs.

We do not sell your personal information to anyone. We do not share your information for advertising. We do not use your information to train any third-party machine-learning model.

We use your information only for the following purposes:

• Verifying your identity and rental arrangement
• Detecting and verifying monthly rent payments via your bank feed
• Reporting verified rent payments to Canadian credit bureaus, where you have enrolled in our credit-building service
• Pulling a credit report from TransUnion Canada with your express written consent for a specific rental application
• Computing a proprietary screening score (the “Elite Score”) based on credit, total debt service ratio, on-platform rental history, and employment tenure
• Generating a screening report and sharing it with the specific landlord who invited you or whose listing you applied to
• Processing subscription payments through Stripe
• Sending transactional communications (account, payment, lease, dispute updates, adverse-action notices)
• Providing customer support
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal obligations (consumer reporting acts, anti-spam law, tax law, anti-money-laundering law where applicable)

We will not use your information for any new purpose without first obtaining your consent.

We rely on your express, informed consent for everything we do. You will be asked to consent at specific moments:

• When you create an account (general data handling)
• When you connect a bank account through Plaid (read-only bank data)
• When you enrol in credit-building (reporting to credit bureaus)
• When you submit a screening for a specific landlord (a separate, versioned consent that explicitly lists which data fields will be shared and authorises a credit pull from TransUnion Canada for that screening)
• When you opt in to verify your income via Plaid Income
• If we ever change the scope of what we collect, we will request renewed consent reflecting the new scope

Each consent is recorded with version, timestamp, IP, and user-agent. You can request a copy of your consent records at any time.

Withdrawing consent. You may withdraw any consent at any time, subject to legal and contractual restrictions. Withdrawing consent for credit reporting will pause future reporting; it does not retroactively remove records already submitted to the bureaus (you must dispute those directly with us or with the bureau). Withdrawing consent for the bank connection will end automatic payment detection. To withdraw any consent, contact privacy@elitetenants.com.

We share your information only as described below, and only with parties bound by written data-processing agreements that prohibit them from using your information for their own purposes.

Service providers (subprocessors)

Landlords / property managers

When you submit a screening for a specific landlord or unit, the landlord receives a screening report containing the data fields you consented to share. The exact fields are listed in the consent text shown to you at the time of submission. Landlords are bound by a Landlord Data-Sharing Agreement that prohibits them from sharing your screening report with any other party and requires them to retain it only for the duration permitted under provincial Consumer Reporting Acts.

When required by law

We may disclose your information if compelled by a valid Canadian court order, subpoena, or other legal process, or where disclosure is necessary to protect Elite Tenants’ legal rights, prevent fraud, or protect the safety of any person.

Some of our service providers process data in jurisdictions outside Canada, primarily the United States. By using our service and granting consent to this policy, you expressly consent to your personal information being transferred to and processed in those jurisdictions. While those jurisdictions may have privacy laws different from Canada’s, we contractually require all processors to implement protections substantially equivalent to Canadian standards, including encryption, access controls, breach notification, and prohibitions on secondary use.

Customer data at rest is stored in Supabase’s Canada region. Application compute runs at Vercel’s global edge but transient request/response data only — there is no persistent customer data on Vercel infrastructure.

• Encryption in transit: TLS 1.2+ on all connections; HSTS preloaded for 2 years.
• Encryption at rest: AES-256 disk-level encryption (Supabase managed) on all database storage and file storage.
• Application-level encryption: the most sensitive identifier we store — your Social Insurance Number — is protected with envelope encryption: a unique data key per record, itself wrapped by a master key held in our application secrets manager, separate from the database. A copy of the database alone does not reveal it.
• Access control: every request is authorized in application code against your authenticated identity and role, so you can only access your own records. Administrative access to sensitive data additionally requires two-factor authentication, an allow-listed network, and is recorded in the append-only audit log described below.
• Authentication and access control: identity provided by Clerk with mandatory two-factor authentication (TOTP or SMS) for all admin and landlord accounts that view credit data.
• Audit log: every credit-data access is recorded in an append-only log secured with cryptographic hash chaining, so any tampering is detectable.
• Kill switch: our operations team can disable all credit-data access platform-wide in seconds if a systemic issue is detected.
• Rate limits: credit-pull and report-view endpoints are rate-limited to deter scraping and credential-stuffing.
• Personnel: only named employees with a legitimate business need have production access. Access reviews occur quarterly. Access is revoked within 24 hours of role change or separation.
• Bank credentials: we never see, store, or have access to your banking login. Plaid handles authentication.
• Card data: we never see, store, or have access to your card numbers. Stripe handles all payment authentication.

We retain your information only as long as necessary to fulfil the purposes for which it was collected, and never longer than is required by applicable law.

• Credit reports (screening): the credit report and its trade-level details are retained for up to 90 days from the date of pull, then automatically purged by a scheduled retention job. The same 90 days governs our reuse cache (no duplicate hard inquiry within the window). After 90 days, we keep only the audit trail of the pull (who, when, under what consent), not the credit data itself.
• Screening reports: retained for up to 90 days after the screening is approved or declined, then automatically reduced to a minimal record (status, consent receipt, approval/decline decision, and audit trail).
• Profile data (name, address, employment, declarations) for active users: retained while your account remains active. Deleted within 30 days of a verified account-deletion request.
• Payment, subscription, tax records: retained for 7 years as required by the Income Tax Act (Canada) and CRA guidelines. After the active period, these records are reduced to the minimum necessary for tax and audit purposes.
• Activity / security logs: retained for 90 days, then automatically purged.
• Audit logs of credit-data access: retained indefinitely. This is required by our agreements with the credit bureaus and by provincial Consumer Reporting Acts as the official record of every credit-data interaction. These logs do not contain credit-report content; they contain only metadata (who, when, where, under what consent, what action).
• Closed accounts (no deletion request): profile data is retained for 90 days after subscription cancellation, then automatically deleted, unless you request earlier deletion.

You may request earlier deletion of your cached credit report at any time through the in-app “Delete my credit report” control or by emailing privacy@elitetenants.com.

Under PIPEDA and applicable provincial privacy laws, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to retention obligations (e.g. tax records). Credit data already submitted to the bureaus cannot be recalled by us; however, you may dispute any reported item.
• Portability: receive your data in a structured, commonly used, machine-readable format (export available in-app from Settings → Data export).
• Withdraw consent: withdraw any consent previously given. Withdrawing consent for ongoing services may require account cancellation and cessation of credit reporting.
• Object to processing: object to specific uses of your data to the extent applicable provincial law grants such a right.
• Dispute reported credit data: if you believe a payment was reported in error, contact disputes@elitetenants.com; we will investigate within 30 days and submit a Metro 2 correction to the bureaus if the report was wrong.
• Lodge a complaint: file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents may also contact the Commission d’accès à l’information du Québec (cai.gouv.qc.ca). Residents of Alberta and British Columbia may contact their respective provincial Information and Privacy Commissioners.

To exercise any of these rights, email privacy@elitetenants.com. We acknowledge requests within 10 calendar days and respond fully within 30 calendar days. There is no fee for these requests.

If you are a resident of Quebec, you have additional rights under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector, including:

• The right to data portability in a structured, commonly used technological format.
• The right to be informed of any automated decision-making that significantly affects you. Our screening produces an “Elite Score” that is one input the landlord considers; the landlord — not Elite Tenants — makes the final approve/decline decision. You may request a human review of any automated processing on request.
• The right to request that your information no longer be communicated to third parties or used to contact you.
• Enhanced de-indexation rights (removal from search engines or automated profiles, where applicable).

To exercise Quebec-specific rights, email privacy@elitetenants.com with “Quebec Law 25 Request” in the subject line.

If a landlord declines your rental application based in whole or in part on information provided by us, you will receive an “adverse action” notice from us by email. The notice will identify the credit bureau whose information was used and inform you of your right to obtain a free copy of your credit report from that bureau, your right to dispute inaccurate information, and the contact information for relevant provincial human-rights tribunals if you believe you were declined for a prohibited reason.

Our screening process includes automated calculations: a credit-bureau-derived debt-service ratio and a weighted Elite Score combining credit, debt-service, on-platform rental history, and employment tenure. The score is presented to the landlord alongside the underlying data so the landlord can make an informed decision. The landlord — not Elite Tenants — decides whether to approve or decline a rental application. You may request human review of any automated calculation by emailing privacy@elitetenants.com.

Our services are intended for adults 18 years of age or older who are parties to (or applying to be parties to) a residential lease. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it promptly.

We use only cookies that are strictly necessary for the operation of the service: authentication session cookies (set by Clerk) and CSRF protection cookies. We do not use advertising cookies, third-party tracking pixels, or non-essential analytics. Because no non-essential cookies are set, no consent banner is displayed.

We send transactional communications (account notifications, payment receipts, lease and dispute updates, adverse-action notices) without separate consent because they are necessary for the contracted service.

We send commercial or promotional emails only to users who have expressly opted in. Every promotional email contains a clear unsubscribe link and our identifying information, as required by Canada’s Anti-Spam Legislation.

If we experience a breach of security safeguards involving personal information under our control that creates a real risk of significant harm to any individual, we will:

• Notify the Office of the Privacy Commissioner of Canada as soon as feasible.
• Notify each affected individual directly, by email or another reliable means, within 72 hours of confirming the breach.
• Maintain a record of all breaches as required by PIPEDA, regardless of whether they triggered notification obligations.
• If the breach involves credit-bureau data, also notify TransUnion Canada within 24 hours of confirmation, as required by our furnisher and inquirer agreements.

If you believe your account has been compromised, contact security@elitetenants.com immediately.

We will notify registered users by email at least 30 days before any material change to this policy takes effect. The version number and last-updated date at the top of this page reflect the current version. You may request copies of any prior version at any time by emailing privacy@elitetenants.com. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.

Elite Tenants Inc.

Toronto, Ontario, Canada

privacy@elitetenants.com — Privacy Officer (access, correction, deletion, complaints, consent withdrawal)
disputes@elitetenants.com — Credit-bureau report disputes
security@elitetenants.com — Security incidents
support@elitetenants.com — General support