Privacy Policy

We use your personal information for the following purposes:

• To provide and maintain our property management services
• To process rent payments and maintain payment records
• To communicate with you about your lease, payments, and maintenance requests
• To manage lease agreements and tenant relationships
• To respond to maintenance requests and coordinate repairs
• To send important notices and updates about your tenancy
• To comply with legal and regulatory requirements
• To improve our services and user experience
• To detect and prevent fraud or unauthorized access
• To maintain accurate records as required by law

We implement appropriate technical and organizational security measures to protect your personal information:

• End-to-end encryption for sensitive data transmission
• Secure authentication and access controls
• Regular security audits and vulnerability assessments
• Employee training on data protection practices
• Secure data storage with reputable cloud providers
• Audit trails and activity logging
• Incident response procedures for data breaches

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Specific retention periods:

• Active Tenancy Records: Duration of lease plus 5 years for legal and operational record retention
• Payment Records: 5 years after the transaction date unless a longer period is required by law
• Lease Agreements: 5 years after lease termination
• Maintenance Records: Duration of tenancy plus 2 years
• Account Information: Until account deletion requested, then anonymized after data retention period

Under PIPEDA and applicable privacy laws, you have the following rights:

• Right to Access: Request access to your personal information we hold
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Right to Withdraw Consent: Withdraw consent for processing where applicable
• Right to Data Portability: Request a copy of your data in a structured format
• Right to Object: Object to certain processing of your personal information
• Right to Lodge a Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, please contact us using the information provided below.

We use only strictly-necessary cookies. NSR does not use advertising cookies, third-party tracking cookies, or analytics cookies that identify you personally. The cookies we set are limited to:

• Session cookie — a short-lived HTTP-only cookie that authenticates you while you’re signed in. Required for the platform to function. Expires after 5 days of inactivity.
• CSRF token — a HTTP-only cookie paired with a request header, used to prevent cross-site request forgery. Required for account security.

Analytics:NSR does not currently deploy third-party analytics tools (no Google Analytics, no Mixpanel, no Vercel Analytics). Internally, we may log anonymized aggregate counts of in-app actions (for example, “X leases created today”) for product-improvement purposes; these logs are not linked to individual users and do not leave our infrastructure. If we ever introduce third-party analytics, we will update this policy and ask for your consent before enabling them.

Because NSR uses only strictly-necessary cookies and no third-party tracking, no consent banner is required under PIPEDA. If we ever introduce optional cookies (for example, marketing or personalization), we will update this policy and ask for your consent before setting them. You can always clear cookies in your browser; clearing our session cookie will sign you out.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe we have collected information from a child, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by posting the updated policy on our platform and updating the “Last Updated” date. Your continued use of our services after such changes constitutes acceptance of the updated Privacy Policy.

To deliver the Service, NSR engages the following sub-processors to process personal information on our behalf. Each has been evaluated for adequate security and privacy practices. We will notify you of new sub-processors at least 30 days before they begin processing your data.

• Firebase / Google Cloud Platform — authentication, database (Firestore), file storage, and application hosting. Data may be stored in any Firebase region; PIPEDA cross-border data-transfer safeguards (Principle 1.4.6) apply.
• Stripe — payment processing for Owner subscriptions and Resident rent payments. Stripe stores payment-method tokens; NSR does not store full card numbers.
• Vercel — application hosting and CDN. Server logs are retained for up to 30 days for security and debugging.
• Resend (or current transactional-email provider) — sends verification, payment, and lease emails on our behalf.

A current list of sub-processors is also available on request by emailing privacy@nsr.mebal.ca.

If you are a resident of Quebec, Act respecting the protection of personal information in the private sector (CQLR c P-39.1, as amended by Act 25) provides additional rights beyond PIPEDA. These include:

• The right to de-indexation of any personal information about you that NSR has made publicly accessible (for example, your name in a building directory).
• The right to receive your personal information in a structured, commonly used, machine-readable format for portability to another service.
• The right to automated decision-making review — to understand and contest any decision made about you solely by automated processing. NSR does not currently make automated decisions that produce legal or similarly significant effects.
• The right to file a complaint with the Commission d’accès à l’information du Québec if you believe your rights have been violated.

To exercise any of these rights, contact privacy@nsr.mebal.ca. We respond within 30 days.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please reach out to us directly — Nduka and Sherisse personally read every message.

If you have concerns about our privacy practices that we have not addressed to your satisfaction, you may file a complaint with: