Privacy Notice

This interim notice describes the current NSR Ontario service. It is version 2026-08-13-interim, effective August 13, 2026. It describes current practices and controls; it is not a representation of PIPEDA or other legal compliance.

Only Ontario is enabled. Quebec and every other province remain unavailable unless a separate jurisdiction pack is implemented and enabled.

NSR tracks privacy accountability through its internal governance checklist. Appointment of a named Privacy Officer and publication of a complete service address remain open governance items.

Privacy inquiries and requests may be sent to privacy@nsr.mebal.ca. NSR is operated from Toronto, Ontario, Canada.

Depending on the workflow, NSR may handle account and contact information, property and unit records, invitations, leases and signatures, invoices and payment evidence, maintenance requests and media, documents, notices, support messages, security events, privacy cases, consent receipts, disclosure history, deletion evidence, and provider identifiers.

Owners may provide information about occupants, emergency contacts, vendors, applicants, and other people. Owners must have authority to provide it, minimize it, and support any required indirect-collection notice. Users should not upload unrelated account balances, full account numbers, or information about third parties.

NSR uses information to authenticate users, provide property and tenancy workflows, protect accounts, maintain financial and legal records, respond to maintenance and support requests, operate privacy rights, prevent abuse, and meet legal obligations. Required service processing is distinguished from optional consent.

Analytics is disabled for the Ontario launch. An optional purpose may be enabled only after a privacy impact assessment, processor and notice update, and counsel approval. Optional consent can be withdrawn from the Privacy & Data Rights area without withdrawing processing that is necessary to provide the service or meet a legal obligation.

Configured providers may include Firebase and Google Cloud for authentication, database, and file storage; Vercel for application hosting; n8n and configured email or support providers for controlled workflows; Stripe for subscriptions and connected rent-payment features; and MEBAL for verified membership eligibility.

Providers may process information outside Canada. Information processed abroad may be accessible under foreign law. NSR does not claim that processing stays exclusively in Canada. Provider contracts, data-processing terms, locations, safeguards, subprocessors, and comparable-protection evidence are tracked in the internal governance checklist.

NSR may disclose information to an authorized owner or resident within the applicable property and lease, to a person covered by an explicit realtor grant, to service providers, or where required or permitted by law. Disclosure events and grant revocation are recorded where the workflow requires them.

Implemented safeguards include revocation-checked sessions, recent authentication for high-impact actions, role and ownership checks, server-only staff records, MFA-gated privacy operations, CSRF protection, rate limiting, scoped file delivery, content security policy, redacted evidence events, and encrypted public privacy-intake details.

TLS protects data in transit and configured providers supply encryption at rest. NSR does not claim end-to-end encryption. Safeguards require testing, access reviews, incident exercises, provider evidence, and ongoing monitoring.

Authenticated users can create and monitor a request in Settings under Privacy & Data Rights. A person without an account may begin a request through the public intake process. Email-link confirmation does not by itself establish sufficient identity for disclosure, correction, or deletion, so additional verification may be required.

The initial response deadline is 30 calendar days. A single extension of no more than 30 additional days is permitted only for a recorded statutory operational or consultation reason, with notice before the original deadline. Access packages are reviewed for third-party information and lawful severance before release through a one-time, short-lived download.

Deletion is subject to approved retention rules, legal holds, provider actions, backups, and verification. A completed deletion produces a minimal HMAC tombstone so restored backups can reapply it before data becomes available.

NSR does not use a blanket retention promise. Versioned Ontario retention policies record the purpose, legal or business basis, trigger, minimum and maximum period, disposition, legal-hold behaviour, effective version, and approval status for each record class. Automated disposition records the policy version used and respects active legal holds.

Reviewed privacy-export artifacts expire after seven days. Breach records are retained for at least 24 months. Backup inventory, access, encryption, retention, legal holds, restoration tests, and deletion replay evidence are tracked in the internal governance checklist.

Every confirmed breach must be recorded, assessed, contained, and supported by a documented real-risk-of-significant-harm decision. Where required, NSR must notify affected people, the Office of the Privacy Commissioner of Canada, and organizations that can reduce the risk of harm.

If a privacy concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada.

NSR uses necessary session and CSRF cookies. Optional analytics and marketing cookies are disabled for the Ontario launch. Material notice changes receive a new version, effective date, impact review, and any consent or notice required by law.