Privacy Policy

Last updated: August 12, 2026

Dweller Property Intelligence (“Dweller”, “we”, “us”) operates the dwellerpm.com website (the “Service”). This privacy policy explains how we collect, use, disclose, and safeguard your information when you use the Service.

1. Information We Collect

We collect the following categories of information:

• Account information: Name, email address, phone number, company name, province, and role (landlord or accountant).
• Property data: Property addresses, building characteristics, asset inventories, expense records, rent payments, and tenant information you enter into the Service.
• Device information: Device token and platform (iOS/Android) collected when you enable push notifications. We do not collect any other device identifiers.
• Usage data: Pages visited, features used, and session information for improving the Service.
• Tenant-submitted data: Maintenance tickets, observation reports, condition reports, and survey responses submitted by tenants through the tenant portal.
• Rental applicant data: Information submitted by people applying to rent a unit — see Section 7: Rental Applicants for the full list, the purpose, and how long it is kept.

2. How We Use Your Information

We use your information to:

• Provide property intelligence, health scoring, and capital forecasting services.
• Generate CRA T776 tax reports and CCA schedules.
• Power optional AI features (maintenance triage, portfolio advisor, portfolio Q&A, and listing generation) — only when you have enabled them in Settings.
• Send push notifications for maintenance updates, lease renewals, and rent reminders (only when you have enabled notifications).
• Send transactional emails (account verification, invite notifications, payment reminders).
• Track expenses with CRA-compliant categories for tax reporting.
• Improve the Service and develop new features.

3. Third-Party Services

We use the following third-party services to operate the Service:

• Supabase: Database and authentication, hosted in Canada (ca-central-1 region).
• Stripe: Payment processing. We do not store payment card details — all payment data is handled directly by Stripe.
• Anthropic Claude: Powers Dweller's optional AI features. AI features are off by default and only run when you enable them in Settings and use them. Depending on the feature you use, the following is sent to Anthropic to generate a response: maintenance triage sends maintenance ticket descriptions; the AI portfolio advisor and portfolio Q&A send the property, financial, and tenancy records needed to answer your question; listing generation sends property details and amenities. Anthropic does not use data sent through its API to train its models. If you never enable AI features, none of your data is sent to Anthropic.
• Expo: Push notification delivery for iOS and Android devices.
• Vercel: Web application hosting.
• Resend: Transactional email delivery.
• Sentry: Error monitoring and performance diagnostics. To help us diagnose crashes, Sentry may record a limited replay of on-screen activity leading up to an error (sampled at approximately 10% of error events only); routine sessions are not recorded.
• Cloudflare Turnstile: Bot and abuse protection on public forms such as sign-up and lead capture. Turnstile performs a privacy-preserving verification and is not used to track you across websites.

Each third-party service operates under its own privacy policy. We do not sell your personal data to any third party.

4. Data Storage and Security

Your primary database is hosted in Canada (Supabase, ca-central-1 region). All data is encrypted at rest and in transit (HTTPS), and row-level security policies ensure users can only access their own data. We use industry-standard practices to protect your information from unauthorized access.

Cross-border processing. Some of the third-party service providers listed above — including Stripe, Vercel, Resend, Sentry, and (only if you enable AI features) Anthropic — process limited personal information on servers located in the United States. When personal information is processed outside Canada, it may be subject to the laws of that jurisdiction, including lawful access requests by courts, law enforcement, or government authorities there. We use reputable providers that apply commercially reasonable safeguards to information handled on our behalf.

Breach notification. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA, and we maintain records of breaches as required by law.

5. Data Sharing

We share data only in the following circumstances:

• Accountant access: If you grant an accountant read-only access, they can view your financial data (expenses, rent, CCA schedules, T776 reports). You can revoke this access at any time.
• Tenant access: Tenants you invite can submit tickets, observations, and condition reports through the tenant portal.
• Legal requirements: We may disclose information if required by law or in response to valid legal process.

6. Data Retention

We retain your data for as long as your account is active. If you submit a deletion request, we complete it within 30 days (this deletion-request turnaround is separate from the post-cancellation grace period described in our Terms of Service), subject to the legal retention minimums below. Specific retention periods by document type:

• Financial records & receipts: 6 years from end of tax year (CRA Income Tax Act s.230).
• Lease agreements: 6 years after lease termination.
• Inspection reports & photos: 6 years from inspection date.
• Condition reports: Duration of tenancy plus 2 years.
• Maintenance tickets: 3 years from resolution.
• Insurance & compliance documents: 6 years.
• Unsuccessful rental applications: 12 months after the application is rejected or withdrawn, then automatically anonymized (see Section 7).
• Successful rental applications: Retained with the tenancy record for 6 years after the lease ends, because the application forms part of the lease file.

While your account is active, you control retention periods (at or above the legal minimums above) in your account settings, and documents past their chosen retention date are archived but remain downloadable. After account closure, personal information that is not subject to a legal retention minimum is deleted or anonymized following the post-cancellation grace period; records that are subject to a legal minimum (such as tax and financial records) are retained only for the required period and then securely destroyed. You can export your data at any time before deletion.

7. Rental Applicants

If you apply to rent a unit through a Dweller rental application form, the landlord who advertised that unit is responsible for your information and Dweller stores and processes it on their behalf. We collect only what the form asks for:

• Identity and contact: Name, email address, phone number, and current address.
• Employment and income: Employer name and phone number, job title, length of employment, and monthly income.
• References: Name, phone number, and relationship for the references you provide, plus any notes the landlord records after speaking with them.
• Emergency contact: Name and phone number of the person you list.
• Tenancy details: Desired move-in date and lease term, number of occupants, pets, and anything you add in the notes field.
• Consents: A record of which consents you gave (data collection, reference checks, credit checks) and when.

Purpose. This information is used for one purpose: to let the landlord assess your application for the unit you applied to — verifying identity and income, contacting the references you named, and, only if you consented to it separately, running a credit check. It is not used for marketing, is not shared with other landlords, and is not sold. We do not ask for your date of birth, Social Insurance Number, or banking details on an application form; do not enter them in a free-text field.

Retention. If your application is rejected or you withdraw it, your identity, contact, income, employer, reference, and emergency-contact details are automatically anonymized 12 months after that decision, and the reference and credit-check notes attached to it are deleted. We keep the 12-month window because human rights complaints in Newfoundland and Labrador can be filed up to a year after the event, and the landlord may need the record — including proof of the consents you gave — to answer one. What remains after anonymization cannot be linked back to you. If your application succeeds, it becomes part of your lease file and is retained on the lease schedule in Section 6.

Your rights as an applicant. You do not need a portal account to exercise them. Email privacy@dwellerpm.com to ask for a copy of your application, correct it, withdraw a consent, or request earlier deletion, and we will respond within 30 days. Withdrawing consent while your application is under consideration will normally end its assessment.

8. Your Rights Under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information held by us at any time using the built-in export features.
• Correct inaccurate personal information through your account settings.
• Delete your account and associated personal information (subject to legal retention minimums).
• Withdraw consent for collection and use of your personal information at any time (note: withdrawal may prevent use of the Service).
• File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe we have not handled your personal information appropriately.

Dweller has designated a Privacy Officer who is accountable for our compliance with this policy. To exercise any of these rights, or to raise a privacy concern, contact our Privacy Officer at privacy@dwellerpm.com. We will respond within 30 days.

9. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at privacy@dwellerpm.com and we will take steps to delete that information.

10. Cookies

We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies. We measure aggregate page usage with Vercel Web Analytics, which is cookieless and does not track you across sites.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active users of material changes via email at least 30 days before they take effect. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

12. Contact

For privacy-related enquiries:

• Email: privacy@dwellerpm.com
• Alternative: julian@harbourandhillsnl.com