Privacy Policy
Last updated: May 8, 2026
1. Who we are
Leasarr (“we”, “our”, “us”) is a property management software service. Our registered business operates in Canada and is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector (Law 25).
Questions about this policy or data requests: privacy@leasarr.com
2. What data we collect and why
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email, phone, profile photo | Create and manage your account; send transactional emails |
| Property & lease data | Property addresses, unit details, lease terms, rent amounts | Core product functionality |
| Tenant data | Tenant names, emails, contact info | Manage tenancies; send portal invitations and notifications |
| Payment data | Payment amounts, dates, Stripe payment intent IDs | Payment tracking; billing management. Card details are handled by Stripe and never touch our servers. |
| Maintenance data | Request descriptions, photos, vendor info | Maintenance request lifecycle |
| Usage data | Pages visited, features used, browser type | Product analytics (PostHog), only with your consent |
| Consent records | Cookie consent decisions with timestamp and jurisdiction | Compliance with PIPEDA and Law 25 |
3. Cookies and analytics
We use strictly necessary cookies (Supabase auth session) that are always active. We use analytics cookies (PostHog) only after you explicitly accept them via the cookie banner. You can change your preference at any time via the “Cookie Preferences” link in the footer or under Settings → Privacy.
4. Third-party processors
| Processor | Data shared | Purpose |
|---|---|---|
| Supabase | All user and property data | Database and authentication |
| PostHog | Anonymous usage events, page URLs | Product analytics (consent-gated) |
| Stripe | Email address, billing details | Payment processing and subscription management |
| Resend | Email address, name | Transactional and notification emails |
All processors are contractually required to handle data in accordance with applicable privacy law.
5. Data retention
We retain your data for as long as your account is active. When you delete your account, your profile and associated data is permanently deleted from our systems within 30 days, except where we are required to retain it by law (e.g. billing records for tax purposes, retained for 7 years per CRA requirements).
Consent audit records are retained indefinitely as required for compliance purposes.
6. Your rights
Under PIPEDA and Law 25, you have the right to:
- Access: request a copy of the personal information we hold about you
- Correction: request that inaccurate or incomplete information be corrected
- Deletion: request that your personal information be deleted (subject to legal retention obligations)
- Portability: request your data in a structured, machine-readable format
- Withdraw consent: withdraw consent to analytics cookies at any time via Cookie Preferences
To exercise any of these rights, email privacy@leasarr.com. We will respond within 30 days.
7. Security
We use industry-standard measures to protect your data, including encryption in transit (TLS), encryption at rest (Supabase), row-level security so users can only access their own data, and access controls limiting who within Leasarr can access production data.
8. Changes to this policy
If we make material changes to this policy, we will notify you via email and re-prompt for consent where required. The “last updated” date at the top of this page reflects the most recent revision.
9. Contact
Privacy questions, complaints, or data requests: privacy@leasarr.com
If you are located in Quebec and believe we have not adequately addressed your concern, you may file a complaint with the Commission d’accès à l’information du Québec (CAI).