renloc.

Privacy policy

Last updated May 8, 2026

renloc (“we,” “our,” “us”) operates a Canadian rental platform that connects landlords and tenants through the rental lifecycle — search, application, lease, move-in, rent collection, maintenance, renewal, and move-out. This policy describes what personal information we collect, why we collect it, who we share it with, and the choices you have. We follow the federal Personal Information Protection and Electronic Documents Act(PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (commonly “Law 25”), and the substantially-similar provincial laws in British Columbia and Alberta.

If you have questions, our Privacy Officer can be reached at privacy@renloc.com.

1. Information we collect

We collect only what we need to operate the service. Concretely:

From tenants

  • Account: email address and name (required to create an account); password (stored hashed by our authentication provider).
  • Profile: date of birth, phone number, employer, job title, annual income, years at current job, and personal/landlord references that you choose to include.
  • Application: when you apply to a listing, we record the application details — current and previous landlord contact information, requested move-in date, free-text message to the landlord, and a timestamp recording your authorization to share your profile with that landlord.
  • Co-applicants: if you invite roommates or co-applicants, we collect their email address and (after they accept) a snapshot of their reported income, employer, and job tenure that gets attached to your application.

From landlords

  • Account: name, email, profile image (optional).
  • Listings: property address, neighborhood, city, rent, beds, baths, square footage, property type, description, amenities, and listing photos.
  • Payouts: when you connect a Stripe account to receive rent, Stripe collects identity verification information (legal name, date of birth, business registration if applicable, bank account) directly through Stripe-hosted onboarding. We store only the resulting Stripe Connect account ID and capability flags — we do not see or store your bank account number, SIN, or government ID.

Lifecycle and transactional data

  • Tours: requested date, time, mode (in-person or video), and notes.
  • Leases: the lease document you upload, e-signature records (typed name, IP address, user agent, signature timestamp), and lease metadata (rent, deposit, term, dates, clauses, fee-payer choice, deposit-collection method).
  • Move-in and move-out: proof-of-completion uploads (photos, receipts), forwarding address on move-out, and any landlord deductions or settlement notes.
  • Maintenance: request title, description, category, urgency, and any photos you attach.
  • Messages: in-app messages between landlord and tenant in the natural course of an application or lease.
  • Payments: for each rent or one-off charge processed through the platform we record the amount, due date, status, Stripe invoice/charge identifiers, and a hosted-receipt URL. The card itself never touches our servers.

Automatically collected

  • Authentication and session data: when you sign in, we record your session identifier and may capture the IP address and user agent at sign-in time. We also capture IP and user agent at the moment you e-sign a lease, which forms part of the audit trail for that signature.
  • Listing-view tracking: we set a single first-party cookie (renloc_view_session) that lets us count distinct viewers of a listing without identifying you personally. It is HTTP-only, expires in one year, and is not shared with any third party.

2. How we use your information

  • To match landlords and tenants and to operate the rental lifecycle end-to-end.
  • To process rent and other rental-related payments through Stripe.
  • To send transactional email — application updates, lease invitations, payment receipts, password resets, and similar — through our email provider.
  • To maintain account security, prevent abuse, and detect fraud.
  • To comply with legal obligations, including tax, audit, and tenancy recordkeeping.
  • To improve the service in aggregate (for example, distinct-viewer counts on listings) — never to build advertising profiles about you.

3. Who we share information with

We share personal information only with parties that need it to operate the service, and only to the extent necessary. We name our service providers explicitly:

  • Stripe — payment processing, Stripe Connect onboarding (identity verification for landlords), and rent subscriptions. Stripe sees tenant name and email, payment amounts, and the metadata we attach to each charge. Landlords interact with Stripe directly during onboarding.
  • Resend — transactional email delivery. Resend processes the recipient address and the email content (subject, body) we send to you.
  • Vercel — application hosting and Vercel Blob file storage (listing photos, lease PDFs, move-in and maintenance uploads).
  • Our database host — Postgres-compatible managed database where account, application, and lease data lives. Access is scoped to renloc engineers via short-lived credentials.
  • better-auth — open-source authentication library running inside our own infrastructure. It manages password hashing, session tokens, and email verification flows. No personal information leaves our database for authentication purposes.

We also share information in two narrower circumstances:

  • Between users in the natural course of the service: when you submit a rental application, the landlord sees your application content (legal name, date of birth, phone, employer, income, references, message). When you sign a lease, both parties see the lease and the e-signature record.
  • When required by law: to comply with a valid court order, subpoena, regulatory request, or to protect rights, safety, or property.

4. What we never do

  • We never sell personal information.
  • We never share rental application or screening data for purposes other than the tenancy decision the tenant authorized.
  • We do not run advertising-profile tracking, retargeting, or ad-network pixels.

5. Your rights

Under PIPEDA, Quebec Law 25, and the BC and Alberta privacy acts, you have the right to:

  • Access the personal information we hold about you and learn how it is used.
  • Correct personal information that is inaccurate, incomplete, or out of date.
  • Delete your account and associated personal data, subject to the retention exceptions described below.
  • Withdraw consent at any time. Doing so may make some or all of the service unavailable to you.
  • File a complaint with the Office of the Privacy Commissioner of Canada or, if you are a Quebec resident, the Commission d’accès à l’information du Québec.

Email privacy@renloc.com to exercise any of these rights. We respond within 30 days.

For Quebec residentsQuebec Law 25 grants a private right of action — Quebec residents may seek damages directly in the courts of Quebec for breaches of the law. Nothing in this policy or our Terms of Service waives that right.

6. How long we keep information

We retain personal information only as long as needed to operate the service or to satisfy a legal obligation:

  • Active accounts: until you ask us to delete them.
  • Signed leases and lease PDFs: seven years following the end of the lease, to satisfy provincial residential tenancy and tax recordkeeping obligations.
  • Payment records: seven years (Canada Revenue Agency requirement).
  • Closed applications that did not result in a lease: twelve months after the application closes.
  • Listing-view cookie: one year.
  • Authentication sessions: per the rolling expiration set by our authentication library.

We may retain specific records longer where a legal hold, ongoing dispute, or fraud investigation requires it. Any such retention is documented and limited in scope.

7. Cross-border transfers

Some of our service providers process personal information outside Canada. Stripe, Resend, and Vercel may store or process data in the United States. Personal information in those jurisdictions may be subject to lawful access requests by foreign authorities — for example, under the U.S. CLOUD Act — that are not available to Canadian authorities.

We use providers that publish their own privacy commitments, sign data-processing agreements with us where applicable, and offer encryption in transit and at rest. By using renloc, you consent to these transfers.

For Quebec residentsThis section also serves as the cross-border transfer disclosure required by Article 17 of Quebec Law 25.

8. Security

We protect personal information with industry-standard safeguards: TLS encryption in transit, encrypted storage at our hosting and database providers, scoped engineer access via short-lived credentials, and audit logging for payment events. No system is perfectly secure; we work to minimize the risk and respond promptly when issues arise.

9. Cookies and tracking

renloc uses only strictly necessary cookies in v1:

  • Authentication session cookie — required to keep you signed in and to protect against cross-site request forgery.
  • renloc_view_session — a first-party cookie used to count distinct viewers of a listing. HTTP-only, one-year expiry, never shared with any third party.

We do not run analytics, retargeting, or marketing cookies. If we add any in the future, we will update this section and request consent — opt-in for Quebec residents and an informed opt-out option for the rest of Canada.

10. Children

renloc is intended for adults who can lawfully enter a rental agreement (typically 18 or, in some provinces, 19 years of age). We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, contact privacy@renloc.com and we will delete it.

11. Changes to this policy

We will update the “Last updated” date at the top of this page when we change this policy. For material changes, we will email active users at least thirty days before the change takes effect, so you have time to review and, if you wish, request deletion of your account before the new terms apply.

12. Contact

For privacy questions, requests, or complaints, write to our Privacy Officer at privacy@renloc.com.

Postal mail: address to follow.

Quebec residents may also contact the Commission d’accès à l’information directly.