Privacy Policy
Last updated
2026-05-10
Who we are
Property Briefcase is a homeowner property-management service operated in Ontario, Canada. The Privacy Officer can be reached at privacy@propertybriefcase.com.
What we collect
- Account info: email, name, role (homeowner or realtor).
- Property identifiers you provide: address, PB Number, PINs (Property Identification Numbers), ARN (Assessment Roll Number).
- Document content + AI-extracted fields from the documents you upload (warranties, tax bills, inspection reports, agreements of purchase and sale, etc.).
- Records you create: equipment, Property Knowledge & Information (PKI) notes, expenses, tasks, contacts.
- Messages you send to the AI chat.
- Usage telemetry (page views, error reports) — only when you opt in via the analytics cookie.
Why we collect it
- To operate the service — file your documents, generate reminders, retrieve answers.
- To communicate with you — account emails, transactional notifications, optional briefings.
- To improve the product — only with your analytics consent.
- To comply with applicable law.
Where it goes (our processors)
We use a small set of third-party processors under data-processing agreements. The full inventory — what each one sees, whether content is stored, and a link to the relevant DPA — lives on the Data Processors page.
How long we keep it
- Active account: as long as you have one, plus 30 days after deletion.
- Soft-deleted documents: 30 days, then purged.
- Unclaimed briefcases: 30 days recoverable, then a 30-day hard-delete window (60 days total).
- Anonymized telemetry: indefinite.
How we protect your data
Your documents are encrypted at rest (AES-256 via Supabase Storage) and in transit (TLS 1.3, with HSTS enforced from the edge). Access to your data is controlled at the database layer by Row Level Security policies — the same enforcement that isolates one homeowner’s records from another and one realtor team’s private workspace from another’s. Documents are reached only via short-lived signed URLs that never appear in AI prompts. We never log document content, prompts, AI responses, or signed URLs. Our internal posture lives in docs/security-baseline.md.
Your rights under PIPEDA
You can request access to your data, ask us to correct it, withdraw consent, or complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Email privacy@propertybriefcase.com to exercise any of these rights.
AI processing
Documents you upload are sent to Google (Gemini) for classification + extraction, with Anthropic (Claude) as a fallback. Both providers operate under their published DPAs with no-training clauses; content is processed transiently and is not stored beyond the request. See the Data Processors page for the specifics.
Children’s privacy
Property Briefcase is not intended for users under 18.
Changes to this policy
When we materially change this policy, we bump the consent-cookie version and the banner re-prompts you on your next visit. We also email registered users at least 14 days before the change takes effect.