Privacy Policy

SQRFT Privacy Policy Last updated: October 2026
<hr />
1. Who We Are
SQRFT ("we", "us", "our") is a Canadian rental marketplace operating at sqrft.ca, connecting tenants and landlords across Canada. SQRFT is operated in association with UrbanLease, a property management company. Our mailing address is Alberta, Canada. For privacy inquiries contact: <a href="mailto:[email protected]" target="_blank" rel="noopener noreferrer">[email protected]</a>
<hr />
2. What Personal Information We Collect
We collect only the information necessary to operate our platform:
<ul>
<li>Account information: name, email address, phone number, account type (tenant or landlord)</li>
<li>Listing information: property address, photos, rental price, availability</li>
<li>Communications: messages sent between tenants and landlords via our chat feature</li>
<li>Usage data: pages visited, search queries, device type, IP address</li>
<li>Payment information: processed by Stripe; we do not store card numbers</li>
<li>Passport data (if applicable): identity verification documents, rental history, income information collected via SQRFT Passport</li>
<li>Identity check: we ask you to verify your identity before you post a listing, and new accounts also verify before they send messages. Tenants can also verify from their SQRFT Passport. Our ID check partner, Didit, asks for a photo of your government-issued ID and a selfie, checks that the selfie is live, and compares your face with the photo on the ID. This uses biometric information (measurements of your face). SQRFT keeps the result, the date, the number of tries and Didit's reference for the check. Each time you start or continue the check, we also keep a record that you agreed to it: the date and time, which wording you agreed to, your IP address and your browser type. The ID images and selfie you give Didit for this check stay with Didit; SQRFT does not store them.</li>
</ul>
<hr />
3. Why We Collect It (Purpose)
<table>
<thead>
<tr>
<th>Data</th>
<th>Purpose</th>
</tr>
</thead>
<tbody>
<tr>
<td>Account info</td>
<td>Create and manage your account</td>
</tr>
<tr>
<td>Listing info</td>
<td>Display rental listings to tenants</td>
</tr>
<tr>
<td>Communications</td>
<td>Enable tenant-landlord contact</td>
</tr>
<tr>
<td>Usage data</td>
<td>Improve platform performance and security</td>
</tr>
<tr>
<td>Payment info</td>
<td>Process subscription payments</td>
</tr>
<tr>
<td>Passport data</td>
<td>Verify tenant identity and rental history</td>
</tr>
<tr>
<td>Identity check result and consent record</td>
<td>Confirm that each account belongs to a real person, to keep fake accounts, fraud and spam off SQRFT, and show that you agreed to the check</td>
</tr>
</tbody>
</table>
<hr />
4. Sharing With Third Parties
We share your information only as follows:
<ul>
<li>UrbanLease: As an affiliated property management company, UrbanLease may contact landlords registered on SQRFT to offer optional property management services. You may opt out of this contact at any time by emailing <a href="mailto:[email protected]" target="_blank" rel="noopener noreferrer">[email protected]</a></li>
<li>Stripe: Payment processing</li>
<li>Google: Maps, location services, and AI description generation (Gemini)</li>
<li>Firebase: Authentication and push notifications</li>
<li>Cloudflare: Security, CDN, and DDoS protection</li>
<li>Vultr: Cloud hosting provider where data is stored on Canadian/US servers</li>
<li>Didit: Identity verification, including the live selfie check and face match. Didit processes and stores your ID images and selfie in the European Union, on Amazon Web Services servers in Ireland, so this information leaves Canada. While it is outside Canada it is subject to the laws there, and courts, law enforcement and national security authorities in those countries may be able to access it. Didit sends SQRFT the result and deletes your ID images and selfie 6 months after the check. Didit does not use SQRFT users' data to train its models. More detail is in Didit's Verification Privacy Notice: <a href="https://didit.me/terms/verification-privacy-notice/" target="_blank" rel="noopener noreferrer">https://didit.me/terms/verification-privacy-notice/</a></li>
<li>Google Analytics: We use Google Analytics 4 to understand how visitors use the site (pages visited, session duration). No personally identifiable information is shared with Google for this purpose.</li>
<li>Meta (Facebook) Pixel: We use Meta Pixel to measure the effectiveness of any ads we run on Facebook/Instagram. No personal data (name, email, phone) is shared with Meta.</li>
<li>PostHog: We use PostHog for product analytics to understand how features are used. Data is anonymised.</li>
</ul>
All analytics tools listed above only activate after you accept cookies via our consent banner. If you decline, none of these tools run. We do not sell your personal information to any third party.
<hr />
5. Your Rights Under PIPEDA
You have the right to:
<ul>
<li>Access your personal information: request a copy of what we hold</li>
<li>Correct inaccurate information</li>
<li>Delete your account and associated data</li>
<li>Withdraw consent at any time (note: withdrawal may limit platform functionality)</li>
<li>File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca</li>
</ul>
To exercise any of these rights, email <a href="mailto:[email protected]" target="_blank" rel="noopener noreferrer">[email protected]</a> or use the data deletion request form at sqrft.ca/data-deletion
<hr />
6. Data Retention
<table>
<thead>
<tr>
<th>Data Type</th>
<th>Retention Period</th>
</tr>
</thead>
<tbody>
<tr>
<td>Account data</td>
<td>Until account deletion request</td>
</tr>
<tr>
<td>Listing data</td>
<td>Until listing removed + 30 days</td>
</tr>
<tr>
<td>Chat messages</td>
<td>12 months</td>
</tr>
<tr>
<td>Payment records</td>
<td>7 years (legal requirement)</td>
</tr>
<tr>
<td>Security logs</td>
<td>90 days</td>
</tr>
<tr>
<td>Passport documents</td>
<td>6 months after last use</td>
</tr>
<tr>
<td>Identity check result and consent record</td>
<td>Until account deletion request</td>
</tr>
<tr>
<td>ID images and selfie (held by Didit)</td>
<td>6 months after the check</td>
</tr>
</tbody>
</table>
<hr />
7. Security
We protect your data using:
<ul>
<li>HTTPS encryption on all connections</li>
<li>Encrypted database passwords and API keys</li>
<li>IP-restricted admin access</li>
<li>Multi-factor authentication for admin accounts</li>
<li>Cloudflare WAF and DDoS protection</li>
<li>Regular security audits</li>
</ul>
<hr />
8. Cookies
We use cookies for authentication, preferences, and analytics. You can manage cookie preferences via the consent banner when you first visit sqrft.ca. See our Cookie Policy for details.
Essential cookies - required for the site to function. These keep you logged in and remember your preferences. They run regardless of your consent choice.
Analytics cookies - optional. We use Google Analytics 4, Meta Pixel, and PostHog solely to understand how visitors use the site. These only load after you explicitly accept via our cookie banner.
You can withdraw your analytics consent at any time by clicking Cookie Preferences in the site footer. This will reload the page with all analytics disabled.
<hr />
9. Data Breach Notification
In the event of a data breach that poses real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA, within a reasonable timeframe.
<hr />
10. Contact Us
Privacy Officer: SQRFT Privacy Team Email: <a href="mailto:[email protected]" target="_blank" rel="noopener noreferrer">[email protected]</a> Website: sqrft.ca