Privacy Policy

PropTrust Group Inc. ("PropTrust," "we," "us," or "our") operates the website proptrust.group and its associated products and services. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services, including RentTrust, BuyTrust, Strata Minutes AI, AgentTrust, and FinanceTrust.

PropTrust is a Canadian company and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). We are committed to protecting your privacy and handling your personal information responsibly.

1. Information We Collect

Information you provide directly

• Name and email address when you submit a contact form or sign up for a service
• Documents you upload for analysis (e.g., strata minutes submitted to our Strata Minutes AI tool)
• Building search queries and report requests
• Payment information processed through Stripe — we do not store your credit card numbers on our servers
• Any other information you voluntarily provide through our contact forms or communications

Information collected automatically

• Device and browser information collected by Cloudflare Turnstile for bot protection (minimal device data used solely for security verification)
• Trial token usage and service interaction data
• Session tokens for maintaining your authenticated state
• Theme preferences (light/dark mode)

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our products and services
• Process your building report requests, strata document analyses, and other service transactions
• Send transactional emails related to your use of our services (e.g., report delivery, account notifications)
• Respond to your inquiries and support requests
• Process payments securely through our payment processor
• Protect our services from abuse, fraud, and bot activity
• Understand how our services are used to improve the user experience
• Comply with legal obligations

3. Data Sharing

We do not sell your personal information to third parties.

We may share your information only with the following categories of service providers, strictly as necessary to deliver our services:

• Stripe — for secure payment processing. Stripe receives your payment details directly; we never store card numbers on our servers.
• Brevo — for transactional email delivery (e.g., report delivery, account notifications). Your email address is shared with Brevo solely for this purpose.
• Cloudflare Turnstile — for bot protection. Minimal device data is collected during verification challenges.
• Anthropic (Claude AI) — for document analysis in our Strata Minutes AI tool. Documents are processed server-side and are not permanently stored by PropTrust or Anthropic after analysis is complete.
• Supabase — for secure database storage and authentication services.

We may also disclose your information if required by law, regulation, or legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of PropTrust, our users, or others.

4. Data Storage & Security

Your data is stored securely using Supabase, which provides encrypted database storage with row-level security policies. All data transmission between your browser and our servers is encrypted using TLS/SSL.

Documents uploaded for strata analysis are processed server-side and are not retained permanently. They are used solely for the purpose of generating your analysis report and are deleted after processing.

While we implement industry-standard security measures to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to protecting your data using commercially reasonable measures.

5. Cookies & Local Storage

Our use of cookies and local storage is minimal:

• Theme preference — we store your light/dark mode preference locally so it persists between visits.
• Session tokens — used to maintain your authenticated session when you are logged in.
• Cloudflare Turnstile — may set cookies as part of its bot protection verification process.

We do not use advertising cookies or tracking pixels. If we add analytics tools (such as Google Analytics) in the future, this policy will be updated accordingly.

6. Third-Party Services

Our services integrate with third-party providers as described in Section 3. Each of these providers has its own privacy policy governing how they handle data:

• Stripe — stripe.com/privacy
• Brevo — brevo.com/legal/privacypolicy
• Cloudflare — cloudflare.com/privacypolicy
• Anthropic — anthropic.com/privacy
• Supabase — supabase.com/privacy

We encourage you to review the privacy policies of these third-party services.

7. Your Rights Under PIPEDA

As a Canadian company subject to PIPEDA, we respect your right to:

• Access your personal information — you may request a copy of the personal information we hold about you.
• Correct your information — you may request corrections to any inaccurate or incomplete personal information.
• Request deletion — you may request that we delete your personal information. We will comply unless we are required to retain it for legal or legitimate business purposes.
• Withdraw consent — you may withdraw your consent for the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.

To exercise any of these rights, please contact us through our contact page. We will respond to your request within 30 days.

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Account information — retained for the duration of your account and deleted upon request.
• Uploaded documents — processed for analysis and not retained permanently. Documents are deleted after your report is generated.
• Transaction records — retained as required for accounting and legal compliance.
• Contact form submissions — retained for as long as necessary to respond to your inquiry.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will update the "Effective date" at the top of this page. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how we handle your personal information, please reach out through our contact page.