Privacy Policy

ManageRight (“we”, “us”) is rental management software operated by ManageRight Software Inc., a federal Canadian corporation with its registered office in British Columbia.

Contact for privacy matters:
Tabitha Lewis, Privacy Officer
support@manageright.ca
Victoria, British Columbia, Canada

We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

ManageRight has two types of users, and our privacy obligations differ for each.

Landlords are our customers. They create an account, pay a subscription, and decide what information to record about their properties and tenants. For landlord information, we are the organization responsible for that data.

Tenantsare invited into ManageRight by their landlord. Tenants do not sign up on their own and are not our paying customers. For tenant information, we act on the landlord's behalf — the landlord decides what tenant information is collected and why; we store and process it according to their instructions and this policy.

If you are a tenant with questions about why your landlord collects certain information, or you want your information corrected or deleted, please contact your landlord first. We will assist them in responding to you.

From landlords

• Account information: name, email address, phone number, business name
• Bank payment setup (only if you accept bank payments): identity and banking details are collected directly by Stripe to open your Stripe account. We receive only your Stripe account ID and whether it is ready to accept payments.
• Billing information: processed by Stripe. We do not store your full credit card number.
• Property information: addresses, unit details, rent amounts, photos and descriptions
• Business records: lease terms, payment records, maintenance requests, uploaded documents, notes, contractor contact details

From tenants (collected at the landlord's direction)

• Identity and contact: name, email address, phone number
• Emergency contact information (if provided)
• Tenancy information: lease terms, unit, rent amount, move-in and move-out dates, deposit amounts
• Payment records: amounts, dates, and methods reported or recorded for rent and utilities
• Communications: messages exchanged with the landlord
• Bank payment details (only if you choose to pay by bank): your bank account is linked through Stripe. We receive only the bank name, the last four digits of the account, whether autopay is on, and the status of each payment. We never see or store your full account number or online banking credentials.
• Notification preferences: your phone number if you add one, whether you opted in to text messages, and when you gave that consent
• Maintenance requests: descriptions and details you submit
• Documents: files uploaded by you or shared with you

Collected automatically

• Authentication data: login timestamps, session information
• Technical data: IP address, browser type, device type, pages accessed
• Usage analytics: aggregate usage patterns via Vercel Analytics

We do not collect: government identification numbers, credit scores, background check results, banking credentials, or biometric data. Where Stripe needs identity or banking information to process payments, Stripe collects it directly under its own privacy policy.

We collect personal information to:

• Create and secure user accounts
• Provide the tenancy management features landlords subscribe to
• Enable communication between landlords and their tenants
• Process subscription payments
• Process optional rent payments by pre-authorized debit through Stripe, and calculate balances and late fees set by the landlord
• Send notifications by email and, if you opt in, by text message (invitations, password resets, messages, payments, maintenance and visit notices)
• Maintain records landlords are required or choose to keep
• Diagnose problems, prevent abuse, and improve the service

Consent. Landlords consent when they create an account and accept our Terms of Service. Tenants consent when they accept an invitation and activate their account. Landlords are responsible for ensuring they have a lawful basis for entering tenant information into ManageRight, and for informing tenants that ManageRight is used to manage their tenancy.

You may withdraw consent at any time, subject to legal and contractual restrictions, by contacting us — though doing so may mean we can no longer provide the service.

We use the following third parties to operate ManageRight. Each has access only to what it needs to perform its function.

• Supabase — database, authentication, file storage
• Vercel — application hosting and analytics (global edge network)
• Stripe— subscription billing and optional rent payments by pre-authorized debit, including verifying landlords and linking tenants' bank accounts (Canada and United States)
• Resend — transactional email delivery (United States)
• Twilio — text message delivery, only for users who opt in (United States)
• Anthropic — the AI maintenance request assistant; the content of that conversation is sent to Anthropic to generate replies (United States)

Cross-border storage.Some of our providers store or process data outside Canada, including in the United States. While your information is in another country, it may be accessible to that country's courts, law enforcement, and national security authorities under that country's laws. By using ManageRight, you acknowledge this transfer.

We do not sell personal information. We do not share it with advertisers. We do not use your data to train machine learning models, and under its commercial terms our AI provider does not use it to train its models either.

• All data is encrypted in transit (HTTPS/TLS) and at rest
• Access is restricted by row-level security rules — landlords can only reach their own records; tenants can only reach their own tenancy
• Documents are stored privately and served through expiring signed links
• Payment card and bank account details are handled by Stripe and never touch our servers
• Changes to pre-authorized debit consent (linking or unlinking a bank, turning autopay on or off) are recorded with the time and IP address, so either party can verify what was authorized
• Passwords are stored as cryptographic hashes, never in readable form

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.

• Active landlord accounts: while the subscription is active
• Cancelled landlord accounts: 90 days after cancellation, then deleted
• Tenant records: retained by the landlord's instruction; deleted with the landlord's account
• Payment and financial records: 6 years, as required for tax purposes. Stripe keeps its own payment records under its policies
• Ended tenancies: retained so landlords keep required tenancy records
• Backups: purged on our providers' standard cycles

Under PIPEDA and BC PIPA you may:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Withdraw consent (subject to legal and contractual limits)
• Stop text messages at any time by replying STOP or turning them off in Settings, and cancel a pre-authorized debit agreement by unlinking your bank account
• Request deletion of your information
• Complain to us, and escalate to a regulator if unsatisfied

To exercise any of these, email support@manageright.ca. We will respond within 30 days as required by law. We may need to verify your identity first.

Tenants:because we process your information on your landlord's behalf, please direct access and deletion requests to your landlord where possible. If you cannot reach them, contact us and we will help.

Escalation:
Office of the Privacy Commissioner of Canada — priv.gc.ca — 1-800-282-1376
Office of the Information and Privacy Commissioner for BC — oipc.bc.ca

We use only what the service needs to function:

• Essential cookies — keep you logged in and secure your session
• Analytics — Vercel Analytics collects aggregate, non-identifying usage data

We do not use advertising cookies or third-party trackers.

ManageRight is not intended for anyone under 19. We do not knowingly collect information from children. If you believe a child's information has been entered into ManageRight, contact us and we will remove it.

We may update this policy as the service evolves. Material changes will be communicated by email or in-app notice at least 30 days before taking effect. The “Last updated” date above always reflects the current version.

Questions, requests, or complaints:

Tabitha Lewis, Privacy Officer
support@manageright.ca
Victoria, British Columbia, Canada

We respond to all privacy inquiries within 30 days.

See also our Terms of Service.