Legal Document

Privacy Policy

Last updated: April 15, 2026 • Effective immediately

Mozongi REMA ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights under applicable laws including Quebec's Law 25 (Act respecting the protection of personal information in the private sector), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and the Canada Anti-Spam Legislation (CASL).

1. Information We Collect

1.1 Account Information

When you register, we collect:

Email address — used as your login identifier and for account communications
Password — stored as a salted hash (we never store or see your actual password)

1.2 Profile Information (Optional)

You may provide in Settings:

First and last name, phone number, mailing address, role, profile photo/logo
This information is used to personalize your experience and auto-fill documents like reference letters

1.3 Property and Lease Data

You enter:

Property addresses, purchase prices, mortgage details, tax amounts, insurance costs
Tenant names, contact information, lease terms, rent amounts, payment records
Uploaded documents (ID, insurance proof, employment letters)

This is your data. We store it solely to provide the service. We do not access, read, or analyze individual property or tenant data.

1.4 Payment Information

When you subscribe to a paid plan:

Payment processing is handled entirely by Stripe. We never see, store, or have access to your full credit card number.
We store your Stripe Customer ID and Subscription ID to manage your plan.
Stripe may store your card details securely under their PCI-DSS compliant infrastructure.

1.5 Usage Data

We automatically collect:

Login timestamps and session information
Feature usage patterns (which pages you visit, not what you type)
Device type and browser (for compatibility)

2. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide the service	All account and property data	Contract performance
Account security	Email, password hash, sessions	Legitimate interest
Subscription billing	Stripe Customer ID, Subscription ID	Contract performance
Platform analytics	Aggregated, anonymized usage data only	Legitimate interest
Customer support	Email, support ticket content	Contract performance
Service announcements	Email	Legitimate interest
Marketing emails	Email (only with separate opt-in)	Consent

3. Aggregated Analytics

We collect anonymized, aggregated statistics about the platform for business intelligence and potential advertising partnerships:

Total number of users, properties, and leases (no names attached)
Geographic distribution of properties (e.g., "45% of properties are in Quebec")
Average portfolio values and rent amounts (no individual data)

This data cannot be traced back to any individual user. We may share these aggregated insights with business partners or use them for advertising targeting (e.g., showing ads relevant to "property managers in Montreal").

4. Advertising

We may display advertisements in the app. Our advertising practices:

We do not sell your personal information to advertisers
We may use anonymized segments (e.g., "users with 5+ properties") for ad targeting
If we implement third-party ad tracking (cookies), we will display a cookie consent banner and allow you to opt out
You can use the app without personalized ads — basic functionality is never affected

5. Data Sharing

We share your personal data only in these cases:

Portfolio sharing: When you explicitly share your portfolio with another user, they can see your property and lease data. You control the permission level and can revoke access anytime.
Service providers: We use Supabase (database), Railway (hosting), Stripe (payment processing), and Resend (email delivery). These providers process data on our behalf under strict confidentiality agreements.
Legal requirements: If required by law, court order, or government request.

We never sell, rent, or trade your personal information to third parties.

6. Data Storage and Security

Data is stored in Supabase (PostgreSQL database) hosted in US-East (Virginia)
All data is encrypted in transit (HTTPS/TLS) and at rest
Passwords are hashed using SHA-256 with unique salts — we cannot see your password
Sessions expire and can be revoked by logging out

Note: Data is currently stored in the United States. Under Quebec Law 25, we are required to inform you that your data may be subject to US jurisdiction. We are evaluating migration to Canadian data centers.

7. Your Rights

Under Quebec Law 25 and PIPEDA, you have the right to:

Access — View all personal data we hold about you (available in Settings)
Rectification — Correct inaccurate information (editable in Settings)
Deletion — Delete your account and all data permanently (Settings > Security > Delete Account)
Portability — Request a copy of your data in a standard format
Withdraw consent — Opt out of marketing communications at any time
File a complaint — With the Commission d'acces a l'information du Quebec (CAI)

8. Data Retention

Active accounts: Data retained as long as your account is active
Deleted accounts: All data permanently removed within 30 days of deletion
Sessions: Automatically cleaned up after 30 days of inactivity
Support tickets: Retained for 1 year after resolution

9. Cookies

We use a single session cookie (session_token) to keep you logged in. This cookie:

Is essential for the app to function (you cannot use the app without it)
Contains no personal information — only a random token
Is deleted when you log out

We do not currently use tracking cookies, analytics cookies, or advertising cookies. If we add these in the future, we will implement a cookie consent banner.

10. Children

Mozongi REMA is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of any material changes. Continued use of the service after changes constitutes acceptance.

12. Privacy Officer

For privacy inquiries, data access requests, or complaints:

Privacy Officer
Mozongi REMA
Email: [email protected]
(or your current contact email until custom domain is set up)