Privacy Policy

Tenon10 ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our property management platform.

Personal Information

• Name, email address, and phone number
• Physical address and property details
• Payment and financial information
• Government-issued identification (when required)
• Employment and income information (for tenant screening)

Usage Information

• Log data (IP address, browser type, pages visited)
• Device information (device type, operating system, app version)
• Cookies and similar tracking technologies (web)
• Analytics data about how you use our platform
• Crash and performance reports, with personal details removed before they leave your device

Information From Your Device (Mobile App)

The app asks for each of these only when you use the feature, and each can be declined in your device settings:

• Camera and photo library: photos and scans you attach to maintenance requests, lease uploads, expense receipts and identity or business verification. We receive only what you choose to capture or select.
• Microphone: voice messages to Keya, our assistant. The recording is converted to text by a speech-to-text provider and the audio is not retained afterwards.
• Notifications: a push notification token for this device, so we can deliver alerts you have turned on. You control which categories reach you, on which channel, and can set quiet hours.
• Face ID, Touch ID or fingerprint: if you turn on biometric sign-in, your device creates a cryptographic key pair that only unlocks with your biometric. We store the public half, along with the device's name, the type of biometric, and when it was last used, so we can recognise the device. Your face or fingerprint data never leaves your device and is never sent to us.
• Location: we do not access your device's location. Addresses come from what you type or place on a map.

Property Information

• Property addresses and descriptions
• Rental rates and lease terms
• Maintenance history and vendor interactions
• Financial transactions related to properties

Digital Signatures and Electronic Documents

• Authenticated Users: When you sign documents while logged in, we store your digital signature (drawn, typed, or uploaded) along with a timestamp, document hash, and audit trail for legal compliance and future reuse
• Anonymous Users: When you use our free form tools without an account, your signature is embedded directly in the generated PDF and is not stored in our database. The PDF serves as the complete legal document
• Document integrity hashes (SHA-256) to verify document authenticity
• IP addresses and timestamps for audit purposes (authenticated users only)

To build trust between landlords and tenants, we offer optional identity verification services. This section explains how we handle your identification documents.

What We Collect

• ID Document Images: Photos of your government-issued identification (driver's license, passport, provincial ID, permanent resident card, or citizenship card)
• Extracted Information: Name, date of birth, document expiry date, issuing authority, and address (if present on the ID)
• Verification Metadata: Timestamp of submission, confidence scores, and verification status
• Document Hash: A cryptographic hash (SHA-256) of your document image to prevent duplicate submissions across users

How We Process Your ID

• Automated Analysis: We use AI-powered document recognition (Google Gemini Vision) to extract information from your ID and verify it matches the selected document type
• Fraud Detection: Our system performs automated checks for document authenticity, including:
  • Document type verification (ensuring you upload the correct ID type)
  • Detection of potentially altered or manipulated documents
  • Security feature verification where visible (holograms, micro-text)
  • Duplicate detection to prevent the same document being used by multiple accounts
• Manual Review: Documents that don't pass automated checks may be reviewed by our verification team

Data Retention for ID Documents

• Document Images: Automatically deleted 30 days after verification approval
• Extracted Data: Retained while your account is active to maintain verification status
• Verification Status: Retained to provide portable verification badges
• Audit Logs: Retained for 7 years for legal compliance

Your Rights Regarding ID Verification

• ID verification is completely optional
• You can request deletion of your verification data at any time
• Verified status can be shared with other platform users (with your consent)
• You will be notified if your verification is rejected with reasons

Third-Party Processing

ID verification images are processed using Google Cloud AI services (Gemini Vision API) for text extraction and document analysis. Google's use of this data is governed by their Cloud Terms of Service. We do not share your ID documents with any other third parties except as required by law.

To Provide Our Services

• Facilitate property listings and tenant applications
• Process rent payments and financial transactions
• Manage maintenance requests and vendor communications
• Generate reports and analytics for property management
• Read the documents you upload (leases, receipts, identity documents) so the details can be filled in for you and verified
• Send you the notifications you have chosen, by email, in the app, by push, or by text message for security codes
• Recognise a phone you have enrolled for biometric sign-in and let it sign in without a password

To Improve Our Platform

• Analyze usage patterns to enhance user experience
• Develop new features and services
• Conduct research and analytics
• Personalize your experience

For Legal and Security Purposes

• Comply with legal obligations and regulations
• Detect and prevent fraud or security issues
• Investigate a problem you report or a fault on your account, which may include an administrator viewing your account read-only, as described under Data Security
• Enforce our terms of service
• Protect rights and safety of users

We do not sell your personal information. We may share information:

With Your Consent

• When you explicitly agree to share information
• With other users as part of the platform functionality

With Service Providers

We share only what each provider needs to do its job, under agreements that restrict use to that job:

• Payment processing (Stripe): payment details and transaction amounts
• Bank account connections (Plaid), when you choose to link an account: your bank login is handled by Plaid; we receive account and transaction details for bookkeeping
• Cloud hosting and database (Supabase, running on Amazon Web Services; Vercel): all platform data
• Email delivery (Resend) and text-message delivery (Telnyx, for security codes and alerts you opt into): your address or phone number and the message
• Push notification delivery (Expo, Apple and Google notification services): your device token and the notification text
• Speech-to-text (Deepgram): voice messages to Keya, for transcription only
• Document reading and identity verification (Google Gemini and Cloud Vision): the lease, receipt or identity document you upload, to extract its details and check it
• AI assistants (OpenAI, Anthropic, Google): see AI Data Access below
• Address lookup and maps (Google Places and Maps; Apple Maps on iOS): the address text you type or the map area you view
• Crash and error reporting (Sentry): technical reports with names, email addresses and other personal details removed before sending
• Business outreach email (Saleshandy and Apollo, email sequence providers): the published business contact details of the trades and businesses we contact about our services, and the opt-outs they give us, so they are never contacted again. An account holder's details are never sent to them

For Legal Reasons

• To comply with legal obligations
• To respond to lawful requests by public authorities
• To protect our rights and safety

Some records name more than one person. A lease names a landlord and a tenant; a payment record names who paid and who was paid. Erasing your side of such a record would remove evidence the other party may depend on, so where we are legally required to keep it, we keep it — and Data Retention below says for how long.

Fraud Prevention

We retain one-way cryptographic hashes derived from identity verification. These hashes:

• Prevent the same person being verified on two active accounts at once
• Prevent the same identity document being used on two active accounts at once
• Cannot be reversed to recover any personal information
• Are retained indefinitely as permitted under PIPEDA for fraud prevention purposes

They do not prevent you from registering again after deleting your account. If you return, you may verify afresh, and you start with a new, empty account — nothing from the previous one carries over.

The Tenon10 marketplace lets landlords, tenants and other customers find, book and pay local service businesses ("pros"). This section explains the extra information it handles. Businesses that list on it also agree to our Marketplace Terms for Businesses.

Public Business Profiles

A pro's profile is public on the internet and may be indexed by search engines: business name, trades, service areas, prices, photos, badges, licence and registration numbers the business gives us, reviews and the business's replies. Documents a business uploads for our checks (insurance certificates, licences) are private and seen only by our staff who review them. We remove location data from uploaded photos.

Profiles We Prepare

We may prepare a basic profile for a business before it joins, from public sources such as its website, public business listings and licensing registries. The business can claim the profile or ask us to remove it, and not to contact it again, at any time on our "Remove my business" page. We keep a do-not-contact record so the request is honoured.

Reviews and Review Fraud Checks

Only a customer who booked and paid for a job through Tenon10 can review it. To keep reviews honest we check new reviews for signs of fraud and may hold one for our team to look at. The checks use:

• whether the reviewer's email address or phone number matches someone on the business's own team;
• how many reviews a business receives in a short time;
• a one-way hash of the reviewer's network address prefix (we do not store the address itself), to spot many reviews from one place; and
• whether the text closely copies another recent review.

A review we publish shows the reviewer's first name and last initial, never their contact details.

Booking Without an Account

You can book a pro without an account. We keep the name, email address, phone number, job address and details you enter, and share them with the pro you booked so they can do the job. We email you a private link to follow the booking; we store only a one-way hash of that link, and it expires. If you later create an account with the same email address, you can add the booking to it.

What a Pro Receives

When you book a pro, they receive your contact details and the job details (for example the address of the unit and how to get in). Pros may use them only for that job and must not add you to marketing lists without your consent. When a landlord pays a pro's invoice through Tenon10, the invoice is also recorded in that landlord's own books on Tenon10.

Sponsored Placements

Some links to pros in our blog and directory are paid placements and are labelled as such. We count how often each one is shown and clicked (the link carries a placement code) and how many bookings start from it. These counts are totals per placement per day; they are not tied to you and are shared with the business only as totals.

We implement appropriate technical and organizational measures:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication measures
• Employee training on data protection
• Incident response procedures

When Our Staff Views Your Account

• To investigate a support request or a fault, an authorised Tenon10 administrator may view your account as you see it.
• That view is read-only. They cannot change anything in your account, make a payment, or send a message as you.
• Only a small number of authorised administrators can do this.
• Every session lasts at most one hour and is recorded: who viewed, whose account, and when.

On Your Device

• The app keeps your sign-in session in storage that only the Tenon10 app can read, encrypted with a key held in your phone's secure keystore.
• Biometric sign-in keys live in your phone's secure hardware and can only be used after your face or fingerprint is verified by the operating system.
• Signing out removes the session and the push notification token for that device. Removing a device from Security on the web, or changing your password, revokes its biometric sign-in.

Access and Portability

You have the right to access and receive a copy of your personal data. Email [email protected] from the address on your account and we will send it to you within 30 days. Much of it is already available to you directly: your leases, payment history, invoices and receipts, and uploaded documents can be viewed and downloaded from your account at any time.

Correction

You can update or correct your information through your account settings.

Account Deletion

You may delete your account at any time, from the app under Account → Settings → Delete account, or from your account settings on the web. We will not refuse the request because you have an active lease or an outstanding balance. Full details are on our account deletion page.

Immediately: you are signed out and can no longer sign in. Automatic payments stop and any invitations you sent are cancelled.

Within 30 days: outstanding amounts are settled in both directions — anything we owe you is paid, and unused prepaid subscription time is refunded.

After 30 days: your personal identifying information (name, email, phone, date of birth, photos, identity documents, saved payment and payout details, and contact details you gave us about guarantors, occupants or references) is erased, and your account record is removed. We email you a summary of what was deleted and what was kept.

What we keep, and why. Records we are legally required to keep are retained: leases under residential tenancies legislation, payment records and invoices for six years as the Canada Revenue Agency may require, deposits while they remain claimable, and notices served, which are legal instruments. These records name another person as well as you, and erasing them would remove evidence that person may depend on.

What deletion does not do. It does not end a tenancy: if you rent, your lease stays in force and rent remains due directly to your landlord. It does not cancel money owed in either direction. If you belong to a company account, deleting your personal account removes you from it; the company and its records remain.

Consent Management

You can manage your consent preferences in your privacy settings.

Notifications

In Notification Preferences you choose, for each category, whether it reaches you by email or in the app (push notifications follow the in-app setting), and you can set quiet hours during which non-urgent messages wait. Payment, legal and security notices that you need in order to use the service cannot be turned off. Marketing emails can be turned off at any time, including from the link in each one.

Biometric Sign-in and Enrolled Devices

Biometric sign-in is optional and off until you turn it on. You can turn it off in the app at any time, and you can see and remove every enrolled phone under Security in your account settings on the web.

We retain your information for as long as necessary to provide our services and comply with legal obligations:

Individual Account Data

• Personal identifying information: Erased within 30 days of account deletion
• Sensitive data (SIN, banking info): Deleted within 30 days of confirmed deletion
• ID verification document images: 30 days after approval (automatically deleted)
• Information extracted from identity documents (name, date of birth): Erased on account deletion
• Communication logs: 1 year
• Analytics data: 2 years
• Push notification tokens: Removed when you sign out of that device, and on account deletion
• Biometric sign-in device records (public key, device name): Removed when you remove the device, change your password, or delete your account
• Voice messages to Keya: Not retained after transcription
• Crash and error reports: Up to 90 days, with personal details removed before sending

Records We Are Required to Keep

These name another person as well as you, so they are retained whatever the status of either account:

• Leases and tenancy agreements: as required under residential tenancies legislation
• Payment records, invoices and receipts: 6 years (Canada Revenue Agency)
• Deposits and trust records: while the deposit remains claimable
• Notices served or received: these are legal instruments
• Dispute records, claims and legal filings: for the life of the matter and any limitation period
• Digital signatures and signed documents: 7 years (for authenticated users)
• Signature audit logs: 7 years (legal compliance requirement)

Everything else belonging to a deleted account is erased. See Your Rights and Choices for what that covers.

Where a record evidences an obligation — a lease, a payment, a deposit held, a notice served — the name on it is retained rather than anonymized. Anonymizing a landlord who owes a tenant a deposit would remove the very record the tenant's claim rests on. Records that carry no obligation, such as activity and analytics logs, are anonymized.

Fraud Prevention Data

• Identity verification hashes (one-way, non-reversible): Retained indefinitely
• Document hashes: Retained indefinitely

These hashes prevent the same person or document being verified on two active accounts at once. They cannot be reversed to recover personal information, and they do not prevent you from registering again after deleting your account.

These cryptographic hashes cannot be used to reconstruct personal information. They exist solely to prevent re-registration fraud and are retained under PIPEDA's legitimate interest provisions for fraud prevention.

We use cookies and similar technologies to:

• Keep you logged in to your account
• Remember your preferences
• Analyze platform usage
• Provide personalized content

You can manage cookie preferences through your browser settings or our cookie consent tool.

The mobile app does not use advertising identifiers, does not track you across other companies' apps or websites, and contains no advertising SDKs.

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers.

Our platform is not intended for children under 18. We do not knowingly collect information from children.

Tenon10 offers an AI assistant ("Keya") that can provide personalized help based on your account data. This feature is entirely opt-in and requires your explicit consent before any data is accessed.

How It Works

• You must enable AI data access in your Account Settings and accept this policy before Keya can access any of your account data
• You choose exactly which data categories Keya can access (e.g., properties, leases, payments, maintenance requests)
• Keya only accesses your data during your active conversation to answer your questions
• Your data is processed in real-time and is not stored, cached, or retained after the conversation ends

Data Categories

You can independently enable or disable access to each of the following categories:

• Properties & Units: Property names, addresses, unit counts and details
• Leases: Lease dates, rent amounts, and status
• Tenants: Tenant names and lease associations (landlords only)
• Payments: Recent payment history and status
• Maintenance Requests: Request titles, status, and priority
• Documents: Document names and types
• Financial Summary: Occupancy rates and income overview (landlords only)

AI Training

Your account data is never used to train AI models. Data is only used in real-time to generate responses during your conversation and is discarded immediately after.

Third-Party AI Providers

Keya may use third-party AI providers (such as OpenAI, Anthropic, or Google) to generate responses. Your data is sent to these providers only during your active conversation and is subject to their data processing agreements with us, which prohibit use of your data for model training.

Documents and Voice

Separately from Keya, two features use AI providers at the moment you use them, whether or not you have enabled AI data access:

• Document reading: when you upload a lease, a receipt or an identity document, its image is sent to Google's document-reading models to extract the details and, for identity documents, to check them. The extracted details are stored as part of your records; the image is handled as described under Identity Verification and Data Retention.
• Voice input: a voice message to Keya is sent to a speech-to-text provider (Deepgram) and returned as text. The audio is not kept.

Neither is used to train AI models.

Revoking Access

• You can disable AI data access at any time from your Account Settings
• Revoking access takes effect immediately
• All category preferences are reset when you revoke access
• No data is retained after revocation

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date.