Privacy Policy

Latchly holds the records a landlord enters to run their rentals. We do not sell it, share it with advertisers, or use it to train anything. Landlords and their tenants see only their own account. You can take your data out or have it deleted.

When a landlord records information about a tenant, the landlord decides what is collected and why. They are the organisation responsible for it under Canadian privacy law. Latchly holds and processes it on their behalf, only to provide the service.

If you are a tenant and want to know why something about you is held, or want it corrected, ask your landlord first — it is their record. If they cannot help, contact us and we will.

About a person, Latchly asks for three things and no more: a name, an email address, and a phone number. That is the whole of it. There is no field for a driver’s licence, a passport, a date of birth, a social insurance number, a bank account or a credit check, because none of those are needed to run a tenancy in this software.

Documents in Latchly are about the property, not the people in it — quotes, receipts, warranties, manuals. Identification and signed tenancy agreements should not be put here. They belong in the landlord’s own files, and Latchly will never ask for them.

Beyond those three details, Latchly holds the records a landlord enters to run the property:

• Sign-in — a one-way hash of your password. We never hold a readable password, so nobody at Latchly can see or recover it.
• Property records — addresses, rooms, rents, tenancy dates, payments, expenses and bills.
• Files a landlord chooses to upload — quotes, receipts, warranties and manuals for the property and its equipment, and photographs of damage or condition.
• Activity — a log of actions taken in the account and emails the system sent, so both sides can see what happened and when.
• Billing — handled by Stripe. Card numbers never reach Latchly’s systems.

We list this plainly rather than claiming to hold less than we do. A privacy policy that understates what is stored is worse than none: it is the thing regulators look at first, and it is the promise you would be judged against.

Records are stored in a managed PostgreSQL database and uploaded files in Cloudflare R2 object storage, both encrypted at rest. The application runs on Vercel. Email is sent through Resend, and subscriptions are handled by Stripe.

Some of these providers store or process data in the United States, which means it may be subject to the laws of that country, including lawful access requests. If that is not acceptable for your records, Latchly is not the right tool for you.

• Landlords on an account see everything in that account.
• A tenant sees only their own tenancy — their rent, receipts, documents, requests and charges. Never another tenant, never your costs, never your private notes.
• No other account can see yours. Every record carries the account that owns it, and a request for someone else’s record returns “not found”.
• Latchly staff access data only when you ask for support, or where necessary to keep the service running.

For as long as your account is open. When an account is closed we delete its records within ninety days, except where we must keep something longer to meet a legal obligation. Tell us if you need it sooner.

You can ask for a copy of everything in your account, or for it to be deleted, by emailing hello@latchly.ca. We will respond within thirty days. Deletion is permanent and cannot be undone.

If a breach occurs that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and the people affected, as the law requires, and we will tell you what we actually know.

No system is perfectly secure. What we do to protect yours is set out on the security page, in plain terms rather than reassurance.

Latchly sets one cookie, to keep you signed in. There is no advertising, no tracking across other sites, and no third-party analytics script on pages showing your data.

If you are unhappy with how your information has been handled, contact us first. You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.