Privacy Policy

1. Introduction

Domly, operated by [Company Name] ("Domly," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, website, and related services (the "Service").

This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and other applicable Canadian federal and provincial privacy legislation.

2. Information We Collect

a. Information You Provide

Account data: name, email address, phone number, and password when you register. Billing data: payment method and billing address, processed securely via Stripe (we do not store credit card numbers). Tenant data you upload: tenant names, phone numbers, and property assignments. Knowledge Base content: building rules, bylaws, FAQ entries, and uploaded documents (PDF, Word, text). Support requests: information you provide when contacting our team.

b. Information Collected Automatically

SMS message content: the full text of messages exchanged between tenants and the AI Agent, including metadata (timestamps, phone numbers, delivery status). Tenant-submitted media: photos sent by tenants via SMS for maintenance assessment, stored securely on Cloudflare R2. Device and usage data: browser type, IP address, operating system, pages visited, and feature usage. Server logs: requests to our servers and edge functions, which may include identifiers such as email, phone, or tenant IDs.

c. Information Generated by Our Service

AI-generated responses and conversation summaries. Maintenance triage assessments and priority classifications. Photo analysis results (e.g., identification of water damage, mold, or broken fixtures). Message categorization data (category, priority, confidence scores).

3. How We Use Your Information

We process data for the following purposes: to provide the Service (managing tenant communications, generating AI responses, delivering notifications); to contact tenants on your behalf (sending maintenance updates, responding to inquiries, and providing troubleshooting guidance via SMS — subject to consent); to manage billing and subscriptions (processing payments, tracking usage, enforcing free-tier limits); to improve our Service (troubleshooting, analytics, AI model performance monitoring — we do not use your data to train AI models); to comply with legal obligations (tax, regulatory, CASL compliance, fraud prevention); and for security purposes (detecting abuse, preventing unauthorized access).

4. AI Data Processing

Domly uses Anthropic's Claude AI to power its conversational AI Agent. When a tenant sends an SMS, the message content, relevant Knowledge Base entries, and conversation history are sent to Anthropic's API for processing. Anthropic processes this data solely to generate a response and does not use it to train its models.

Photo analysis: when tenants send images, these are transmitted to Anthropic's Claude Vision API for analysis (identifying maintenance issues such as water damage, mold, broken fixtures, or pest signs). Images are not retained by Anthropic after processing.

We do not sell or license any personal data to AI providers. Data sent to Anthropic is governed by our Data Processing Agreement with them and is subject to their enterprise data handling commitments.

5. Legal Basis for Processing (PIPEDA)

Under PIPEDA, we rely on the following bases for processing personal information: consent — we obtain meaningful consent before collecting, using, or disclosing personal information (for SMS communications, this is obtained through an explicit opt-in process); contractual necessity — processing is necessary to provide the Service you have requested; legitimate interest — we may process data for security, fraud prevention, and service improvement where this does not override your privacy rights; and legal obligation — we process data as required by Canadian law, including tax and anti-spam regulations.

6. Data Sharing & Sub-Processors

We share personal information only with the sub-processors necessary to deliver the Service. Each sub-processor is bound by data processing agreements that require them to protect your data. We do not sell, rent, or share tenant phone numbers or personal data with third parties for their own marketing purposes.

We may also disclose information where required by law, court order, or government request; to protect the rights, safety, or property of Domly, our users, or others; or in connection with a merger, acquisition, or sale of assets (with notice to affected users).

7. Data Retention

Account data is retained for as long as your account is active. Tenant data is retained until you delete it or close your account. SMS messages, conversation logs, and media are retained for up to 24 months, unless you delete them sooner. Billing records are retained as required by Canadian tax law (generally 6 years).

Upon account closure, we retain your data for 30 days to allow for reactivation, after which it is permanently deleted from our active systems. Encrypted backups may persist for up to 90 days before automatic purge.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including: encryption of data in transit (TLS 1.2+) and at rest; role-based access controls and row-level security in our database; secure token storage for authentication; regular security monitoring and logging; and sub-processor security assessments. No system is 100% secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA's breach notification provisions.

9. Your Rights Under PIPEDA

As a Canadian resident, you have the right to: access the personal information we hold about you; correct any inaccurate or incomplete information; withdraw consent for data processing (for SMS messages, reply STOP at any time); request deletion of your personal information, subject to legal retention requirements; and file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by PIPEDA. If you have uploaded third-party data (e.g., tenant information), you are responsible for honouring their privacy rights requests. Domly will assist where possible.

10. Cookies & Analytics

Our website uses strictly necessary cookies to maintain your session and preferences. We may use minimal analytics to understand aggregate usage patterns. We do not use advertising cookies or tracking pixels. You can control cookie settings through your browser preferences.

11. Children's Privacy

Our Service is designed for landlords and property managers and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that data has been provided about a minor without proper authority, we will delete it promptly.

12. International Data Transfers

Some of our sub-processors are located in the United States. When personal information is transferred outside Canada, we ensure comparable protection through contractual safeguards (Data Processing Agreements) with each sub-processor. By using the Service, you acknowledge that some data processing may occur outside Canada, subject to these protections.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notification at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use after updates indicates acceptance.

14. Contact & Privacy Officer

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact our designated Privacy Officer at: BAKA Real Estate, Inc, Canada. Email: [email protected]

You may also file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or, for Quebec residents, the Commission d'accès à l'information du Québec at www.cai.gouv.qc.ca.