Privacy Policy

Propstack is operated by 15068045 Canada Inc., doing business as Propstack, 6225 Place Northcrest, 414, Montréal, Québec H3S 2T5, Canada. We are responsible for the personal information collected through propstack.ca, the app and our agent API.

Person in charge of the protection of personal information: Sean Morrier, sean@propstack.ca.

This policy describes our practices under Québec’s Act respecting the protection of personal information in the private sector (Law 25) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Account

• Name, email, language and, if you sign in with Google, your Google account id.
• Your password is handled by WorkOS; we never see or store it.
• Your investor profile (your onboarding answer) and your preferences (deal score settings, shortcuts).
• Your cookie choice, saved on your account when you are signed in.

Your deals

• The data you enter: address, price, financing, units and rents, expenses, notes, action items, scenarios, comparisons and, for buildings you own, their actual results.
• Files you attach (PDFs, images) and the Street View photo of the property we fetch from its address.

Imports

• The listing link, the page’s content, the text of an imported PDF (when PDF records are turned on, never the file itself), the extracted data and, for 14 days, the values you then save for that deal.
• A log of your imports (time, type) to apply usage limits.

Try mode (no account)

• The deal you analyze stays in your browser until you save it to an account.
• A signed cookie counts your free imports. To limit abuse, we keep a keyed hash of your IP address for 2 days, never the address itself.

Payment

• Your card is entered on Stripe’s page and held by Stripe only. We receive the Stripe customer id, plan, subscription status and billing dates.

Usage and technical data

• The features you use in your account (for example import, export, sharing), with the date.
• Error reports (page, browser, technical details) and server logs, which include IP addresses.
• With your consent: audience measurement (pages viewed, actions) and masked session replay.

Advertising (with your consent)

• The campaign that brought you (UTM parameters, click id), saved on your account when you sign up.
• Events sent to Meta to measure our ads (sign-up, trial start, subscription), with your email and user id in hashed form. Google Ads receives only the pages you view and its ad-click and cookie identifiers, not your email.

Referrals, messages and API

• The partner referral link you used when signing up.
• Your messages: support emails, bug reports and feature requests (with the page you were on and recent errors).
• For the API and MCP: the apps you authorize, the permissions granted and access tokens (stored hashed).

We do not knowingly collect sensitive information. Do not put more information about other people (tenants, for example) in your notes or files than you need.

• Create and secure your account, sign you in and verify your email.
• Provide the Service: calculations, imports, files, sharing, export and API access.
• Manage your subscription, trial, partner offers and billing.
• Apply usage limits and prevent fraud and abuse.
• Find and fix errors, and make imports more accurate.
• Understand how the Service is used so we can improve it (with your consent for analytics tools).
• Measure how well our ads work (with your consent).
• Answer your messages and send you service notices (security, billing, changes to the terms).
• Meet our legal obligations.

We collect your information with your consent, only for the purposes above, or where the law allows or requires it. By creating an account, you consent to the uses the Service needs.

Analytics and advertising tools are off by default and only turn on if you accept them in the cookie banner. You can withdraw your consent at any time (see “Cookies and tracking”), except for uses the Service needs or the law requires.

We make no decision about you based solely on automated processing. AI is used only to extract data from the listings and documents you import.

We do not sell your personal information. We share it only with the providers that help us run the Service, as far as their task requires. They are bound by contract to protect your information and use it only to provide their services to us.

We may also disclose information where the law requires it (a court order, for example), to protect our rights or someone’s safety, or to the buyer of the business in a sale or merger, who must honour this policy.

What you choose to share

• A share link lets anyone who has it see the deal, including its address, inputs, analysis and property notes. They can try changes on the shared page without affecting your deal, and a signed-in visitor can save a copy to their own account. Copies already saved stay with them after you revoke the link.
• An AI assistant you connect (such as Claude or ChatGPT) receives the information it reads at your request. It is governed by its own privacy policy.

Most of our providers process information outside Québec and Canada, mainly in the United States. Before sharing information outside Québec, we assess whether it will be adequately protected there and put the transfer under contract. Information processed abroad may be accessible to that country’s authorities under its laws.

We group cookies and browser storage into three categories:

• Necessary: always on. Sign-in, security, language, try-mode limits, Stripe payments and error monitoring (Sentry).
• Analytics: only with your consent. PostHog, Google Analytics and Sentry session replay (all text masked and media blocked).
• Advertising: only with your consent. Meta Pixel and Conversions API, Google Ads.

Your choice is stored in the ps_consent cookie for 13 months and, when you are signed in, on your account. To change it, click “Cookie preferences” at the bottom of our pages or in your account Settings. If we change these categories, we will ask you again.

• Account and deals: as long as your account is active. A deal you delete is erased from our database right away, with its notes, scenarios, files and import records. A file you delete is also erased from our storage right away.
• Import records: kept as long as your account exists, then deleted with it. The records of a deal you delete are deleted with the deal.
• Import limit counters (including the hashed IP address in try mode): 2 days.
• Feature usage history: as long as your account exists.
• Billing: billing records are kept for at least 6 years, as tax laws require.
• Analytics, errors and logs: for the retention period set with each provider.
• Cookies: see the table above.

When you delete your account in Settings, it is deleted right away: your deals, files, notes, scenarios, comparisons, share links, connected apps and import records are erased, your subscription is cancelled, your customer record is deleted at Stripe (which keeps invoices for tax purposes), your sign-in is removed from WorkOS your marketing contact is deleted from Loops, and your name and email are removed from our analytics tools. Copies of a shared deal that other users saved stay with them. If you ask us by email, or if we close your account, we do the same within 30 days. Backup copies are erased on their normal cycle.

We take reasonable measures to protect your information, including:

• encrypted connections (HTTPS) and an encrypted session cookie;
• passwords handled by WorkOS, never stored by us; email verification;
• share-link and API tokens stored hashed; try-mode IP addresses hashed;
• access to production data limited to the people who need it.

No system is perfectly secure. If a confidentiality incident creates a risk of serious injury, we will notify the Commission d’accès à l’information, the Office of the Privacy Commissioner of Canada and the people affected, as the law requires, and keep a register of incidents.

We send you the emails the Service needs (verification, password reset, billing, important notices). These are sent through our email provider Loops and do not depend on any marketing choice.

We send promotional or educational emails (tips, product news, offers) only with your express consent. The box on the sign-up form is unchecked by default, and you can change your choice at any time in Settings. We keep the date and source of your consent (sign-up or Settings) and the date you withdraw it. Each email has a link to unsubscribe at any time, as Canada’s Anti-Spam Legislation (CASL) requires; unsubscribing there also updates your choice in Settings. If you consent, your email address, first name, plan, investor type, language, how you found us and a few product events (for example creating a deal) are shared with Loops for marketing. Loops stores them in the United States. For people who have not consented we share with Loops only the address needed to deliver the service emails above, without adding it to a marketing list, and we delete your Loops contact when you withdraw your consent or delete your account.

The Service is not meant for people under 18 and we do not knowingly collect their information. If you believe a minor has given us information, write to us and we will delete it.

At any time, you can:

• access your information and learn how it is used and who it is shared with;
• have it corrected if it is inaccurate, incomplete or ambiguous;
• ask for it to be deleted or your account closed;
• withdraw your consent, including to analytics and advertising cookies;
• get a copy of the information you gave us in a structured, commonly used technological format (portability), and ask for it to be sent to a third party;
• ask us to stop disseminating information or to de-index a link, where the law allows.

You can correct most of your data directly in the app and delete your account yourself in Settings (Danger zone → Delete my account). With Pro, you can also export your analyses to Excel. On any plan, we will send you a copy of your information in a structured, commonly used format, free of charge, on request. For any request, write to sean@propstack.ca.

We may ask you to confirm your identity. We reply in writing within 30 days. Access is free; reasonable fees may apply only to transcribing, copying or sending information, and we will tell you first.

Our internal rules on personal information include:

• Roles: the person in charge of the protection of personal information (Sean Morrier) approves these rules, keeps the register of incidents and answers requests and complaints. Only people who need information for their work can access it.
• New projects and providers: before adopting a new system or sharing information outside Québec, we assess the privacy factors.
• Retention and destruction: we keep information only as long as needed (see “How long we keep it”), then destroy or anonymize it.
• Requests and complaints: handled in writing within 30 days (see “Your rights” and “Complaints”).

Please write first to our person in charge of the protection of personal information, Sean Morrier, at sean@propstack.ca. We will look into your complaint and reply.

If you are not satisfied, you can contact:

• the Commission d’accès à l’information du Québec: cai.gouv.qc.ca;
• the Office of the Privacy Commissioner of Canada: priv.gc.ca.

We will update this policy when our practices or the law change. The last-updated date is at the top of the page. For a significant change, we will tell you by email or in the app before it applies and, if it affects a use based on your consent, we will ask you again. See also our Terms of Service.