Privacy Policy

Last updated October 27, 2026 (version 2026-10-27.3)

James Street Chateau is provided on Gopher Boss, which is operated by Gopher Boss ("we", "us"). This policy explains what personal information we handle, why, who we share it with, where it's stored, how long it's kept, and the choices you have. It is one policy for every business that uses Gopher Boss, whatever its type (for example a landlord business, a fire inspection company or another trade), and for the people a business invites or keeps records about: its team, tenants, rental applicants, property owners, contractors, customers and lenders. Sections marked for one type of business apply only to that type.

Gopher Boss is in beta. We wrote this policy in plain language to match what the software does today; it hasn't been reviewed by a lawyer. It's written with Canada's federal privacy law (PIPEDA), Canada's anti-spam law (CASL) and, for Quebec, Quebec's Act respecting the protection of personal information in the private sector in mind.

Who is responsible

Each business controls its own records. A business decides whose information goes into its account (its tenants, applicants, owners, contractors, customers or lenders) and uses it to run the business. For that information, the business is responsible to those people, and we handle it on the business's behalf and on its instructions.

We are responsible for the information people give us directly to use the service (their sign-in details, and the choices and consents they make in their own settings), for how we run and secure the service, and for the service providers we use. Our privacy contact is the Gopher Boss privacy officer. To reach them, use our Contact page (choose "Privacy or my data"), or write to Gopher Boss, 11-100 Bronte Rd, Oakville, Ontario, L6L 3B3.

What we collect

From everyone who signs in

• Account details: name, email, role and language, an optional phone number, and the business name. Your password is stored only as a one-way hash. If you turn on two-step sign-in, an encrypted authenticator secret. When you change your email, we email a confirmation link to the new address and a heads-up to the old one; we keep only the confirmed address.
• Agreement records: which version of the Terms of Service and this policy you agreed to, and when.
• Technical records: sign-in times, the network (IP) address of sign-up and sign-in attempts, failed sign-in attempts and error reports, used to keep the service secure and working. Sign-in sessions end after at most 30 days and are then deleted; records of failed sign-in attempts and sign-up counters are deleted after a day.
• Feature suggestions: what you suggest, an optional screenshot, and your votes. Only our admin sees your own words, your name and the screenshot; everyone else sees only our short public description of an accepted suggestion. We delete the screenshot once your suggestion is decided (or after 12 months), and declined or combined suggestions 24 months after the decision (undecided ones after 24 months); for accepted ones, your own words are cleared after 24 months. We email you when its status changes.
• Messages to us through the Contact page.

Landlord businesses

• Business details: for a landlord who charges HST on commercial rent, the business's HST number. Landlords can add an optional business mailing address. It's used only as the sender's address at the bottom of wait-list emails sent for them, next to our own (Canada's anti-spam law asks for one), and only if we've turned this on. Landlords can remove it any time in Settings; emails already sent keep it. It's deleted with the account (and from our backups as described below).
• Referral invitations: when a landlord invites someone by email, we use that address only to send the one invitation. A copy of the email is kept in the email log for 12 months. To make sure no address is invited twice, or after it unsubscribes, we keep a one-way fingerprint of it (not the address itself). Who referred whom, and any credit earned, is kept for 5 years for billing records, then deleted. A landlord who referred you sees your business name and whether you've subscribed, nothing else.
• Tenancy records: units, rent, charges and payments (with any HST), receipts, a record of any payment deleted from the rent ledger (who deleted it, when, the amount and receipt number, shown to the landlord and the tenant), leases, notices, inspection reports, entry notices and messages, and whether, when and how a tenant agreed to get notices by email.
• Rental applications: what an applicant chooses to send, such as current address, income, employer, occupants, pets and references. We email applicants a confirmation (with a private link to see where their application stands) and the landlord's decision.
• Repairs: descriptions, photos, entry permission, visit times, contractor responses, ratings and invoices.
• Compliance records: the checklist a landlord keeps for each property, when each item was done, notes, and any certificate, report or invoice they upload as proof. Kept, like tenant records, for the retention period (7 years by default), then deleted.
• Tenant insurance: where a landlord uses it, the proof of insurance a tenant or their landlord uploads (a photo or PDF of the insurance certificate or the policy's summary page), the insurance company if given, the day it expires, and who uploaded it and when. Only the tenant (signed in or through their personal link) and their landlord's account can see it, and it's included in the landlord's Download all my data. We use it to show whether it's current and to send reminders before it expires. Only the newest is kept: a new upload replaces the old one. It's deleted a year after it expired, sooner if removed, or with the tenancy's records or a closed account.
• Bank statements: when a landlord uploads a bank statement to match it to rent and expenses, we keep only each line's date, description and amount (not the account-number or balance columns; long numbers in descriptions are hidden). Descriptions can include the names of people who sent or received money, and an e-Transfer's message. We keep these lines in a preview until the landlord confirms, uploads another, or 7 days pass, whichever is first (and in our backups as described below). Previews of other uploaded spreadsheets are deleted the same way. Only the lines the landlord confirms are saved, as rent payments or expenses, and kept like the rest of the tenant's or landlord's records. So that the same bank line is never recorded twice, we also keep each confirmed statement line's date and amount (no description) for 24 months after its date.
• Live bank feeds (a beta feature, only for a landlord who connects a bank account): one bank sign-in can fill several of the landlord's bank accounts here, and the landlord picks which account from the bank fills which. The posted lines of each account picked, with only each line's date, description and amount (long numbers in descriptions are hidden), wait in the account until the landlord checks them, or until 24 months after the line's date, when they are deleted; disconnecting doesn't delete lines already brought in, and closing the account does. Once a line is saved or marked not needed, its description is deleted and its date and amount are kept for 24 months after the line's date; lines the landlord confirms are saved as rent payments or expenses, like a statement's.
• Neighbourhood feed: to show tenants local news from their city's website, we use only the city name. Nothing about the tenant is sent anywhere; a tenant can turn the feed off in My details. Feed items (headlines and links from the city's own website, nothing about you) are deleted after 30 days; an item a site administrator hid is kept 365 days so it isn't shown again.
• Listing photos: photos a landlord adds to a unit are shown on its public listing while it's published, and kept until the landlord deletes them or the unit.
• Signing and service records: when you sign a document electronically, we record your typed name, the time, your internet (IP) address, your browser type and a fingerprint of the document, so the signature can be proven later. When a notice is emailed, we keep a copy of the email and its result.

We don't run credit checks or store credit reports. If a landlord asks an applicant for a tenant screening, the applicant completes it directly with the screening company, which has its own privacy policy, and shares the report with the landlord. We keep only the screening's status, the SingleKey score when the landlord used SingleKey, and the landlord's own short summary (a credit range, the overall result and any notes) with the application, and delete them with the application. When a landlord pays for a screening, they pay on SingleKey's own page; card details never reach us.

Trade businesses

• About your business's customers, as your business enters them: names, email addresses, phone numbers, street addresses, language, notes, invoices, payments and statements; for fire inspection, their buildings, equipment and visits; for loans, the lender's name and email.
• Copies of the emails sent through the app (businesses don't send texts yet), with their delivery status. Personal links in the stored copies are hidden.
• If your business turns on e-Transfer matching, the Interac e-Transfer notification emails you forward to our mailbox and the e-Transfer email addresses you confirm. We keep, from each notice, the sender's name, their message, the amount, the Interac reference and the day; the email itself is read and not stored by the app.
• Bank statement and import files are read to bring in their lines and aren't stored; the lines brought in are, and so are the lines a live bank feed brings in (see Plaid below).

What we don't collect

We don't ask for Social Insurance Numbers, bank account or card numbers, or government ID, and we ask businesses not to enter them.

Why we use it

Only to provide and improve the service the business signed up for: its records (rent, invoices, payments, expenses and books), receipts, documents and signatures, repairs and visits, statements and tax summaries, the emails and texts it asks the app to send, billing for its plan, answering support requests, keeping accounts secure and stopping abuse, finding and fixing errors, and meeting our legal obligations. We don't sell personal information, rent it out, or use it for advertising, we don't send our own marketing to a business's tenants or customers, and we don't use your records to train artificial intelligence models.

Consent

• A business may add someone's information (a tenant, applicant, owner, contractor, customer or lender) only with their consent or another lawful basis, and it is responsible for that.
• Everyone who signs up or accepts an invitation agrees to the Terms of Service and this policy, and we keep which version and when.
• Landlord businesses: a contractor decides for themselves whether to work with a landlord: a landlord who adds a contractor can only invite them, and they accept or decline. The accept step names exactly what that landlord will see, and that the tenants and owners on those jobs are told the contractor's name or business name (owners also see the invoice amount); declining shares nothing more. A property owner is invited the same way, and the accept step names exactly what that landlord will see (their name, email, phone and whether they get texts from us) and that they'll see that landlord's statements for their properties. Either can stop at any time (for the landlord who set up their login, by closing it in My details), and can ask a landlord not to invite them again (a link in every invitation).
• Applicants agree on the application form to their information being shared with the landlord they apply to.
• Tenants receive notices by email only if they agree in writing, as the Landlord and Tenant Board's rules require. They can withdraw that agreement at any time in the app or by telling their landlord in writing.
• You can withdraw other consents at any time, subject to legal or contractual limits, such as records a business must keep.

Who can see it

Each business's records are kept separate from every other business's. Inside a business, each team member sees only what their role allows. People a business invites see only what concerns them: tenants their own tenancy, property owners their own properties, contractors the jobs offered or assigned to them. A trade business's customers and lenders don't sign in: they open what the business sends them through a private link.

Landlord businesses: a contractor can use one login to work for several landlords (or for a landlord and their own business). Each landlord sees only their own jobs and, once the contractor accepts that landlord's invitation, the contractor's name, email, phone, business name, HST number and whether they get texts from us, never their work for anyone else. Until they accept, that landlord sees only what it typed when adding them, and nothing from an existing login. A property owner can likewise use one login with several landlords, and sees each landlord's statements separately, and only while they work with that landlord. When a landlord adds a contractor or an owner, the app gives the same answer, and shows the same until they accept, whether or not their email already has a login (adding a tenant, one at a time or from an import file, can still show that an address is already in use; one at a time, a landlord can try only a limited number of new addresses an hour). When a landlord changes someone's email, the new address gets a message asking to confirm it, and the landlord gets the same answer whether or not that address already has a login; the email changes only once it's confirmed from the new address. The current address is told at once, with a link to cancel the change; if they cancel, the landlord sees that they did. When a contractor or an owner stops working with a landlord, that landlord keeps its records of their jobs or properties and the name and email they had then, and no longer sees their other details. No landlord can change the name, email, phone or password of a contractor's login once it works for, or has been invited by, another landlord. The landlord who set up a contractor's login can still remove its access, and that stops the login for every landlord they work for.

Our staff access account information only when needed to provide support, fix a problem or keep the service secure. To fix a problem, support staff may view the service as you see it and correct information in your account; every such session and change is logged, and staff never sign documents or give consent on your behalf.

Service providers, and storage outside Canada

We use a small number of providers to run the service. Each gets only what it needs and must protect it under its contract with us:

• Hostinger hosts the website, database, files and our backups, on servers in the United States.
• Our email provider (currently Hostinger's email service; the app can use Hostinger's mail server or Resend, in the United States) delivers receipts, notices, invoices and account emails. It receives each email's address, subject and contents. When a trade business turns on e-Transfer matching, the same Hostinger mailbox receives the Interac notifications the business forwards to it.
• Twilio (United States) sends text messages, used today by landlord businesses only (trade businesses don't send texts yet), and only to people who said yes to texts (and, where we ask, confirmed their number by replying YES). It receives the phone number, the messages we send, and any replies (including photos) people text back to us. Replying STOP always stops them. If you set quiet hours, a text that would arrive during them is kept until they end (at most a day), then sent; the record that it was held is deleted after 30 days.
• Google (Places, United States) suggests addresses as someone types an address (a rental property's, or a trade business's customer or building), when it's turned on. It receives the partial address typed, from our server rather than your browser, never your name or anyone else's details.
• Plaid (United States) provides live bank feeds, only for a business that connects a bank account (a beta feature). The business signs in to its bank in Plaid's own window, so its bank password goes to Plaid, never to us. Plaid sends us the transactions of the bank accounts the business chooses to share there. One bank sign-in can fill several of the business's bank accounts here: the business picks which shared account fills which. We keep only the posted lines of the accounts it picks, as described above; for each of those accounts, its name as the bank gives it with its last digits (to show which fills which) and match keys made from the bank, those digits and the kind of account, and from Plaid's lasting reference for the account where Plaid gives one (so the same real account can't fill two of the business's accounts); plus the bank's name and an encrypted key to the connection. We keep nothing from a shared account the business doesn't pick; it stays shared with Plaid under that bank sign-in until the business disconnects. We send Plaid our keys and our reference number for the account (never your name or email). Descriptions can include the names of people who sent or received money, such as tenants paying rent or customers paying an invoice by e-Transfer. Disconnecting ends Plaid's access and deletes the key and the accounts it filled (their names, last digits and match keys); closing the account deletes them too and asks Plaid to end its access. Plaid handles the bank sign-in, and what it receives from the bank, under its own End User Privacy Policy, shown in its window. Not offered yet to a business based in Quebec or a landlord with a rental in Quebec.
• GitHub (United States) holds our code and receives error reports so we can fix problems. Email addresses, phone numbers, long numbers, quoted values and record ids are removed from these reports first.
• Stripe (we contract with its Canadian company; information is processed in the United States and elsewhere) processes landlord businesses' subscription payments. It receives the landlord's email and business name. Card details go directly to Stripe on its own secure page; we never see or store them. Trade businesses aren't charged during the beta, so nothing about them goes to Stripe.
• SingleKey (a Canadian company) runs tenant screening, only when a landlord orders it for an applicant. It receives the applicant's and landlord's names and emails, the landlord's phone number if they gave one, the rental address and unit, the rent, and our reference numbers for the account, application and listing; the applicant gives consent and enters everything else on SingleKey's own page. The report stays with SingleKey; we keep only its status, the score and the landlord's short summary.
• Anthropic (Claude AI) receives personal information only for landlord businesses that turn on the AI assistant. For each new repair request it receives the request's title and description, the city and province, the month, the urgency and type of repair chosen when it was reported and how many photos there are (not the photos), to suggest the urgency and type of repair, a safety tip and a question for the tenant. Before it's sent, the contact details the app recognises (email addresses, phone numbers, street addresses and postal codes, as they're usually written) and the names the app knows (the tenants on the lease, whoever reported it, the contractor, and the people and businesses on the landlord's account or invited to it) are taken out; other words are sent as written, so a name the app doesn't know can still be sent. When a landlord asks it to fix problem rows in a spreadsheet they uploaded, it receives those rows and the column headings. The cells of name, email and phone columns, and the email addresses, phone numbers and street addresses the app recognises in other cells, are replaced by placeholders first; other words are sent as written, so a name in another column (such as a business name, a description or a note) can still be sent. For one-click listings it receives only the unit's facts (type, size, rent, what's included, features, what's nearby), never anything about tenants. Anthropic processes it in the United States and doesn't use it to train its models. Messages written by the assistant are signed “AI assistant”. For a Quebec rental, when it sets a repair's urgency or type by itself, the tenant is told, and can ask their landlord what it was based on, have it corrected, and have a person review it. Separately, Claude searches official government websites for us: for law and code changes that affect landlords, and for the tenants' neighbourhood feed. For those searches it receives only a province or city name, dates, and the headlines already found on those sites, with nothing about any person.

Our typeface is served from our own site, so loading a page sends nothing to a font service. Links to other websites (for example listing sites, a calendar, the CRA or a tribunal's forms) only open those sites; we don't send them your information.

Where it's stored

Gopher Boss's servers are in the United States. Your information, and the information a business keeps about its tenants, customers and others, is stored and processed there, and some of the providers above also store or process it outside Canada, including in the United States and Europe. While it is there, it is subject to those countries' laws, and courts, law enforcement or national security authorities there may be able to access it. If where we store it changes, this policy will say so first. You can ask for written information about our policies on using service providers outside Canada, or ask questions about them, by contacting the Gopher Boss privacy officer: use our Contact page (choose "Privacy or my data"), or write to Gopher Boss, 11-100 Bronte Rd, Oakville, Ontario, L6L 3B3.

Quebec: a privacy impact assessment of storing this information outside Quebec (section 17 of Quebec's Act respecting the protection of personal information in the private sector) is in progress.

Payments between a business and its tenants or customers

Tenants pay their landlord, and customers pay the business, directly, for example by Interac e-Transfer to the business's own email. We never receive, hold or move that money; the service records the payment the business tells it about, or matches it from a notice or bank line the business brings in, and issues the receipt or updates the invoice.

Cookies

We use only the cookies the service needs: one to keep you signed in (for up to 30 days), one for a few minutes while you finish two-step sign-in, one to remember your language (for a year), one to remember the referral code you arrived with so the referral can be credited (for up to 30 days), and, while you use them, short-lived ones for a private link you just created and for our support staff's “view as”. We don't use advertising or tracking cookies, and we don't use third-party analytics. So you don't have to type it again after a mistake, your browser tab briefly keeps what you typed into a few forms (sign-up, a rental application, adding a person, a repair request), never passwords, codes, ID or bank numbers; it stays in that tab only, and is cleared when the form goes through, when you leave the page or close the tab, and after 15 minutes.

How long we keep it

Each kind of information has one rule, applied automatically every night.

For every business

• Error reports are deleted after 12 months (short summaries without personal details may remain in our issue tracker), and our admin activity log after 24 months. Our record of a privacy request (who asked, what they asked, and when we answered) is deleted 24 months after we answer.
• Invitation, confirmation and password-reset links are deleted 30 days after they expire, whether or not they were used.
• Answered Contact-page messages are deleted after 24 months.
• Backups: a full copy of the database is made every night (the newest 7 are kept), before each update (the newest 5) and when an administrator asks for one (the newest 5), and none of our own backups is kept longer than 90 days. Our backups are kept on the same hosting service as the website, in the United States. Once a month an administrator also downloads the newest one, keeps it on an encrypted external drive (not a cloud service) kept in Canada, away from the server, and deletes copies older than 90 days. So information deleted from the app is gone from our own backups within 90 days. Our hosting provider also makes its own backups of the server; they are outside this 90-day limit and follow the provider's own schedule. If we ever have to restore a backup, we first re-apply our record of deletions (account and business closures, closed logins, access a business removed, contractors who stopped working with a landlord, customers who stopped invoice reminders, and wait-list and invitation opt-outs) before the site is used again.

Landlord businesses

• Landlord records (properties, tenancies, rent ledgers, leases, notices, repairs and the like) are kept while the account is open, so the landlord has them for tax and for any tenancy dispute, except where a shorter period is listed below.
• When a tenancy ends, the tenant's personal records (contact details, messages, notices, lease, inspections, photos and the record of deleted payments) are kept for 7 years, then deleted. The landlord is told 30 days before. Rent amounts are kept without the tenant's name, so the landlord's tax records still add up.
• A landlord can close their account at any time from Settings, after downloading all their records. Everyone on the account is signed out at once, each tenant is told by email (with the rent recorded for this year and last year), and 30 days later we delete the account's records, except the billing records tax law requires us to keep (our record of the account and its charges, and the customer record our payment processor, Stripe, keeps), which we delete about 7 years later. A tenant, owner or contractor can close their own login from My details, and can later sign up again with the same email address. The landlord's records about them stay with the landlord, including the email address they had (so the landlord can still contact them directly); the landlord decides how long to keep them, so ask the landlord about access to or deletion of those records.
• Rental applications that don't lead to a tenancy are deleted automatically 12 months after the landlord's decision (or after they came in, if there was none), unless the landlord keeps one (including one that led to a tenancy) for a complaint, hearing or legal claim, with the reason, until it's over; we ask them yearly whether it's still needed. Closing the account deletes it. Landlords can also delete them sooner. Viewing bookings (name, email and phone) and wait-list sign-ups for a listing or a building (name, email, and what they're looking for if they said) are deleted on the same schedule; anyone can leave a wait list sooner with the link in its emails, which deletes their details at once. Joining a wait list is confirmed by email first: we email a link to confirm, nobody gets a listing email until they confirm, and a sign-up not confirmed within 7 days is deleted. The network (IP) address a viewing booking or wait-list sign-up came from, used only to limit repeated attempts, is deleted after a day, at the next nightly clean-up.
• A text held for someone's quiet hours is kept only until it's sent, and at most a day (after that it isn't sent); its wording is then deleted, and the record that it was held is deleted after 30 days.
• Bank lines from a statement or a live bank feed: their date and amount (and, for a feed line not yet checked, its description) are deleted 24 months after the line's date, or with the account.
• When a contractor or an owner stops working with a landlord (or an invitation is declined or never accepted), the link between them is deleted 12 months later, and so is a login a landlord set up for a contractor or an owner who never accepted. The landlord's records of the jobs the contractor did for them stay with the landlord. A decline stops that landlord emailing another invitation for 30 days. If the contractor asked a landlord not to invite them again, we keep that request, and that landlord's entry for them, for as long as the contractor's login or that landlord's account exists, so it's honoured. A login a landlord set up that was never accepted is then kept only to honour the request.
• The list of what the app did for a landlord on its own (for example, an e-Transfer it recorded for a tenant, or a rent reminder it emailed) is kept for 12 months, then deleted, or sooner with the tenant's records or the account. For an e-Transfer it recorded, it also keeps the sender's name and message and when it arrived, so the landlord can undo it if it went to the wrong tenant.
• An e-Transfer waiting for the landlord to record or dismiss it (the sender's name, their message, the amount, the Interac reference and when it arrived) is deleted 12 months after the landlord records or dismisses it, or 24 months after it arrived if they never do; a payment they recorded stays on the tenant's ledger. The AI assistant's suggestions and the record of what it did (a short summary, which can quote a repair request) are deleted after 12 months.

Trade businesses

• Accounting records (invoices, payments, expenses, vendors, bills, loans, bank lines, imported from a file or brought in by a bank feed, and the journal): kept for at least 7 years by design (the CRA requires 6); no rule deletes them automatically while the account exists. They're deleted only when the owner closes the account.
• Customers your business deletes: removed for good after 30 days, with their messages, unless an invoice names them.
• Customers of a business whose logins have all been turned off for 12 months: deleted, with their messages, unless an invoice names them.
• Emails and texts tied to a customer: 24 months. Emails and texts to people who aren't users and aren't tied to a record: 12 months.
• Invitation, confirmation and reset links: 30 days after they expire. People who never chose a password (invited, or signed up and never confirmed): deleted 30 days after their last link expired. Beta invitations: 12 months.
• Interac e-Transfer notices: 18 months after they were recorded or dismissed, 24 months if never handled (the payment a notice made is an accounting record). Forwarded emails in our mailbox: 30 days once handled, 90 days if they couldn't be used. Gmail forwarding codes: 7 days.
• Fire inspection records, recurring invoice schedules, reminder records and the business's activity log: kept while the business exists, and deleted with their customer or when the account is closed.
• Closing the account: the owner is first offered every record to download and warned that nothing can be recovered; then everything the business has in the app is deleted at once. Copies in backups are deleted within 90 days, as described under Backups. A team member who closes their own login can no longer sign in; the business keeps its records, with their name and former email on what they did, until the business is closed. The only owner closes the business instead.

How we protect it

Encrypted connections (HTTPS), passwords stored only as one-way hashes, limits on repeated sign-in attempts, optional two-step sign-in with an authenticator app, access checks on every page (each business sees only its own records, and each person only what their role needs), encryption of stored service keys and two-step secrets, nightly backups, a record of administrator actions, and a fingerprint on every signed document so changes can be detected. No system is perfectly secure. If a breach of our safeguards affects information we're responsible for (such as your own account) and creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires. If it affects records a business keeps, we tell that business promptly and give it what it needs to notify the people affected. We keep a record of every breach.

Your books and the CRA (trade businesses)

The CRA requires business records to be kept in Canada unless it authorizes another place in writing. Records kept outside Canada and reached electronically from Canada aren't considered kept in Canada. The CRA may accept a complete copy kept in Canada, and it recommends keeping backups in Canada. During the beta our servers are in the United States, so download your books from Money → Download for your accountant each month and save a complete copy on your own computer or storage in Canada. We can't promise the CRA will accept it in your case: ask your accountant. The app reminds owners each month.

Keeping your books is your business's responsibility: the CRA asks for 6 years from the end of the tax year they relate to.

CRA, IC05-1 Electronic Record Keeping

Emails and texts

We send the emails needed to run an account: receipts, notices, invoices, signing requests, repair updates, billing and security messages. For landlord businesses, reminders (rent, insurance expiry and compliance due dates) and news (law and code updates, landlords' Monday summary of what the app did for them, suggestion news and referral rewards) are optional: turn them off in My details or with the link at the bottom of each one. We don't send marketing email without your consent, and every marketing email will have an unsubscribe link.

Trade businesses: Invoices, statements, payment reminders and other emails sent through the app go to your customers on your business's behalf. Under Canada's anti-spam law (CASL), your business is responsible for having consent where a message needs it. Payment reminders are off until the owner turns them on, can be turned off for any customer or invoice, and each reminder has a link the customer can use to stop them.

Your rights

You can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, withdraw your consent, or complain about how it is handled. To do so, use our Contact page (choose "Privacy or my data"), or write to Gopher Boss, 11-100 Bronte Rd, Oakville, Ontario, L6L 3B3. We'll confirm it's you, then answer within 30 days of receiving it. For records a business keeps about you, contact that business first: it decides what it records about you. If you ask us, we'll pass your request to that business and help it answer.

Much of this is self-serve. Everyone who signs in can correct their name, phone and email (a new email is confirmed by a link) and change their password, two-step sign-in and language. Landlords can download all their records at any time from Settings; a contractor with their own login sees and corrects their own name, email, phone and business details in My details. In a trade business, under My data, each person downloads their own details and what their role lets them see, and can close their own login; owners can download all of the business's records at any time.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Children

The service is for adults. Landlords may record the names of children who live in a unit when a lease requires it, but children don't use the service.

Changes

We'll post changes on this page, with a new version number. If a change is significant, we'll email account holders before it takes effect. See also our Terms of Service.

While Gopher Boss is in beta, we may change this Privacy Policy and the Terms of Service at any time, and changes take effect when posted, except changes to your plan or its price, which keep the notice described above. We'll ask for your consent before using your personal information for a new purpose. Once Gopher Boss is out of beta, the notice described above applies.