Propilot — Privacy Policy

Effective Date: March 8, 2026 | Last Updated: March 8, 2026

1576533 B.C. LTD., doing business as Propilot (“Propilot”, “we”, “us”, “our”), is committed to protecting the privacy and security of personal information under our care. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with the Propilot platform and services (the “Service”).

This Policy applies to:

• Landlords — registered users of the Service who manage rental properties
• Applicants and Tenants — individuals whose personal information is submitted to or collected through the Service by Landlords

Propilot operates in British Columbia, Canada. This Policy is designed to satisfy the requirements of both the Personal Information Protection Act (BC PIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA). Where these statutes differ, we apply the stricter standard.

By using the Service (as a Landlord) or submitting your information through the Service (as an Applicant), you acknowledge and consent to the practices described in this Policy.

1. Scope and Our Role

1.1. Controller and Processor Roles

Propilot operates in two distinct roles depending on the type of data:

• As Controller: Propilot determines the purposes and means of processing Landlord account data and platform analytics data. Propilot is directly responsible for compliance with PIPEDA and BC PIPA for this data.

• As Processor: Propilot processes Applicant and Tenant personal information at the direction and on behalf of the Landlord. The Landlord is responsible for obtaining all required consents and ensuring lawful collection. Propilot processes this data solely to provide the Service.

1.2. Scope Limitations

This Policy does not govern the practices of Third-Party Services integrated with the Service. Each third party maintains its own privacy policy:

• Certn (screening): https://certn.co/privacy-policy
• Stripe (payments): https://stripe.com/privacy
• Google (AI infrastructure): https://cloud.google.com/terms/cloud-privacy-notice

2. Information We Collect

2.1. Landlord Account Data

We collect the following information when you create and use a Propilot account:

• Identity: Full name, email address, phone number, business name (if applicable)
• Property details: Property address, unit count, rental amount, amenities, property photos and descriptions
• Payment information: Processed by Stripe; Propilot stores only the last four digits of the card number, card type, and billing address for reference
• Account activity: Login timestamps, feature usage, Service interaction history

2.2. Applicant and Tenant Data

Landlords submit or trigger the collection of the following Applicant information through the Service:

Pre-Qualification Data (collected via AI Leasing Agent):

• Name, email address, phone number
• Stated income range, employment type
• Desired move-in date, pet ownership, number of occupants

Application Data (submitted by Applicant):

• Government-issued ID (processed by Certn; Propilot does not store identity documents)
• Current and previous addresses
• Employer name and contact information
• Annual income and employment verification details
• Personal references and contact information

Screening Data (from Certn):

• Credit score and key credit history factors
• Criminal background check status (clean/flagged)
• Eviction history status (clean/flagged)
• Identity verification result

Important: Propilot stores screening results as composite grades (A/B/C/D) and key factor summaries. Raw credit reports are not stored by Propilot beyond the screening provider’s required retention window. Raw reports remain with Certn per their data retention policy.

2.3. AI-Generated Data

The Service generates the following data through AI processing:

• Composite grades (A/B/C/D) for screened Applicants
• Natural-language recommendation summaries explaining AI scoring factors
• Pre-qualification status (Qualified / Conditional / Not Qualified)
• Conversation transcripts between Applicants and the AI Leasing Agent
• Showing coordination data (confirmed times, rescheduling, no-shows)

2.4. Technical and Usage Data

We automatically collect:

• IP address, browser type, device type, operating system
• Pages visited, features used, session duration
• Error logs and performance data
• Cookies and similar tracking technologies (see Section 12)

2.5. Information We Do Not Collect

• Raw credit report files — these remain with Certn
• Payment card numbers — Stripe is our payment processor; we never access full card numbers
• Protected characteristics — we do not collect race, religion, sexual orientation, disability status, or other protected-class data from Applicants through the Service
• Children’s data — see Section 13

3. How We Use Your Information

3.1. Landlord Data — Purposes

3.2. Applicant Data — Purposes

Applicant data is processed on behalf of the Landlord for the following purposes:

3.3. What We Do Not Do

• We do not sell personal information to third parties
• We do not use Applicant personal information to train AI models without explicit, informed, opt-in consent from the relevant individuals
• We do not use Landlord personal information to train AI models without explicit consent
• We do not use Screening Report data for any purpose other than the specific rental evaluation requested by the Landlord
• We do not share Applicant data with other Landlords or unrelated third parties

4. Automated Decision-Making and AI

4.1. How AI Processing Works

Propilot uses artificial intelligence and machine learning to assist Landlords in evaluating rental applications. Specifically:

• The AI Leasing Agent engages with Applicants via conversational chat to collect pre-qualification information (income range, employment, move-in date, pets, occupancy)
• The AI scoring engine processes Screening Report data to generate a composite grade (A/B/C/D) and a natural-language recommendation summary

4.2. Input Factors

The AI scoring engine uses the following factors to generate recommendations:

• Credit score and key credit history events
• Income-to-rent ratio (based on Applicant-stated income)
• Criminal background check status
• Eviction history status
• Landlord-configured qualification thresholds (e.g., minimum credit score, income ratio)

The AI does not use race, colour, ancestry, place of origin, religion, marital status, family status, physical or mental disability, sex, sexual orientation, gender identity or expression, age, or lawful source of income as scoring factors.

4.3. Human Decision Authority

AI Recommendations are advisory tools — they do not constitute tenancy decisions. The Landlord reviews all AI Recommendations alongside the underlying data and makes the final decision independently. Propilot does not approve or reject any Applicant.

4.4. Applicant Rights Regarding AI

• Right to Know: Applicants may request confirmation of whether automated processing was used in evaluating their application
• Right to Explanation: Applicants may request a plain-language explanation of the primary factors that contributed to their AI grade
• Right to Human Review: Applicants may request that a human review their AI-generated grade

To exercise these rights, contact info@propilot.tech.

4.5. Algorithmic Fairness

Propilot makes reasonable efforts to minimize discriminatory outputs from its AI systems, including actively excluding protected characteristics from scoring inputs. However, AI models trained on historical data may reflect systemic patterns present in that data. Propilot does not warrant that AI outputs are entirely free from bias. Landlords are responsible for ensuring their tenancy decisions comply with the Human Rights Code (British Columbia).

5. Applicant and Tenant Rights

Applicants and Tenants whose personal information has been processed through the Service have the following rights, regardless of whether they hold a Propilot account:

5.1. Right of Access

You may request a copy of the personal information Propilot holds about you. This includes: pre-qualification data, screening grades and factor summaries, AI Recommendations, and conversation transcripts.

Note: Raw credit reports are held by Certn, not Propilot. To access your full credit report, contact Certn directly or request a copy from the applicable credit bureau.

5.2. Right to Correction

You may request correction of inaccurate personal information held by Propilot. If the inaccuracy originates from a Screening Report (e.g., incorrect credit data), you should dispute the information directly with Certn and the applicable credit bureau.

5.3. Right to Deletion

You may request deletion of your personal information, subject to:

• Legal retention obligations (see Section 10)
• Active tenancy records that the Landlord is required to maintain under the Residential Tenancy Act
• Pending disputes or legal proceedings

5.4. Right to Withdraw Consent

You may withdraw consent to Propilot’s processing of your personal information at any time. If consent is withdrawn during an active screening process, the screening cannot be completed and Propilot will notify the Landlord accordingly (without disclosing any partial results).

5.5. Adverse Action Notice

If a Landlord declines your application based in whole or in part on a Screening Report, you are entitled to receive an Adverse Action Notice that includes: the name of the screening provider (Certn), your right to dispute the information, and information about how to obtain a copy of your report.

5.6. How to Exercise Your Rights

Contact Propilot at info@propilot.tech. Include your full name and sufficient detail to identify your records. We will verify your identity before fulfilling any request.

Response time: We will respond to all requests within 30 days, as required by PIPEDA. If we require additional time (up to 60 days), we will notify you of the extension and the reason.

5.7. Complaints

If you believe your personal information has been mishandled, you may file a complaint with:

• Propilot: info@propilot.tech
• Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca
• Office of the Information and Privacy Commissioner for BC (OIPC): https://www.oipc.bc.ca

6. Landlord Rights

As a registered Landlord, you have the following rights regarding your personal information:

6.1. Access: Request a copy of the personal information we hold about your account.

6.2. Correction: Request correction of inaccurate account information.

6.3. Deletion: Request deletion of your account and associated personal information, subject to legal retention obligations.

6.4. Data Portability: Request an export of your property data, leasing history, and account information in a standard format.

6.5. Withdrawal of Consent: Withdraw consent to our processing of your personal information. Withdrawal may result in termination of your account and inability to use the Service.

To exercise these rights, contact info@propilot.tech.

7. How We Share Your Information

7.1. Sub-Processors

Propilot engages the following sub-processors to provide the Service:

Propilot maintains data processing agreements with all sub-processors. We will update this table and notify Landlords of material changes to sub-processors.

7.2. Disclosure to Landlords

Applicant data (pre-qualification results, Screening Reports, AI Recommendations) is disclosed to the requesting Landlord. This is the core function of the Service and is performed at the Landlord’s direction.

7.3. Legal Disclosures

We may disclose personal information:

• As required by law, court order, subpoena, or regulatory authority
• To legal counsel for the purpose of obtaining legal advice
• To protect the rights, property, or safety of Propilot, our users, or the public

7.4. Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Propilot’s assets, personal information may be transferred to the acquiring entity. We will provide notice to affected users before any such transfer and will require the acquiring entity to honor the commitments in this Privacy Policy.

7.5. Aggregated and De-Identified Data

Propilot may use and share aggregated, de-identified data (such as market trends, vacancy rates, and conversion analytics) for product improvement, research, and marketing purposes. Such data cannot be used to identify any individual.

7.6. What We Do Not Share

• We do not sell personal information to third parties
• We do not share Applicant data with other Landlords
• We do not share personal information with data brokers or advertisers

8. Cross-Border Data Transfers

Propilot is based in British Columbia, Canada. Your personal information is primarily stored and processed in Canada.

8.1. Canada-Based Processing

8.2. Cross-Border Processing

Certain sub-processors are located in the United States. When data is transferred to the US, it is subject to the laws of that jurisdiction, including lawful requirements to disclose personal information to government and national security authorities.

8.3. Safeguards

Propilot relies on contractual safeguards (data processing agreements) with all sub-processors that require them to: (a) process data only on Propilot’s instructions; (b) maintain appropriate security measures; and (c) notify Propilot of any government access requests.

By using the Service, you acknowledge and consent to the transfer of personal information to jurisdictions outside Canada as described above.

9. Data Security

Propilot implements physical, technical, and administrative safeguards to protect personal information:

9.1. Technical Measures

• Encryption at rest: AES-256 for all personal data stored in our systems
• Encryption in transit: TLS 1.3 for all data transmitted between your device, Propilot’s servers, and third-party services
• Screening data minimization: Composite grades and key factors are stored; raw credit reports are not retained by Propilot
• Payment security: All payment card data is processed by Stripe. Propilot does not access, process, or store full payment card numbers (PCI-DSS compliance via Stripe)

9.2. Administrative Measures

• Access controls: Role-based access; employees and contractors access only the data necessary for their function
• Confidentiality obligations: All personnel are bound by confidentiality obligations
• Security training: Personnel with access to personal information receive security awareness training

9.3. Document Security

• Signed leases are stored encrypted with access restricted to the Landlord (account holder) and Tenant (via time-limited email link)
• Adverse Action Notice records are stored and access-controlled

9.4. Limitation

No security system is impenetrable. While we take reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a security incident, we will follow the breach notification procedures described in Section 11.

10. Data Retention

Propilot retains personal information only as long as necessary for the purposes described in this Policy or as required by law.

10.1. Retention Schedule

10.2. Deletion

When the retention period expires, personal information is securely deleted or irreversibly de-identified. Landlords may request earlier deletion of their account data, subject to legal retention obligations.

10.3. Legal Holds

If personal information is subject to a pending legal claim, regulatory investigation, or dispute, we may retain the information beyond the standard retention period until the matter is resolved.

11. Breach Notification

11.1. Breach Response Plan

Propilot maintains a written incident response plan for identifying, containing, and remediating security incidents affecting personal information.

11.2. Mandatory Reporting

Under PIPEDA, organizations must report data breaches to the Office of the Privacy Commissioner of Canada (OPC) and notify affected individuals when the breach creates a “real risk of significant harm” (RROSH). Screening data (credit history, criminal records, identity documents) is considered high-sensitivity information that is likely to meet the RROSH threshold.

11.3. Notification Timeline

• Internal assessment: Propilot targets completion of a breach assessment within 72 hours of discovering the incident
• Regulatory notification: As soon as feasible after determining that the RROSH threshold is met, as required by PIPEDA
• Individual notification: Affected individuals will be notified as soon as feasible, including a description of the breach, the types of information involved, steps taken to mitigate harm, and steps the individual can take to protect themselves

11.4. Landlord Notification

If a breach affects Applicant or Tenant data that Propilot processes on a Landlord’s behalf, Propilot will notify the Landlord promptly so that the Landlord can fulfill their own notification obligations as the data controller.

11.5. Record Keeping

Propilot maintains a record of all security incidents, including incidents that do not meet the RROSH threshold, as required by PIPEDA.

12. Cookies and Tracking

12.1. Types of Cookies

12.2. No Advertising Cookies

Propilot does not use advertising cookies, cross-site tracking, or retargeting pixels.

12.3. Applicant Cookies

Applicants interacting with the AI Leasing Agent (e.g., via a chat widget on a listing page) are subject to session cookies only, used to maintain conversation state. These cookies are deleted when the session ends.

12.4. Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

13. Children’s Privacy

The Service is intended for use by individuals who are at least 19 years of age (the age of majority in British Columbia). Propilot does not knowingly collect personal information from individuals under 19.

If we learn that we have collected personal information from a person under 19, we will delete that information promptly. If you believe that a minor’s personal information has been collected through the Service, please contact us at info@propilot.tech.

14. BC PIPA and PIPEDA Compliance

14.1. Dual Applicability

Propilot is a British Columbia-based organization engaged in commercial activity. Both BC PIPA and federal PIPEDA apply to our collection, use, and disclosure of personal information:

• BC PIPA governs personal information collected, used, or disclosed in the course of commercial activity within British Columbia
• PIPEDA applies to personal information collected in the course of commercial activity that crosses provincial or national boundaries, and to federally regulated activities

This Policy is designed to satisfy both statutes. Where they differ, we apply the stricter standard.

14.2. PIPEDA Fair Information Principles

Propilot’s privacy practices are guided by the ten fair information principles set out in Schedule 1 of PIPEDA:

1. Accountability: Propilot’s Privacy Officer is responsible for compliance with this Policy
2. Identifying Purposes: We identify the purpose of collection at or before the time of collection
3. Consent: We obtain meaningful consent for the collection, use, and disclosure of personal information
4. Limiting Collection: We collect only the personal information necessary for identified purposes
5. Limiting Use, Disclosure, and Retention: We use and disclose personal information only for identified purposes and retain it only as long as necessary
6. Accuracy: We make reasonable efforts to keep personal information accurate, complete, and up-to-date
7. Safeguards: We protect personal information with appropriate security measures (see Section 9)
8. Openness: We make our privacy practices readily available through this Policy
9. Individual Access: Individuals may request access to and correction of their personal information
10. Challenging Compliance: Individuals may challenge our compliance by contacting our Privacy Officer

14.3. Regulatory Contacts

• Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca — 1-800-282-1376
• Office of the Information and Privacy Commissioner for BC (OIPC): https://www.oipc.bc.ca — 250-387-5629

Individuals who are not satisfied with Propilot’s response to a privacy inquiry or complaint may escalate to the applicable regulator.

15. Changes to This Policy

15.1. Propilot may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

15.2. Material changes: We will provide at least 30 days’ notice of material changes via email to registered Landlords and via an in-app notification. Material changes include: new categories of data collection, new sub-processors, changes to cross-border transfer practices, or changes to data retention periods.

15.3. Non-material changes: We will update the “Last Updated” date at the top of this Policy.

15.4. Continued use: Your continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy. If you do not agree with the changes, you may close your account before the effective date.

15.5. Retroactive changes: Changes to this Policy will not retroactively alter how previously collected Applicant data is used without obtaining fresh consent from the affected individuals where required by law.

16. Contact and Complaints

Privacy Officer

1576533 B.C. LTD. (DBA Propilot) 1228 W Hastings St, Suite 404, Vancouver, BC V6E 4S6

• Privacy inquiries: info@propilot.tech
• General support: support@propilot.tech

Applicant Inquiries

Applicants and Tenants who are not Propilot account holders may submit privacy inquiries, access requests, or complaints to info@propilot.tech. Please include your full name and sufficient detail for us to locate your records.

Response Time

We will respond to all privacy inquiries within 30 days, as required by PIPEDA. If additional time is needed (up to 60 days), we will notify you of the extension and the reason.