1. Who We Are
Oskkar is operated by Oskkar Labs Inc., PO Box 46, 260 Adelaide Street East, Toronto, ON M5A 1N1. We are the organization responsible for the personal information described in this policy.
We have designated a Privacy Officer who is accountable for our compliance with this policy and with PIPEDA. You can reach them at legal@oskkar.com.
2. Information We Collect
We collect only the personal information necessary to provide our services:
- Account information: First name, last name, email address, password (hashed and never stored in plain text), phone number (optional), and user role (landlord or tenant).
- Tenancy information: Property addresses, lease terms, rent amounts, deposit amounts, dates, and other tenancy-related data you enter.
- Rent and payment records: Rent charges, payments applied against them, the method recorded (pre-authorized debit, e-transfer, cheque, cash), and any reference you enter such as a cheque number or bank memo.
- Bank account details, for pre-authorized debit only: If you set up pre-authorized rent payments, you provide your bank name, institution number, transit number, and account number. We do not store your account number. It passes through our servers once, is sent to the payment processor, and is not retained or logged by us. We store your bank name, institution number, transit number, the last four digits of the account, and an identifier issued by the processor — enough to show you which account is connected, not enough to move money.
- Payment method for subscription billing: For landlord accounts, a reference to your saved card held by Stripe — a Stripe customer identifier, a payment method reference, card brand, expiry month and year, and the last four digits. We do not store full card numbers or CVV codes.
- Documents: Files you upload, such as lease PDFs, insurance documents, and maintenance photographs.
- Notices and communications: Notices you generate, maintenance requests, messages, and the timeline of actions taken on your tenancy.
- Usage data: Log data, IP addresses, browser type, and device information collected automatically when you use the platform.
We do not collect Social Insurance Numbers or government-issued identification documents, and we do not ask for them. Note that documents you choose to upload are stored as you provide them — please do not upload identification you do not intend us to hold.
3. How We Use Your Information
We use your information only for the following purposes:
- To create and manage your account
- To provide tenancy management features (notices, payment records, maintenance, reports)
- To enable the shared workspace between landlords and tenants
- To set up and maintain pre-authorized rent payments with the payment processor, where you ask us to
- To send service-related emails (account verification, notices of policy changes)
- To improve and debug the platform
- To comply with applicable law
We do not sell, rent, or trade your personal information. We do not use your information for targeted advertising, and we do not share it with advertisers or data brokers.
4. Consent
We rely on your consent to collect and use your personal information, and we ask for it separately for separate purposes.
- Operating your account and tenancy. Creating an account and using the platform requires the information described in section 2. This is the information without which the service cannot function.
- Marketing and product emails are separate and optional. We ask for these with their own opt-in, unticked by default. You do not need to agree to them to use Oskkar, and declining costs you nothing. You can withdraw at any time using the unsubscribe link in any such message.
- Pre-authorized debit requires its own authorization, recorded separately at the time you give it.
You may withdraw consent at any time, subject to legal and contractual restrictions and to the retention limits in section 7. Withdrawing consent for information needed to operate your account will mean we can no longer provide the service.
5. Shared Tenancy Data
Oskkar is a shared workspace platform. When a landlord creates a tenancy and links a tenant, both parties have access to the shared tenancy workspace, including lease details, notices, payment records, maintenance requests, and timeline events. This sharing is inherent to the platform's purpose and function.
By using Oskkar, you acknowledge and consent to this data sharing with the other party in your tenancy relationship. It also means that records forming part of a shared tenancy cannot be unilaterally removed by one party — see section 7.
6. Data Storage and Security
Your data is stored and processed in Canada and the United States by the service providers listed in section 10. We use industry-standard security measures including:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Hashed and salted passwords (bcrypt)
- Access controls limiting employee access to personal data
- Exclusion of request bodies, cookies, and account identifiers from our error-monitoring records
- Regular security reviews
No system is completely secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.
7. Data Retention
We retain your personal information for as long as your account is active. When you ask us to close your account, we delete or anonymize your personal information within 90 days, with the specific exceptions set out below. Those exceptions are not a general reservation — they are the complete list.
Records we keep, and why:
- Consent records. When you give or withdraw consent to receive marketing email, we record that you did, what you were shown, and when. Canada's Anti-Spam Legislation requires us to be able to prove consent, and a record that could be edited or deleted would not prove anything. These records cannot be altered or removed once written.
- Unsubscribe records. If you unsubscribe, we keep a record of the address and the class of message. Deleting it would mean we no longer know you asked us to stop.
- Notices and their audit trail. Notices served through the platform, the document as served, the signatures on it, and the record of who did what and when. These are legal records of a step taken in a tenancy, they are shared with the other party to that tenancy, and they may be needed by either party before the Landlord and Tenant Board.
- Rent and payment history. Rent charges and the payments applied against them. These are the financial record of a tenancy, shared with the other party, and are subject to record-keeping obligations.
- Tenancy timeline and billing history. The audit record of actions taken on a tenancy, and records of amounts invoiced to you by Oskkar, retained for accounting and tax purposes.
- Anything the law requires us to keep for longer than the periods above.
Where a record is shared between a landlord and a tenant, closing one party's account does not remove it from the other party's tenancy record. Where we retain a record under one of the exceptions above, we retain the minimum needed for that purpose.
To ask us to close your account and delete your information, contact our Privacy Officer at legal@oskkar.com.
8. Your Rights (PIPEDA)
Under PIPEDA and applicable Canadian law, you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Withdrawal of consent: Withdraw consent for collection or use, subject to legal and contractual restrictions
- Deletion: Request deletion of your account and associated data, subject to the retention exceptions in section 7
- Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated
To exercise these rights, contact our Privacy Officer at legal@oskkar.com. We will respond within 30 days.
9. Cookies and Tracking
We use essential cookies required to operate the platform (session management, authentication). We do not use advertising cookies, and we do not use cookies to track you across other websites. You can disable cookies in your browser, but this may prevent you from logging in.
We use privacy-focused analytics that measure page views and page performance without cookies and without building a profile of you — see section 10.
10. Service Providers
We use the following third-party service providers to operate the platform. Each is contractually obligated to protect your information and to use it only to provide services to us. Several process data in the United States, which means that information may be accessible to United States authorities under the laws of that country.
- Hosting and application platform — serves the application and processes all requests, including IP addresses and log data. United States.
- Database and file storage — stores the application database and the documents you upload, including leases, insurance documents, and photographs.
- Email delivery — receives recipient addresses and the full content of emails we send you. United States.
- Subscription payment processing (Stripe, Inc.) — receives and stores card details for Oskkar's own subscription billing. Stripe's privacy policy applies to information it processes, available at stripe.com. United States.
- Rent payment processing — where you set up pre-authorized rent payments, an independent regulated payment processor receives your bank details and the payment schedule in order to move funds between you and the other party. Oskkar is not a party to that transfer; see section 3 of our Terms of Service.
- Document text extraction — when you upload a lease, the document is sent to a third-party document-analysis service to read its text so we can pre-fill the tenancy form for you. You review and correct everything it extracts.
- Automated drafting assistance — where you ask us to generate a dispute report narrative or summarize lease clauses, the relevant tenancy information or lease text is sent to a third-party language-model service to produce the draft. This happens only when you request it. United States.
- Error monitoring — receives technical error reports and a sample of performance traces. We exclude request bodies, cookies, headers, and account identifiers from these reports. United States.
- Analytics — receives page views, page addresses, and page-performance measurements. It does not use cookies and does not build a profile of you. United States.
We do not share your information with advertisers or data brokers, and we do not sell it.
11. Children's Privacy
Oskkar is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a minor, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 30 days before changes take effect. The date at the top of this page indicates when this Policy was last revised.
13. Contact and Complaints
For privacy-related questions, to exercise your rights, or to raise a concern:
Privacy Officer, Oskkar Labs Inc.
legal@oskkar.com
PO Box 46, 260 Adelaide Street East, Toronto, ON M5A 1N1
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
14. Governing Law
This Privacy Policy is governed by PIPEDA and by the applicable privacy laws of the Province of Ontario.