Privacy

Who holds your information

Your landlord or property manager holds it. They decide what to ask for and how long to keep it. Kaza is the system they run it on — we hold the data on their behalf and do not sell it, share it between companies, or use it to train anything.

Each company on Kaza has its own separate database. One company cannot see another company’s applicants, and that is a property of how the system is built rather than a promise about how carefully it is used.

What gets collected, and when

• When you enquire — your name, email, phone, and what you asked about. If you email the leasing address, the message itself is stored so the person replying can see what you said.
• When you apply — the household, your employment and income, your rental history and references, and any documents you upload (commonly a pay stub or a piece of ID). Documents are stored privately and are not reachable by a public link.
• When you book a viewing — the time you chose, and the fact you turned up or did not.
• When you rent — your lease, your rent ledger and payments, deposits, repair requests and their history, and notes staff write about your tenancy.
• Always — a record of consequential actions taken on your file (who decided your application, who remitted your deposit, when a notice was served). This log cannot be edited after the fact, deliberately: it protects you as much as anyone.

Who can see it

Staff at the company you applied to, and only what their job needs. A contractor sent to fix your tap sees the address, your first name and a phone number — never your income, your application or any other tenancy. A building’s owner sees numbers for their own buildings and no personal details at all.

Kaza’s operators can reach a company’s data to run and repair the service, and any time that happens it is written to that company’s audit log.

Where it is stored, and who else touches it

Everything runs on Cloudflare — the databases, the uploaded documents, and the code itself. There is no analytics service watching you, no advertising network, and no third-party chat widget on these pages.

Three things do leave, and they are worth naming precisely:

• The address box. Canadian street data for some provinces is held locally and nothing leaves. Where a province is not loaded, what you have typed is sent to an open mapping service (Photon, run by Komoot in Germany) to suggest an address. It is sent by our server, not your browser, and it is only ever the partial address — never your name, and never anything else on the form.
• The map. Map images come through our own address, so the map provider never sees you.
• Email we send you. A confirmation or a receipt is handed to an email provider to deliver, as any email must be.

The writing assistance staff use to draft replies and listing text runs inside Cloudflare’s own network on the company’s own data. Nothing about you is sent to an outside AI service, and nothing you provide is used to train a model.

Screening

An application may be screened before a decision. Screening happens only after you have been asked and have agreed, and the agreement is recorded with a date. No credit or background check is run without it.

How long it is kept

A tenancy record is kept for as long as the tenancy lasts and afterwards for as long as your province’s tenancy law requires — deposits, notices and rent history can all be needed at a tribunal years later, and a landlord who has destroyed them cannot defend you or themselves.

An application that does not become a tenancy is kept for the current leasing season and then erased. You can ask for it to go sooner.

Getting a copy, or having it erased

Under Canadian privacy law (PIPEDA) you can ask what is held about you, get a copy, have a mistake corrected, and in most cases have it erased. These are buttons in this product, not a request someone has to get around to:

• A copy of everything on your application — the link in your application email opens your file and will download it as a data file.
• Erasure — the same page will delete it. What must be kept by law (a remitted deposit, a served notice) survives, and you are told exactly what survived and why rather than being told it is all gone when it is not.

If a company will not answer you, the Office of the Privacy Commissioner of Canada takes complaints.

If something goes wrong

If information is lost or taken in a way that creates a real risk of significant harm, the affected people and the Privacy Commissioner are told — that is the law, and it is also simply what should happen.

Asking us something

Start with the company you applied to; they hold your file and can act on it directly. For anything about Kaza itself, write to info@3d3d.ca.

See also the terms of use.