Privacy Policy
Last updated October 8, 2026
Vault Leasing (“Vault”) is software that property management companies use to manage their buildings, visits, applications and leases. This policy explains what personal information Vault handles, why, and the choices you have. It's written to meet Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA.
Two kinds of information
Your account. When you or your company sign up, we keep your name, work email, your company's details, and a scrambled (hashed) form of your password — never the password itself. We record when and on which browser you sign in, so you can see your devices in Settings → Security.
Information your company manages. Property managers enter information about tenants, applicants and visitors — names, contact details, income, credit information, identity documents and leases. That information belongs to the property management company. Vault stores and processes it only on that company's behalf, to provide the service. If you're a tenant or applicant, the property management company you dealt with is responsible for your information — please contact them first.
How we use it
- To run Vault: signing in, showing each company its own data, and sending the emails a company asks Vault to send.
- To keep it secure: detecting misuse and protecting accounts.
- To support you when you write to us.
We don't sell personal information, and we don't use it for advertising.
Who else handles it
We use a small number of service providers to host Vault and to deliver email. They process information only on our instructions and under confidentiality obligations. Each company's information is kept separate from every other company's.
How long we keep it
A company's records stay until the company deletes them or closes its account. Notifications disappear after 7 days, a sign-in on a device ends after 30 days without use, and password-reset and invitation links expire. A new account whose email is never confirmed is deleted after 7 days. Encrypted backup copies of the database are kept for 30 days, so anything deleted is fully gone from them after that. A manager can see this in Settings → Privacy & Data, and download a copy of their company's data there.
Your rights
You can ask to see the personal information we hold about you, have it corrected, receive it in a usable format, or withdraw your consent where it applies. Write to yoelp360@gmail.com. We answer within 30 days. If you're not satisfied, you can contact the Commission d'accès à l'information du Québec.
Security
Access to Vault requires signing in; passwords are stored hashed; and each company can only reach its own data. If a confidentiality incident puts anyone at risk of serious harm, we'll notify the people affected and the Commission, as the law requires.
Changes
If this policy changes in a way that matters, we'll update the date above and let account holders know.
Contact
Questions about privacy: yoelp360@gmail.com.