Privacy Policy
We take your privacy seriously. This policy explains what information we collect, why we collect it, and how we protect it. We comply with PIPEDA and Canadian privacy law.
Last updated: February 17, 2026
Summary
We never sell your data
Your information is never sold or traded to third parties
Documents are encrypted
Stored in encrypted Supabase Storage with row-level security
You control your data
Request access, correction, or deletion at any time
Contents
Overview
RezRescue respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the RezRescue platform.
RezRescue is based in the Province of Ontario, Canada. We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy legislation.
By creating an account and using our services, you consent to the collection and use of your personal information as described in this policy. This policy was last updated on February 17, 2026.
Information We Collect
We collect only the information necessary to provide our services. This falls into four categories:
Account Information
When you register, we collect your full name, university email address, phone number, and university enrollment status. This information is used to verify your identity as a UTM student and to maintain your account.
Identity and Enrollment Documents
To verify your student status and process housing applications, we collect uploaded documents including government-issued ID and proof of enrollment. These documents are stored in encrypted form in Supabase Storage with row-level security controls. Only you and property managers reviewing your active application can access these documents.
Payment Information
When you upgrade to a paid tier (Premium or Priority), your payment is processed by Stripe, a PCI-DSS compliant payment processor. RezRescue will never receive, store, or have access to your full credit card or banking details. We only store your Stripe payment intent ID and the amount paid for record-keeping and refund processing.
Usage Data
We collect anonymous, aggregated usage analytics to understand how students interact with the platform so we can improve it. This data does not identify you individually and is not linked to your account or documents.
How We Use Your Information
We use the information we collect for the following purposes:
- Verify student identity: To confirm that all platform users are current UTM students before granting access to housing communities.
- Match students with housing communities: To present you with relevant available communities based on your profile and preferences.
- Process applications: To transmit your application and documents to the relevant property manager for review and decision.
- Communicate application status: To notify you by email when your application status changes, when you receive an acceptance offer, or when action is required.
- Improve the platform: To analyze anonymous usage patterns and make the platform more useful for students.
- Comply with legal obligations: To maintain records as required by applicable law, including payment records.
We do not use your personal information for any purpose beyond those listed above without your prior consent.
Data Sharing
RezRescue does not sell, trade, or rent your personal information to third parties. We share your data only in the following limited circumstances:
- Property Managers: When you submit an application to a housing community, your application profile and uploaded documents are shared with the property manager responsible for that community. This sharing is limited to the scope of your active application and is necessary to process it.
- Stripe: When you purchase a paid tier (Premium or Priority), payment details are shared with Stripe solely for transaction processing. Stripe's own privacy policy governs how they handle this data.
- Resend: Your email address is shared with Resend, our transactional email provider, solely to deliver application status notifications and platform communications to you.
- Legal Requirements: We may disclose your information if required to do so by law or in response to valid legal process (such as a court order or government inquiry).
Data Retention
We retain your information only for as long as necessary to provide our services and meet our legal obligations. Specifically:
- Account data (name, email, profile information) is retained for as long as your account remains active. When you delete your account, this data is removed within 30 days unless retention is required by law.
- Uploaded documents (government ID, enrollment proof) are deleted from our storage systems 90 days after your housing placement is confirmed or your account is deleted, whichever comes first.
- Payment records are retained for the period required by applicable tax and financial regulations in Canada, typically seven (7) years.
Your Rights
Under PIPEDA and applicable Canadian privacy law, you have the following rights with respect to your personal information:
- Right of Access: You may request a copy of the personal information we hold about you at any time.
- Right to Correction: If any information we hold about you is inaccurate or incomplete, you may request that we correct it. Many fields can be updated directly from your account profile.
- Right to Deletion: You may request deletion of your account and associated personal data, subject to our legal retention obligations.
- Right to Withdraw Consent: Where we rely on your consent to process your data, you may withdraw that consent at any time by contacting us. Withdrawal of consent may limit your ability to use certain features of the platform.
To exercise any of these rights, please contact us at privacy@rezrescue.com. We will respond to all requests within 30 days.
Data Security
We take the security of your personal information seriously and implement appropriate technical and organizational safeguards:
- Encrypted Storage: All documents are stored in Supabase Storage, which encrypts data at rest. Row-level security policies ensure that only authorized users can access each document.
- Transport Security: All data transmitted between your browser and our servers is encrypted using HTTPS and TLS protocols. We do not allow unencrypted HTTP connections.
- Access Controls: Access to personal data within our systems is restricted to personnel and systems that require it to perform their function.
- Third-Party Security: We work only with service providers (Supabase, Stripe, Resend) that maintain their own industry-standard security practices and certifications.
While we employ strong security measures, no system is completely immune to security risks. If you suspect unauthorized access to your account, please contact us immediately at privacy@rezrescue.com.
Contact Us
For any privacy-related questions, requests, or concerns, please contact our privacy team:
Privacy Inquiries
privacy@rezrescue.comWe aim to respond to all privacy requests within 30 days as required by PIPEDA. If you are unsatisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.