Privacy Policy

1. Introduction and Scope

Sweet ("we," "our," "us") operates the Sweet platform (the "Service"), accessible via the website and mobile applications, designed for rental management and connecting landlords with tenants in Quebec and Canada.

This Privacy Policy describes how we collect, use, disclose, retain and protect your personal information when you use our Service, in accordance with Quebec's Act respecting the protection of personal information in the private sector (hereinafter the "Quebec Act"), An Act to modernize legislative provisions as regards the protection of personal information (Law 25), the Personal Information Protection and Electronic Documents Act (PIPEDA) and any other applicable legislation.

By using the Service, you acknowledge that you have read and understood this policy. If you do not agree with the practices described below, please do not use the Service.

Sweet also complies with applicable provincial personal information protection legislation, including the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia) and any equivalent legislation applicable in other Canadian jurisdictions.

2. Definitions

For the purposes of this policy:

• "Personal information" means any information which relates to a natural person and allows that person to be identified directly or indirectly, within the meaning of section 2 of the Quebec Act.
• "Sensitive information" means personal information that, by its nature or given the context of its use or disclosure, gives rise to a high degree of reasonable expectation of privacy (s. 12.1, Law 25).
• "Consent" means a free, informed and specific manifestation of will, which may be express or implied depending on the sensitivity of the information.
• "Confidentiality incident" means unauthorized access to, unauthorized use or disclosure of, or loss of personal information (s. 3.5, Law 25).
• "Privacy officer" means the person designated within Sweet to ensure compliance with this policy and applicable legislation.
• "Landlord" means a user registered on the Sweet platform as a landlord or any team member (property manager).
• "Tenant" means a user registered on the Sweet platform as a current or prospective tenant (Visitor).

3. Personal Information We Collect

We collect the following categories of personal information:

• Identification information: full name, email address, phone number, mailing address, profile photo.
• Additional identification information (team member): Information relating to team member salaries may be accessible depending on the role defined by the Landlord profile administrator.
• Account information: login credentials, role (landlord, tenant), language and location preferences.
• Financial information: payment information processed by Stripe, transaction history and billing details.
• Property information: property addresses, descriptions, photos and videos (including images captured by your device's camera or selected from your gallery), lease documents, rental prices, availability.
• Communication information: messages exchanged between landlords and tenants through the platform, support requests, notifications.
• Technical information: IP address, browser type, operating system, device identifiers, pages visited, visit duration, referring URLs, crash reports, app performance data, error diagnostics, in-app interactions (screens viewed, actions taken).
• Geolocation information: approximate location data based on IP address.
• Uploaded documents: leases, identification documents, building-related documents and any other files you choose to upload to the platform.
• Audio data: voice notes recorded during emergency reports via your device's microphone.
• Electronic signature data: digital handwritten signature images, timestamps, IP addresses, user agents, geolocation data, cryptographic hashes and detailed audit logs collected during the document signing process (see section 9 for more details).

4. How We Collect Your Information

We collect your personal information through the following means:

• Directly from you: when you register, create your profile, post listings, upload documents, send messages or submit support requests.
• Automatically: through the use of cookies, tracking pixels and similar technologies when you browse the platform.
• From third-party providers: authentication services (Auth0), payment processing (Stripe), mapping services (Mapbox, OpenStreetMap) and analytics services.
• From publicly available sources: land registries, municipal databases for address verification.

5. Legal Bases and Purposes of Processing

In accordance with the Quebec Act (ss. 8, 14) and PIPEDA, we process your personal information on the following bases:

• Performance of the subscription: to provide the Service, process payments, facilitate communications between landlords and tenants and manage your account.
• Consent: for sending commercial communications, using non-essential cookies and processing sensitive information.
• Reasonable commercial interests, in accordance with section 5(3) of PIPEDA and applicable provincial legislation, including to improve the Service, ensure platform security, prevent fraud and conduct internal analyses.
• Legal obligation: to comply with our obligations under tax laws, anti-money laundering regulations and court orders.

6. How We Use Your Information

We use your personal information for the following purposes:

• Provide, operate and maintain the Service, including account management and listing display.
• Process rent payment transactions via Stripe and issue receipts.
• Facilitate communication between landlords and tenants through the platform's messaging system (Pusher).
• Send transactional email notifications (via Nodemailer/SMTP) regarding your account, payments and listings.
• Power listing search and recommendation features via Algolia.
• Display property locations on interactive maps via Mapbox and Leaflet/OpenStreetMap.
• Provide AI-assisted features (via OpenAI), such as listing description generation and neighbourhood recommendations.
• Prevent fraud, detect abuse and protect platform security, including via Google reCAPTCHA v3.
• Comply with our legal and regulatory obligations.
• Improve and personalize the Service based on your preferences and usage.
• Facilitate the electronic signing of legal documents (leases, notices, building rules) and maintain an immutable audit log to ensure the legal validity of signatures in accordance with the LCCJTI.
• Verify the authenticity and integrity of signed documents via signing certificates and SHA-256 cryptographic hashes.

7. Sharing and Disclosure of Your Information

We do not sell your personal information. We may disclose your information in the following circumstances:

• Between users: landlord profile information is visible to tenants searching for listings, and vice versa within an established rental relationship.
• With third-party service providers: as described in section 8 below, for the operation of the Service.
• As required by law: when required by a court order, subpoena or legal obligation, in accordance with section 18(6) of the Quebec Act.
• To protect rights: to enforce our terms of use, protect our rights, privacy, safety or property, or those of others.
• With your consent: in any other circumstance for which you have given your explicit consent.
• In connection with a business transaction: in the event of a merger, acquisition, financing, reorganization or sale of all or part of our assets, your personal information may be disclosed to a potential or actual acquirer, subject to the requirements of section 18.4 of the Quebec Act and applicable Canadian laws.

Any acquirer or successor will be required to respect the commitments set out in this Privacy Policy or to provide you with prior notice in the event of a substantial change to their personal information protection practices.

8. Third-Party Service Providers

We use the following third-party service providers to operate the Service. Each processes your personal information in accordance with its own privacy policy:

• Auth0: authentication and identity management — processes your login credentials, session tokens and login data.
• Stripe: payment processing — processes payment information, billing details and transaction history.
• TIB Finance: bank payment processing — processes banking information, pre-authorized debit authorizations, transaction details and payment statuses.
• Amazon Web Services (AWS): cloud storage — hosts photos, documents and files uploaded to the platform.
• Pusher: real-time messaging — processes messages and notifications exchanged between users.
• Nodemailer/SMTP: transactional email delivery — processes email addresses and notification content.
• Google reCAPTCHA v3: bot protection — processes interaction data to assess fraud risk.
• Mapbox: mapping services — processes location data for map display and geolocation.
• Leaflet/OpenStreetMap: mapping — processes location data for map rendering.
• OpenAI: artificial intelligence — processes text inputs for listing description generation and assistance features.
• Algolia: search — processes listing data and search queries to provide real-time results.
• Sentry: error and performance monitoring — processes crash reports, app performance data, device identifiers and stack traces to ensure the stability and quality of the Service.

9. Electronic Signatures and Digital Documents

Sweet offers an electronic signature feature that allows landlords and tenants to sign, view and verify legal documents (leases, notices, building rules, etc.) directly on the platform. In accordance with Quebec's Act to establish a legal framework for information technology (LCCJTI, R.S.Q., c. C-1.1, ss. 2, 3, 5, 6 and 39), we collect and retain the information necessary to ensure the integrity, authenticity and non-repudiation of each electronic signature.

During the signing process, we collect the following information:

• Signature image: your digital handwritten signature, captured via an HTML5 canvas and stored as a base64-encoded image in our database.
• Timestamp: the exact date and time of each action (consent, document viewing, signature application, completion, refusal).
• IP address: your IP address is recorded at the time of consent, signing and any other interaction with the document, from the x-forwarded-for, x-real-ip or cf-connecting-ip headers.
• User agent: the browser type, operating system and device information used during signing.
• Geolocation data: country, region and city, when available via Cloudflare headers (cf-ipcountry, cf-region, cf-city).
• Viewing tracking: number of document views, date of first and last viewing.
• Consent: separate timestamp and IP address recorded at the time you give your consent to sign.
• Cryptographic hash (SHA-256): digital fingerprint of the original document, the signed document and each signature value, allowing detection of any alteration.
• Signing certificate: a unique certificate identifier is generated for each completed document, enabling public verification of its authenticity.
• Immutable audit log: a detailed chronological record of each action performed on the document (creation, sending, viewing, consent, signing, completion, refusal, verification), including the identity of the actor, IP address, user agent, geolocation and the state of the document at the time of the action. This log is never modified or deleted.
• Acknowledgement of receipt: for documents requiring only a confirmation of reading, we record the timestamp, IP address, user agent and confirmation method.
• Reason for refusal: if you refuse to sign a document, the reason you provide (if any) is recorded.

Original and signed documents are stored securely on AWS S3, accessible only via time-limited presigned URLs (30 minutes for viewing, 5 minutes for uploading). The audit log constitutes legal proof of the validity of the signature and is retained permanently in accordance with the requirements of the LCCJTI.

10. Artificial Intelligence and Automated Decisions

Sweet uses artificial intelligence (AI) technologies provided by OpenAI to offer certain features, including listing description generation and chatbot assistance.

In accordance with section 12.1 of Law 25, we inform you that:

No decision based exclusively on automated processing is made about you without your being informed. AI features are provided for assistance purposes only and do not replace human judgment. You have the right to be informed when a decision concerning you is based on automated processing of your personal information, to know the information used and the main factors that led to the decision, and to have the decision reviewed by a natural person.

The data you submit to AI features is processed in accordance with OpenAI's privacy policy and is not used to train third-party AI models.

Where required by applicable law, we will also provide users residing in other Canadian provinces with the required information regarding automated decisions, in accordance with the principles of transparency and fairness set out in PIPEDA.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential cookies: ensure the basic operation of the Service, maintain your session and security preferences.
• Functionality cookies: remember your language, location and display preferences.
• Analytics cookies: understand how you use the Service to improve the user experience.
• Security cookies: Google reCAPTCHA v3 uses cookies to protect against bots and abuse.

You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the operation of the Service. In accordance with Law 25, we obtain your consent before deploying non-essential cookies.

12. Data Security

We implement technical and organizational security measures consistent with industry standards to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Secure authentication via Auth0 with multi-factor authentication support.
• PCI-DSS compliant payment processing via Stripe (we never store your complete credit card information).
• Secure file storage on AWS S3 with access control.
• Role-based access control within the platform.
• Regular security audits and vulnerability assessments.
• Staff training on personal information protection.

Despite these measures, no transmission over the Internet or electronic storage is completely secure. We cannot guarantee the absolute security of your information.

13. Data Retention and Deletion

We retain your personal information for as long as necessary for the purposes for which it was collected, in accordance with section 12 of the Quebec Act:

• Account data: retained for the duration of your active account, then for 7 years after its closure in accordance with the prescription period under article 2925 of the Civil Code of Quebec.
• Transactional data: retained for 7 years in accordance with tax and accounting requirements.
• Messages and communications: retained for the duration of the active rental relationship, then for 7 years after its end.
• Uploaded documents: retained for the duration of your use of the Service and deleted within 7 years following the deletion of your account.
• Technical logs and analytics data: retained for a maximum of 7 years for security and Service improvement purposes.
• Electronic signature audit log: retained permanently in accordance with the requirements of the LCCJTI to ensure the long-term legal validity of electronic signatures. This log constitutes proof of the integrity and authenticity of each signed document.
• Signed documents and signing certificates: retained permanently or until the account is deleted, after which they are retained for the duration of the underlying contractual relationship plus the applicable prescription period (7 years under article 2925 of the Civil Code of Quebec).
• Saved signature images: retained for the duration of your active account and deleted within 7 years following the deletion of your account.

The electronic signature audit log is retained for as long as necessary to ensure the legal integrity of signed documents and to allow the exercise or defence of rights in court, in accordance with applicable laws.

14. Your Personal Information Protection Rights

In accordance with the Quebec Act and Law 25, you have the following rights:

• Right of access (s. 27): you may request access to the personal information we hold about you.
• Right of rectification (s. 28): you may request the correction of inaccurate, incomplete or ambiguous information.
• Right to erasure: you may request the deletion of your personal information, subject to our legal obligations.
• Right to portability (s. 27, Law 25): you may request a copy of your information in a structured and commonly used technological format.
• Right to withdraw consent: you may withdraw your consent to the processing of your information at any time, subject to legal or contractual restrictions.
• Right to de-indexation (s. 28.1, Law 25): you may request the cessation of the dissemination of your personal information or the de-indexation of any hyperlink attached to your name.
• Right to be informed of automated decisions (s. 12.1, Law 25): you have the right to know when a decision concerning you is based on automated processing.

To exercise your rights, please contact us via our contact page. We will respond within 30 days in accordance with section 32 of the Quebec Act.

15. Consent

In accordance with the Quebec Act and Law 25:

Your consent to the collection and use of your personal information must be manifest, free, informed and given for specific purposes. For sensitive information, your consent must be explicit.

By creating an account on Sweet, you consent to the collection and use of your personal information as described in this policy. You may withdraw your consent at any time by contacting us. Withdrawal of consent may, however, limit your ability to use certain features of the Service.

We do not collect consent through obscure clauses or pre-checked boxes. We ask for separate consent for each processing purpose when required.

16. Protection of Minors

The Service is not intended for persons under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a minor, we will take reasonable steps to delete it promptly.

In accordance with applicable laws, where a minor is authorized to exercise certain personal information protection rights autonomously, we will respect these provisions according to the province or territory concerned.

In Quebec, minors aged 14 and over may exercise certain rights autonomously in accordance with Law 25. In other provinces and territories, these rights are exercised in accordance with applicable laws and the degree of maturity recognized by them.

17. International Data Transfers

Some of our third-party service providers (including AWS, Stripe, Auth0, OpenAI and Algolia) may process your personal information on servers located outside Quebec or Canada, including in the United States.

In accordance with section 17 of the Quebec Act, before disclosing personal information outside Quebec, we conduct a privacy impact assessment to ensure that the information will receive adequate protection. We use contractual clauses and data processing agreements with our providers to ensure a level of protection equivalent to that offered by Quebec and Canadian legislation.

These transfers are made in accordance with the requirements of PIPEDA and applicable provincial laws, which require organizations to use contractual or other means to ensure a comparable level of protection.

You may obtain information about our policies and practices governing the management of personal information transferred abroad by contacting us via our contact page.

18. Confidentiality Incidents

In accordance with sections 3.5 to 3.8 of Law 25, in the event of a confidentiality incident presenting a serious risk of harm:

We will notify the Commission d'accès à l'information du Québec with diligence. We will notify the persons whose information is concerned by the incident without delay. The notice will contain a description of the information concerned, the circumstances of the incident, the measures taken or contemplated to reduce the risks, and the contact details of a resource person.

We maintain a register of all confidentiality incidents, whether or not they present a serious risk of harm, in accordance with section 3.8 of Law 25. This register is kept for at least five (5) years and is available upon request from the Commission d'accès à l'information.

19. Privacy Impact Assessments

In accordance with section 3.3 of Law 25, we conduct privacy impact assessments (PIAs) before:

Any project to acquire, develop or redesign information systems or electronic service delivery involving the collection, use, disclosure, retention or destruction of personal information. Any disclosure of personal information outside Quebec.

These assessments take into account the sensitivity of the information concerned, the purpose of its use, its quantity, distribution and medium, as well as the applicable protection measures. The results of these assessments guide our design decisions and personal information protection practices.

20. Privacy Officer

In accordance with section 3.1 of Law 25, Sweet has designated a Privacy Officer whose contact details are as follows:

Privacy Officer Sweet Email: privacy@sweet.immo

The Privacy Officer is responsible for ensuring compliance with the Quebec Act and Law 25 within our organization. They are the primary point of contact for any question or complaint regarding the protection of your personal information.

21. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes to our practices, technology or applicable regulations.

In the event of a substantial modification, we will notify you by email or by a prominent notice on the platform at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates the date of the last revision.

Your continued use of the Service after the posting of changes constitutes your acceptance of the revised policy. If you do not agree with the changes, please stop using the Service and delete your account.

22. Language

In accordance with the Charter of the French Language (Bill 101, s. 55), the French version of this Privacy Policy prevails in the event of any discrepancy between the French and English versions.

This policy is available in French and English to serve all our users.

23. Contact Information and Supervisory Authority

For any question, concern or complaint regarding this Privacy Policy or the processing of your personal information, please contact us via our contact page.

Sweet, Sweet.immo — 3235 av. de la Gare, Mascouche, (Québec) J7K 3C1.

• Commission d'accès à l'information du Québec: provincial body responsible for overseeing the application of the Quebec Act and Law 25. Phone: 1-888-528-7741.
• Office of the Privacy Commissioner of Canada: federal body responsible for overseeing the application of PIPEDA. Phone: 1-800-282-1376.