Privacy Policy

• Account data: email address, display name, password (hashed).
• Property and tenant data: addresses, lease terms, rent amounts, tenant names and contact info that you enter.
• Payment and expense data: rent received, expenses, FX rates, CRA remittance records.
• Forwarded payment and bill emails: only the emails you choose to forward. BorderBird never connects to your inbox. Instead, you set up one email filter that forwards only your Interac e-Transfer and utility-bill emails to a private BorderBird address, and we read only those forwarded messages to detect rent payment confirmations and bill amounts. We never see, read, or have access to the rest of your mailbox.

• Plausible Analytics — cookieless, aggregate traffic counts (which pages are visited, roughly how many people, which site referred them). Runs on every visit; it cannot identify you and sets no cookie.
• Google Analytics 4 and Google Ads (conversion tracking + remarketing) — set cookies and are therefore off by default. They load only after you accept the cookie banner on your first visit, or if you accept later from the link below. If you decline, or if your browser sends a Global Privacy Control signal, neither one loads at all.
• Referral cookie (bb_attr) — a first-party cookie, set only if you accept the cookie banner, that lasts 30 days. It records the campaign tags in the link you arrived from (utm_source, utm_medium, utm_campaign, utm_content), the website that referred you (hostname only) and the page you landed on, so that if you later create an account we can tell which channel brought you. It is read when you sign up or sign in and then removed. It is not used for ads. If you decline, or your browser sends a Global Privacy Control signal and you have not accepted, it is not set.
• Vercel Speed Insights — anonymous page-performance metrics (load times), no personal data, no cookie.
• A sign-up on this site also fires a server-side conversion event to Google Analytics (so ad-blockers cannot hide that a sign-up happened), gated on the same cookie consent as the GA4 script above — it fires only if you accepted.

You can change your cookie preferences at any time.

• BorderBird never connects to your inbox and holds no access to your mailbox. We only ever receive the emails your own forwarding filter sends us.
• You set up one email filter that forwards only your Interac e-Transfer and utility-bill emails to a private BorderBird address — nothing else is ever sent to us.
• Used solely to detect rent payment notifications (e-transfers, Interac auto-deposits) and bill amounts.
• Parsed payment data is stored in your account; the original email content is not retained beyond what is needed to deduplicate imports.
• Never sold, rented, or shared with third parties.
• You can turn off forwarding at any time from the filter settings in your own email account. Once it's off, no further emails reach BorderBird; turning it off does not delete data already imported.

• No bank connection is required to use BorderBird. By default, your tenants pay you the way they already do (Interac e-Transfer, Zelle, Venmo, Cash App) and you forward the receipt — BorderBird only records the payment and never holds or moves your money.
• Connecting a bank is optional and opt-in. If you later choose to collect rent online, you can connect a bank account from the Settings tab. This is handled entirely by Stripe, our payment processor.
• BorderBird never sees or stores your bank account number or banking login. Card and bank details are entered directly with Stripe and tokenized; we store only Stripe's identifiers, never the underlying account numbers.
• Where funds settle. For a single-owner property, funds settle directly to your own account through Stripe and never pass through a BorderBird account. For a co-ownedproperty, funds first settle to BorderBird's Stripe platform account and are then split and transferred to each owner according to their ownership share, before reaching their own account. BorderBird never holds those funds beyond that transfer step, and this online-payment feature is not yet available to any customer.

• All data is hosted in Canada on Supabase's ca-central-1 region (Montréal). Data in transit is encrypted with TLS; data at rest is encrypted with AES-256. The one exception is the optional AI features described below, which send the content being read to Anthropic for processing outside Canada.
• Account data is retained for as long as your account is active. Upon account closure, all personal data is permanently deleted within 30 days.

• Read-only by default. We look; we do not change anything.
• We make changes only when you ask us to — for example, if you would rather we corrected a record than talked you through it. We may also correct data where it is necessary to fix a fault in the service, or where the law requires it.
• Only what is needed. Access is limited to the people handling your request, and to the information relevant to it.
• Never for anything else. We do not use your account data for advertising or profiling, we do not sell it, and BorderBird does not use your financial or tenant records to train AI models.
• We may also access account data to investigate a suspected security incident, fraud, or abuse of the service.

Tenant information you enter is treated with the same care as your own. If a tenant asks what is held about them, contact us and we will help you answer.

Links to each service's own privacy policy: Supabase, Vercel, Stripe, Anthropic, Plausible.

Google sign-in (optional) is used only to authenticate your account — BorderBird does not connect to or read your Gmail inbox; payment and bill detection relies solely on the emails you forward to us.

Anthropic (AI features)— BorderBird's optional AI features send the relevant content to Anthropic's API to be read: a lease, receipt or mortgage statement you upload; an expense you describe in your own words; a maintenance issue and the appliance details recorded against it; and the questions you ask the assistant, together with the account data needed to answer them. The "smart solutions" feature also runs a web search, so the search terms — typically an appliance make and model, the nature of the fault, and the property's general location — leave Anthropic's systems. These features run only when you use them.

Apart from the subprocessors listed above, no third party has access to your personal or financial data.

BorderBird's privacy officer, accountable for compliance with PIPEDA and Quebec's Law 25, is:

{PRIVACY_OFFICER_NAME} — {PRIVACY_OFFICER_EMAIL}
Placeholder pending the founder's name/title/email for this role (audit L2, FOUNDER_QUEUE B46) — never invented. Do not treat this box as published; replace it before this page is considered complete.

• Access all data we hold about you
• Correct inaccurate data
• Request deletion of your account and all associated data
• Export your data in CSV format