Privacy

Who holds your information

Your landlord or property manager holds it. They decide what to ask for and how long to keep it. Kaza is the system they run it on. We hold the data on their behalf and do not sell it, share it between companies, or use it to train anything.

Each company on Kaza has its own separate database. One company cannot see another company’s applicants, and that is a property of how the system is built rather than a promise about how carefully it is used.

What gets collected, and when

• When you enquire: your name, email, phone, and what you asked about. If you email the leasing address, the message itself is stored so the person replying can see what you said.
• When you apply: your name, email and phone, how many people would live there, what you need (bedrooms, the most you can pay, when you can move), the homes you picked, and a piece of ID if you choose to upload one. That is the whole list. Anything you upload is stored privately and is not reachable by a public link.
• When you book a viewing, the time you chose, and the fact you turned up or did not.
• When you rent: your lease, your rent ledger and payments, deposits, repair requests and their history, and notes staff write about your tenancy.
• Always: a record of consequential actions taken on your file (who decided your application, who remitted your deposit, when a notice was served). This log cannot be edited after the fact, deliberately: it protects you as much as anyone.

Who can see it

Staff at the company you applied to, and only what their job needs. A contractor sent to fix your tap sees the address, your first name and a phone number, never your application and never any other tenancy. A building’s owner sees numbers for their own buildings and no personal details at all.

Kaza’s operators can reach a company’s data to run and repair the service, and any time that happens it is written to that company’s audit log.

Where it is stored, and who else touches it

Everything runs on Cloudflare: the databases, the uploaded documents, and the code itself. There is no third-party analytics service watching you, no advertising network, and no third-party chat widget on these pages.

Four things do leave, and they are worth naming precisely:

• The address box. Canadian street data for some provinces is held locally and nothing leaves. Where a province is not loaded, what you have typed is sent to an open mapping service (Photon, run by Komoot in Germany) to suggest an address. It is sent by our server, not your browser, and it is only ever the partial address, never your name, and never anything else on the form.
• The map. Map images come through our own address, so the map provider never sees you.
• Email we send you. A confirmation or a receipt is handed to Resend to deliver, as any email must be handed to someone. They see the address it is going to and what the message says.
• A page count, on marketing pages only. Kaza’s public pages (this one included) tell our own counting service which page was opened and which site sent you: no cookie, no name, no way to follow you afterwards. It runs on our operator’s own infrastructure, never on a landlord’s site, and never on any page where you sign in, apply or rent.

The writing assistance staff use to draft replies and listing text runs inside Cloudflare’s own network on the company’s own data. Nothing about you is sent to an outside AI service, and nothing you provide is used to train a model.

How visits are counted

When a page on a company’s site is opened, we count it for that company: which page, on which day. To tell one person opening three pages apart from three people, we keep a short code for that day, made from your connection and your browser together with a secret key that only our server holds. The code changes every day, it cannot be turned back into you, and without the key nobody can rebuild it. No cookie is set for this, no advertising company is involved, and your address is never written down. The landlord sees totals for their own site; nobody sees a person.

We also count, per company and only as a number, when things happen: a landlord opens their invitation link or signs in for the first time, adds a building, a home or a photograph, or goes live; a renter sends an enquiry, finishes an application, a lease is issued or signed, a rent payment is recorded, a repair is reported. The company sees its own numbers; the platform’s owner sees every company’s numbers side by side. None of these counts names a person, none of them leaves Cloudflare, and none of them is used for advertising.

Screening

Kaza runs no credit check and no background check, and is connected to no bureau, so nothing about you is sent to one. If a landlord screens an application, that happens away from Kaza, under their own province’s rules, and they have to ask you first. There is no step in Kaza for it.

How long it is kept

A tenancy record is kept for as long as the tenancy lasts and afterwards for as long as your province’s tenancy law requires: deposits, notices and rent history can all be needed at a tribunal years later, and a landlord who has destroyed them cannot defend you or themselves.

If your application does not become a tenancy, anything you uploaded with it, such as a piece of ID, is destroyed ninety days after you applied. Not hidden, not unlinked: deleted from the storage they were in. This happens on its own, every day, without anyone asking for it.

The application, consent and decision record are kept separately from those uploaded documents. If you believe you were turned down unfairly, the decision record is what a complaint rests on. The access and erasure choices below apply separately.

Getting a copy, or having it erased

Under Canadian privacy law (PIPEDA) you can ask what is held about you, get a copy, have a mistake corrected, and in most cases have it erased. These are buttons in this product, not a request someone has to get around to:

• A copy of everything on your application, the link in your application email opens your file and will download it as a data file.
• Erasure: the same page will delete uploaded application files and anonymize personal details it can remove. What must be kept, such as a remitted deposit or served notice, survives, and you are told what survived and why.
• A Kaza account for saving homes is smaller and entirely yours: an email, the homes you saved and any town alerts. Your account page downloads all of it, and deletes all of it. Nothing is kept: there is no tribunal that ever needs to know a stranger bookmarked a flat.

If a company will not answer you, the Office of the Privacy Commissioner of Canada takes complaints.

If something goes wrong

If information is lost or taken in a way that creates a real risk of significant harm, the affected people and the Privacy Commissioner are told. That is the law, and it is also simply what should happen.

Asking us something

Start with the company you applied to; they hold your file and can act on it directly. For anything about Kaza itself, write to info@3d3d.ca.

Kaza is made and operated by Randall Marshall, trading as 3D3D, at 421 Rte 105, Maugerville, NB E3A 8N3, Canada. That is who is accountable for everything on this page.

See also the terms of use.