Privacy Policy

QAPP Property Management ("QAPP", "we", "us") provides residential property management services in Edmonton and surrounding areas. QAPP is RECA-licensed and operates under Century 21 All Stars Ltd.

This policy explains how we collect, use, disclose, and protect personal information in accordance with the Personal Information Protection Act (Alberta) ("PIPA") and, where applicable, the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA").

It works alongside the privacy policy of our brokerage, Century 21 All Stars Ltd., which is responsible under the Real Estate Act Rules for the records of our property management business.

Our online portals and this website are operated for us by PropIQ, our software service provider, which processes information only on our instructions.

Our Privacy Officer is Johnny Peng. You can reach them at qapp.edmonton@gmail.com or 780-298-8120, or by mail at QAPP Property Management, 312 Saddleback Rd, Edmonton, AB T6J 4R7. Please include "Privacy request" in the subject line.

The Privacy Officer answers questions about this policy, about access and correction requests, and about how our service providers collect, use, disclose, and store personal information, including outside Canada.

Contact and inquiry details: your name, email address, phone number, and the message you send us through our contact form, by email, or by phone.

Rental applications: the information you provide when applying for a vacancy — contact details, household and pets, current and past housing, employment and income, and references — and the documents you upload to support it, such as photo identification, pay stubs or an employment letter, bank statements, a Notice of Assessment, or proof of enrollment. We never ask for your Social Insurance Number on an application.

Credit checks: where a full credit check is needed, we use a tenant screening service (SingleKey or FrontLobby). We give the service your name and email address; the service contacts you directly and asks for your consent before it provides a credit report.

Tenancy records: once you are a tenant — your lease, rent and deposit payments and arrears, move-in and move-out inspections and photos, maintenance requests, entry notices, and messages with our team.

Property owner records: contact details, proof of ownership (such as a land title or possession letter), identification and banking details for payments to you, your service agreement, statements, and repair approvals. Owners who are not residents of Canada also give us the tax information that the Canada Revenue Agency requires; it is kept in our accounting records, not in our online portals.

Vendor records: company and contact details, work orders, quotes, and invoices.

Portal accounts: name, email address, phone number, role (tenant, owner, vendor, or staff), a securely hashed password, and two-step login settings. Passwords are never stored in readable form.

AI assistant conversations: messages exchanged with Lucy, our website and portal assistant, are kept so our team can review the service provided. Please do not enter banking details, government ID numbers, or other sensitive information into the chat.

Technical data: session information and basic security logs (such as sign-in times and actions taken in the portals) needed to keep the service secure. We do not use advertising trackers.

To respond to inquiries and to assess rental applications, including verifying identity, income, rental history, and credit.

To manage tenancies and properties: collecting and recording rent and deposits, coordinating maintenance, giving notices, communicating with tenants, owners, and vendors, paying owners, and preparing owner statements.

To meet our legal and regulatory obligations, including record-keeping under the Real Estate Act (Alberta) and its Rules, the Residential Tenancies Act (Alberta), and tax law (for example, non-resident withholding).

To keep the service secure and working properly.

Under PIPA, we collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only as much as those purposes need.

By submitting a form, applying for a vacancy, or using our portals, you consent to the collection and use described in this policy. Where the law allows or requires collection without consent (for example, information needed to manage an existing tenancy or meet regulatory obligations), we rely on those provisions.

You may withdraw consent, subject to legal or contractual restrictions, by contacting our Privacy Officer; we will explain the consequences (for example, an application cannot be assessed without the supporting information).

Our brokerage, Century 21 All Stars Ltd., which oversees our property management business and holds rent and security deposits in its trust accounts.

Property owners: we share what an owner needs to know about their own property — for example, rent status, maintenance, and a summary of an approved tenant (such as the number of occupants, pets, move-in date, and that our checks were completed). We do not give owners a tenant’s name or contact details, or a tenant an owner’s contact details, unless both agree.

Vendors: the contact details a contractor needs to arrange access for a repair.

Service providers that run our systems, listed in section 7. Each is limited to what it needs to provide its service.

Others when required or permitted by law — for example, RECA, the Canada Revenue Agency, a court or tribunal (such as the Residential Tenancy Dispute Resolution Service), or law enforcement with lawful authority.

We never sell personal information.

Our main database is stored in Canada. Some of our service providers store or process personal information outside Canada, mainly in the United States. While it is outside Canada, it may be subject to the laws of that country and accessible to its courts, law enforcement, and national security authorities.

• Supabase · Canada

  Main database and private file storage

  Account, property, tenancy, application and payment records

• Vercel · United States

  Runs this website and the portals

  Information as it passes through the website

• Anthropic · United States

  Powers Lucy, our automated assistant

  What you type into the chat

• Google (Gmail) · United States

  Our email: account and service emails, and e-transfer notifications

  Name, email address, message content and payment notifications

• Microsoft (OneDrive) · Canada (to be confirmed)

  Storage for our documents

  Leases, inspections, statements, applications and owner documents

• SingleKey or FrontLobby · Canada (to be confirmed)

  Tenant screening and credit reports

  Applicant name and email; the credit report, with the applicant’s consent

Questions about how we or our service providers collect, use, disclose, or store personal information, including outside Canada, can be sent to our Privacy Officer, Johnny Peng, at qapp.edmonton@gmail.com or 780-298-8120.

We protect personal information with safeguards suited to its sensitivity: encrypted connections, hashed passwords, two-step login for staff, individual staff accounts with access limited by role, private document storage with short-lived links, a log of sign-ins and changes, regular backups, and staff confidentiality obligations under our brokerage’s policies.

No system is perfectly secure. If a privacy breach creates a real risk of significant harm, we will report it to the Office of the Information and Privacy Commissioner of Alberta and notify affected individuals as PIPA requires.

Tenancy, property, and financial records: 7 years after the tenancy or service ends, to meet real estate and tax record-keeping rules.

Applications that do not lead to a tenancy: uploaded documents (such as identification and financial documents) are deleted after 90 days, and the remaining application details after 1 year.

For an approved tenant, the identification and credit report used in the application are kept with the tenancy file.

Inquiries and Lucy conversations: 1 year. Security logs: at least 2 years.

When the period ends, information is securely deleted. Deleted information may remain for a short time in backups until they expire.

You may ask to see the personal information we hold about you, or ask us to correct an error, by contacting our Privacy Officer. We will respond within the time PIPA allows (normally 45 days) and explain any legal reason we cannot provide particular information.

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

We will update this policy when our practices or service providers change, and show the date of the latest update at the top of this page.