This policy explains what personal information we collect, why we collect it, who can see it, how long we keep it, and what you can ask us to do. It describes how the systemactually behaves — it is not a statement of intent.
1. Who we are
Sunlit Properties is a property management company. We provide full-cycle rental management for owners in British Columbia, Alberta and Saskatchewan, and listing, lease and maintenance services for renters.
⚠️ To be supplied: legal entity name, registered address, licensed entity and licence class. These must come from the company; this page does not infer them.
2. What we collect
What we collect depends on your relationship with us.
Public visitors
- Browsing listings and using the map requires no personal information at all.
- Saved listings live in your own browser storage and are not uploaded to us.
People who submit an enquiry
- Name, email, phone, and the message you write
- Details you choose to provide: desired move-in date, number of occupants, pets, budget range
Renters
- Name, email, phone, mailing address
- Lease, invoices, move-out and renewal requests, viewing appointments, maintenance requests including any photos and text you submit
Owners
- Name, email, phone, mailing address
- Your properties, statements, expenses and payout records
- Tax identification number, collected only where tax reporting requires it. It is stored encrypted with AES-256-GCM, and the database keepsonly the last four digits for verification. We also record whether it was provided, refused or not collected — so declining to provide it is a supported outcome.
Service providers
- Contact details, and the work orders assigned to you
3. Why we collect it
- To deliver property management services (leasing, maintenance, settlement)
- To respond to an enquiry you started
- To meet record-keeping obligations under tax and tenancy law
- For system security and an audit trail of who changed what, and when
We do not sell your personal information, and we do not use it for unrelated purposes.
4. Who can see it
Access is limited by role. This is enforced in code, not merely stated as policy:
- Renters see only their own lease, invoices and related maintenance
- Owners see only their own properties and finances within their company
- Service providers see only work orders assigned to them — nothing before assignment
- Property managers access only their own company's data
Query scope is issued by the server from your authenticated session andnever accepted from the client. A missing scope resolves to an empty set rather than granting access.
5. Where it is stored
- Business data is stored on our own servers in Canada.
- Listing photos are stored in our self-hosted object storage.
- Static pages are delivered by Cloudflare Pages, which serves the page itself and does not process your business data.
- Maps use our own basemap files — no requests are sent to any third-party map service.
- Address autocomplete queries a Canadian open address database on our own machine, which also does not leave our infrastructure.
⚠️ To be confirmed: server location and backup location, to be supplied by operations.
6. The one processing path that leaves our infrastructure
Some intelligent features (listing translation, semantic search, image and receipt recognition, statement narratives, maintenance classification) send the relevant content to anexternal AI service. This is the only path in our system that discloses content to a third party.
- It is governed by a company-level authorization. When not authorized, those tasks are skipped rather than retried.
- Features that stay on our infrastructure (maps, address autocomplete) are unaffected and send nothing out.
⚠️ To be supplied: the external AI provider's name and a link to its data processing terms.
7. How long we keep it
- Sessions: we store only a hash of the token, never the token itself. Sessions expire automatically and are revoked on password change.
- Lease and financial records: retained for the period required by tax and tenancy law.
- Audit records: retained alongside the business records they describe.
⚠️ To be confirmed: specific retention periods, determined against the rules of all three provinces and accounting requirements.
8. Your rights
- Access the personal information we hold about you
- Correct information that is inaccurate
- Withdraw consent (this may affect our ability to continue providing a service)
- Request deletion, except where the law requires us to retain a record
To exercise any of these, contact us using section 10.
9. How we protect it
- Passwords are salted and hashed (PBKDF2, 210,000 iterations) and cannot be recovered from the database
- Session tokens are stored only as hashes
- Tax numbers are encrypted with AES-256-GCM; only the last four digits are kept in clear text
- Administrative actions and their audit records are committed in the same transaction, so an action cannot take effect without leaving a trace
10. Contact us
Email: [email protected]Phone: 778-700-8908
Address: 1930 Osprey Drive, Tsawwassen, BC, V4M 4G9
11. Changes to this policy
The date at the top of this page changes whenever the policy is updated. Material changes to what we collect or why will be called out on the page.
Written by Sunlit Properties. The technical descriptions match how the system actually behaves. Items marked ⚠️ require input from the company or review by legal counsel before publication.