Privacy Policy
Legal
Privacy Policy
Last updated: October 2026
Truelo operates in Toronto and the Greater Toronto Area, Ontario, Canada. We handle your personal information under Canadian privacy law (PIPEDA). This policy explains what we collect, why, and the choices you have.
1. Information We Collect
When you create an account we collect your name, email address, and password. If you choose to verify your identity (KYC), we also collect government-issued ID documents. Landlords who subscribe to a paid plan or boost a listing have their payment card details processed directly by Stripe — we never see or store your full card number. When you use the messaging feature, message content is stored on our servers. If you are looking for a room, you give us a renter status: your move-in date, your maximum monthly budget, roughly how long you plan to stay, and an optional short note. It is self-reported and is not verified by Truelo. A landlord sees it only inside a conversation you have started with them, where it stays up to date if you change it; it is never shown publicly or in search results. We also record when you last used Truelo, so we can ask you to re-confirm your status after a long absence. We also collect standard usage data such as IP addresses, browser type, and pages visited. When you sign up we also record how you found Truelo — for example the website or search engine that sent you, the page you first landed on, any campaign tags in the link you followed, and which blog article you read last — and keep it with your account so we can understand which content and channels bring in renters and landlords. We never use it to make decisions about you individually.
2. How We Use Your Information
We use your information to operate the platform — creating and managing accounts, reviewing listings, verifying identities, delivering messages, sending transactional emails (such as account and verification notices), and providing customer support. Rent and any deposit are arranged directly between tenant and landlord, so we do not process those payments. We identify the purpose of collection at or before the time we collect your information, and use it only for those purposes. We do not sell your personal data to third parties. We may use anonymised and aggregated data for internal analytics to improve the platform.
3. Your Privacy Rights Under Canadian Law
Truelo handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal law that governs how businesses collect, use, and disclose personal information in Ontario. You have the right to meaningful, informed consent before we collect your information, and you may withdraw consent (subject to legal and contractual limits). If you believe we have not handled your information properly, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC).
4. Payment Information
All payment processing is handled by Stripe. Truelo does not store your full card details. When you make a payment — for a subscription plan, a listing boost, or identity verification — your card information is transmitted directly to Stripe via an encrypted connection. Rent and any deposit are arranged and paid directly between tenant and landlord, off-platform; Truelo does not collect, hold, or process rent payments or landlord payout/banking details. Please refer to Stripe's Privacy Policy for details on how they handle financial data.
5. Identity Verification
Identity verification is optional, and we ask for your express consent before collecting government-issued ID. We collect only what is necessary to confirm your identity. Documents are encrypted, stored securely, and reviewed by authorised staff only. Verified status is recorded against your account; the ID documents themselves are retained only as long as necessary to complete and evidence verification, after which they are securely destroyed, except where retention is required by law.
6. Data Sharing and International Transfers
We share limited data with third-party service providers that help us operate the platform: Stripe for payment processing, our email provider (Resend) for transactional notifications, and Cloudflare R2 for secure file storage. Each is bound by data processing agreements and may not use your data for their own purposes. Some of these providers process or store data outside Canada (for example, in the United States), where it may be subject to the laws of that jurisdiction. We take steps to ensure a comparable level of protection wherever your data is processed.
7. Cookies and Analytics
We use Google Analytics to understand how visitors use truelo.co and to improve the platform. Google Analytics collects usage data such as pages visited, referring pages, approximate location derived from your IP address, device and browser type, and on-page interactions such as scrolling and outbound link clicks. This data is pseudonymous and is not linked to your Truelo account or combined with the personal information described elsewhere in this policy. Google acts as our service provider for this purpose and processes this data under its own Privacy Policy (policies.google.com/privacy). We do not enable Google Signals or use Google Analytics for advertising or cross-site tracking. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on or by adjusting your browser's cookie settings. This tracking is active only on truelo.co in production, not on our preview or development environments. We also count visits to listing pages ourselves, so landlords can see how many people viewed their listing. For this we set a first-party cookie, visitor_id, containing a random ID that is not linked to your name, email or account; it lasts up to one year and lets us recognise a returning visitor and count unique visitors accurately. Landlords see only totals, never who viewed their listing, and visits by a listing's owner or our staff are not counted. If you are signed in we count your visit against your account instead of using the cookie, and we do not set the cookie if your browser sends a Global Privacy Control or Do Not Track signal. The full list of cookies we set is on our Cookie Policy page. Separately, to record how you found Truelo (see section 1), your browser temporarily stores that source information in its local storage for up to 30 days before you sign up; once you have an account it is saved with your account record and removed from local storage. When you sign up, Google Analytics receives a "sign up" event that includes the source, campaign and article, but no account or personal details.
8. Marketing Communications
Transactional and service messages (such as account, verification, and security notices) are sent as a necessary part of providing the service. We send marketing or promotional messages only where we have your consent, in accordance with Canada's Anti-Spam Legislation (CASL). Every marketing message identifies us and includes an unsubscribe link; you can opt out at any time, and we will honour your request promptly. If you subscribe to the Truelo weekly news digest, we keep your email address, the date you confirmed, and whether you are subscribed or have unsubscribed, and use them only to send you the digest. We ask you to confirm your address by email before sending anything, and every digest includes a one-click unsubscribe link; you can also unsubscribe from the News page while signed in.
9. Data Retention
We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law — for example, financial and transaction records, which we retain for the period required by Canadian tax and financial-record rules (generally up to seven years). Sensitive identity documents are purged once they are no longer needed for verification.
10. Your Rights
You have the right to access, correct, or delete your personal data, and to request a copy of the data we hold about you. To exercise these rights, contact our Privacy Officer, Ehsan Haghighatgoo, at the address below. We will respond to all requests within 30 days.
11. Security and Breach Notification
We use security measures proportionate to the sensitivity of your data, including HTTPS encryption, HttpOnly cookies, CSRF protection, and access controls. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information against unauthorised access. If a breach of our security safeguards poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. Significant changes will be communicated to you via email or an in-app notification.
13. Contact
If you have any questions about this Privacy Policy or how we handle your data, or to reach our Privacy Officer, Ehsan Haghighatgoo, please contact us at privacy@truelo.co.