Privacy Policy
1. Who we are
Bankable Technologies Inc. ("Bankable", "we", "us") provides real-estate underwriting and deal-modelling software. We are based in Toronto, Ontario, Canada.
Privacy Officer: privacy@bankable.properties
Mailing address: 5048 Dundas St. W, Etobicoke, ON M9A 1B9, Canada
We are accountable for the personal information under our control, as required by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), by Quebec's private-sector privacy legislation as amended by Law 25, and, where applicable, by the EU and UK General Data Protection Regulation.
2. Our approach in one paragraph
We collect the least personal information we need to run the Service, we tell you why before we collect it, we do not sell it, we do not use your deal data to train AI models, we keep it only as long as we need it, and we protect it. If you want to know what we hold about you, ask us and we will tell you.
3. Two different roles
We are accountable (a "controller") for: your account and profile information, your billing records, your usage and security logs, your support correspondence, and our marketing contacts. This Policy describes that information.
We act on our customer's behalf (a "processor") for: the deal data, property information, assumptions, documents and any third-party personal information that a customer enters into the Service. Where you are an individual whose information a customer has entered into Bankable, that customer is accountable for it, and you should direct your request to them. We will assist them and will forward any request we receive. Our processing in that role is governed by our agreement with that customer and, for business customers, by our Data Processing Addendum, available on request from privacy@bankable.properties.
One account across our applications. Your Bankable ID is account information under our control. All Bankable applications are operated by Bankable Technologies Inc.; using Bankable ID with several of them does not pass your information to another company.
Deal Files and the shared CRM. Deal Files (copies of your saved proformas kept in Bankable Core) and the contacts, notes and pipeline in a shared CRM workspace are Customer Data, which we process on our customer's behalf. For a CRM workspace, the customer accountable for the contact information is the workspace owner: the team owner for a team workspace, or the individual for a personal workspace. If you are a contact recorded in someone's CRM, please direct your request to that person or organization; we will forward any request we receive and help them respond.
4. What we collect and why
| Category | Examples | Why we collect it | Lawful basis / GDPR |
|---|---|---|---|
| Account information | Email address, name and organization if you give them, plan and role, one-time sign-in codes (kept only as a keyed hash for 10 minutes), and the account identifier from Apple, Google or Microsoft if you sign in with one of them | To create and secure your account, verify your email, authenticate you, and provide the Service | Performance of a contract; consent |
| Bankable ID | Your Bankable ID number, verified email address, name and language if you give them, the Apple, Google or Microsoft account identifier if you sign in with one, which Bankable applications are linked to it, each application's plan (tier, source, end date), sessions and sign-in security events | To sign you in once across Bankable applications, recognize the plan you hold in each, end sessions everywhere on request, and secure the account | Performance of a contract; legitimate interests |
| Profile and preferences | Display name, default model assumptions, display settings | To operate and personalize the Service | Performance of a contract |
| Subscription and billing | Plan, tier, billing contact, billing address, tax status, transaction history, partial card details and payment token held by our processor | To charge you, issue invoices, collect tax, and keep required financial records | Performance of a contract; legal obligation |
| Customer Data you enter | Property addresses, rent rolls, financial assumptions, expense figures, investor and tenancy details, uploaded documents, the Deal Files created from your proformas, and the contacts, notes and pipeline stages you record in a CRM workspace | To provide the modelling functionality you are paying for. We do not review, analyse, mine, sell, or use this content for our own purposes | Performance of a contract; we act as processor |
| Service logs | Requests to our servers, the features they call, errors and timing | To operate, debug and secure the Service. On our public website only, and only with your consent, we use Google Analytics, Google Ads, the Meta Pixel and the LinkedIn Insight Tag to measure our marketing and to show our ads to people who visited. We do not use session-recording tools, and none of these tools are used inside the Bankable apps (see our Cookie Notice) | Legitimate interests |
| Assistant conversations | Questions you type into the Bankable assistant; your email and message if you ask to reach a person | To answer your question and, if you ask, to pass the conversation to our team | Legitimate interests; consent for the hand-off |
| Device and technical data | IP address, browser type and version, operating system, device type, screen size, language, crash and error diagnostics | To deliver the Service, maintain security, prevent fraud and abuse, and diagnose faults | Legitimate interests; legal obligation |
| Support and correspondence | Emails, support tickets, chat messages, and their contents | To answer you and to keep a record of the issue and its resolution | Performance of a contract; legitimate interests |
| Marketing information | Email address, name, company, role, campaign and engagement data, source of consent | To send you information about Bankable that you have consented to receive | Consent (express or implied, as required by CASL); legitimate interests |
| Security and audit logs | Sign-in attempts, IP addresses, administrative actions, access records | To protect accounts and investigate incidents | Legitimate interests; legal obligation |
We do not knowingly collect, and you must not submit, sensitive information the Service is not designed to handle — including social insurance or government identification numbers, full payment card numbers, banking credentials, health information, biometric data, or information about children. See the Acceptable Use Policy.
Children. The Service is for business use by adults. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.
5. How we use personal information
We use personal information to: create and administer accounts; authenticate users and send verification codes; provide, maintain and support the Service; process payments and issue invoices; communicate with you about your account, security, changes to the Service and to these terms; provide customer support; monitor and improve performance, reliability and usability; develop new features; detect, prevent and investigate fraud, abuse and security incidents; enforce our terms; comply with legal, tax and accounting obligations; and, with your consent, send you marketing communications.
We will not use your personal information for a new purpose that is materially different from those described here without first telling you and, where the law requires it, obtaining your consent.
6. Automated processing and AI
6.1 We do not make decisions about you by automated means that produce legal effects or otherwise significantly affect you.
6.2 The Service performs financial calculations on the assumptions you enter. Those calculations are deterministic arithmetic, not automated decision-making about a person, and they do not evaluate, score, or profile any individual.
6.3 We do not use Customer Data, including your deal data, models, assumptions or uploaded documents, to train, fine-tune or evaluate any machine-learning or artificial-intelligence model. Where we use aggregated statistical information to improve the Service, it is irreversibly de-identified and cannot be attributed to you, to any individual, to any property, or to any transaction.
6.4 The Bankable assistant. Our website and app include an assistant that answers questions about plans, billing and how the models work. It does not see your saved deals. The messages you type are sent to an AI model run by our hosting provider, Cloudflare (Workers AI), to generate the answer. We do not keep chat messages unless you ask to be put in touch with a person; then the conversation and the email you give are sent to our team and kept for 90 days. Please do not type personal information about other people into the assistant.
6.5 If we introduce any other feature that uses artificial intelligence to process your content, we will describe it in this Policy before doing so, explain the provider involved, and where required obtain your consent.
7. When we share personal information
We share personal information only as described here. We do not sell personal information. With your consent, information about your visits to our public website collected by the tools described in our Cookie Notice is shared with Google, Meta and LinkedIn to measure and target our advertising; you can withdraw consent at any time.
- Service providers and subprocessors who process information on our behalf under contract, only for the purposes we specify, and subject to confidentiality and security obligations. Our current providers are: Cloudflare (hosting, data storage, backups, security, the assistant's AI model and cookieless Web Analytics page statistics; global network, United States); Stripe (payments, subscriptions and invoices; Canada and United States); Resend (transactional email such as sign-in codes; United States); Microsoft (business email and documents, and optional sign-in; Canada and United States); HubSpot (customer relationship management and marketing email you have agreed to receive; United States); Apple and Google (optional sign-in, and the App Store for purchases made there); Fontshare (Indian Type Foundry; the web font loaded by your browser on our website and web app, which receives your IP address and browser details; India and its content-delivery network); and, only with your consent on our public website, Google, Meta and LinkedIn (website measurement and advertising; United States and other countries). We will update this list before adding a provider.
- Between Bankable applications. When you use Bankable ID, the applications you use can see your Bankable ID, your verified email address and the plan you hold in each application, so they can sign you in and give you the right access. Deal Files are visible to another person only when their owner shares them. Seats on a team see the team's CRM workspace and team-library Deal Files while they hold a seat.
- Your organization. If you use Bankable under an account administered by your employer or client, that organization's administrators may access your account information and the Customer Data in the account.
- Professional advisors — our lawyers, accountants and auditors — where necessary and under a duty of confidence.
- Legal and regulatory. Where required by law, subpoena, warrant, court order, or other lawful requirement; to establish, exercise or defend legal claims; to enforce our terms; or where we reasonably believe disclosure is necessary to prevent fraud, to protect the security of the Service, or to protect the rights, safety or property of any person. We assess each request, disclose only the minimum required, and where lawful and reasonable notify the affected individual.
- Business transaction. In connection with a financing, merger, acquisition, reorganization or sale of assets, subject to appropriate confidentiality protections, and — as PIPEDA requires — only the information necessary for the parties to determine whether to proceed and to carry out the transaction. If a transaction completes, the acquirer will be bound to use the information for the purposes for which it was collected.
- With your consent in any other case.
8. Where information is processed, and cross-border transfers
8.1 We are based in Canada. Personal information may be processed in Canada, the United States, and the other countries where our providers operate (Cloudflare serves each request from the data centre nearest you) by us and our service providers.
8.2 When information is processed in another country, it may be accessible to the courts, law enforcement and national security authorities of that country under that country's laws.
8.3 We use contractual and technical measures to require our service providers to protect personal information to a standard comparable to that required by Canadian law, and we assess each provider before engaging it.
8.4 Quebec. Where we handle the personal information of individuals in Quebec, we conduct the privacy impact assessment that Law 25 requires before personal information is communicated outside Quebec, and we implement the measures identified as necessary.
8.5 EU and UK. Where the GDPR or UK GDPR applies, transfers out of the European Economic Area or the United Kingdom are made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, and with any supplementary measures needed.
9. How long we keep information
| Information | Retention |
|---|---|
| Account and profile | For the life of the account, then 90 days after closure |
| Customer Data | For the subscription term; available for export for 30 days after termination; deleted or irreversibly de-identified within 90 days |
| Trial data (no paid subscription) | 30 days after the trial ends |
| Billing and tax records | 7 years (Canadian tax law requires at least 6) |
| Support correspondence | 24 months |
| Security and access logs | 13 months (400 days) |
| Assistant hand-off conversations | 90 days |
| Marketing contacts and consent records | Until consent is withdrawn, and consent records for 3 years after that, to demonstrate compliance |
| Backups | Encrypted, on a rolling cycle not exceeding 35 days |
| Bankable ID | For the life of the account. When it is deleted, we keep only its number, the fact that it was deleted, and the date — no email address |
| Deal Files | For the life of the owner's account. Deleted or archived Deal Files can be restored for 90 days, then are permanently deleted. Deleting your account deletes the Deal Files you own |
| CRM workspace | For the life of the workspace; deleted with the workspace owner's account unless ownership has moved to another seat |
We may retain information longer where required by law or where necessary to establish or defend a legal claim.
10. Your rights
Subject to legal limits, you may:
- Access the personal information we hold about you, and be told how it is used and to whom it has been disclosed;
- Correct information that is inaccurate or incomplete;
- Withdraw consent, at any time, subject to legal and contractual restrictions — noting that some withdrawals will mean we can no longer provide the Service;
- Delete your information, where we are not required to retain it;
- Port your information, receiving it in a structured, commonly used technological format where the law provides that right;
- Object to or restrict processing based on legitimate interests, and opt out of non-essential analytics;
- Unsubscribe from marketing at any time, using the link in every message or by emailing us;
- De-index — request that a hyperlink to information about you be de-indexed or ceased to be disseminated, where the law provides that right;
- Be informed about automated processing, and where applicable request human review;
- Complain to us, and to a regulator.
How to exercise a right: email privacy@bankable.properties with enough detail for us to locate the information. We may ask you to verify your identity, and we will not use that verification information for any other purpose. We respond within 30 days and will tell you if we need more time or if we are refusing a request, with our reasons and information about how to challenge our decision. There is no charge, unless a request is manifestly excessive, in which case we will give you a cost estimate first and proceed only if you confirm.
One request covers every Bankable application: we answer access, correction and deletion requests for your Bankable ID and for each application linked to it. If you are a contact recorded in someone's CRM workspace, the workspace owner is accountable for your information; we will forward your request and help them respond.
If you are an individual whose information a Bankable customer entered into the Service, please contact that customer, who is accountable for it. We will forward any request we receive and assist the customer in responding.
11. Security
We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, role-based access on least privilege, mandatory multi-factor authentication for administrative access, logging and monitoring, secure development practices, vulnerability management, backups, personnel confidentiality obligations and training, and an incident response plan. Our current measures are described in Annex 2 to our Data Processing Addendum, available to business customers on request.
No safeguard is perfect. Because sign-in codes are sent to your email, please keep that email account secure with a strong password and multi-factor authentication, and tell us immediately at privacy@bankable.properties if you believe your account has been compromised.
If a breach of security safeguards occurs that creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada and notify you as soon as feasible, as PIPEDA requires (OPC guidance, PIPEDA s. 10.1), and we will meet any equivalent obligation under Quebec or other applicable law.
12. Cookies and tracking
We use cookies and similar technologies. See our Cookie and Tracking Technologies Notice for what we use, why, and how to control it. We obtain consent before setting non-essential cookies where the law requires it.
13. Marketing communications
We send commercial electronic messages only where we have your express or implied consent, as required by Canada's anti-spam legislation. Every message identifies us, gives our contact information, and contains a working unsubscribe mechanism that we action within 10 business days and in practice immediately (CRTC). Transactional and service messages — verification codes, receipts, security alerts, and notices about changes to the Service or these terms — are not marketing and are sent as part of providing the Service.
14. Third-party sites
The Service may link to third-party websites and services. We are not responsible for their privacy practices. Review their policies before providing information to them.
15. Changes to this Policy
We may update this Policy. We will post the updated version with a new "last updated" date. If a change is material, we will notify you by email and by a notice in the Service at least 30 days before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated Policy, except where the law requires fresh consent, in which case we will ask for it.
16. How to reach us, and how to complain
Privacy Officer: Bankable Technologies Inc., 5048 Dundas St. W, Etobicoke, ON M9A 1B9, Canada. privacy@bankable.properties
Please raise any concern with us first — we will investigate and respond within 30 days. If you are not satisfied, you may complain to:
- the Office of the Privacy Commissioner of Canada, priv.gc.ca;
- the Commission d'accès à l'information du Québec, if you are in Quebec;
- the Information and Privacy Commissioner of Alberta or British Columbia, if applicable; or
- your EU or UK supervisory authority, if the GDPR or UK GDPR applies to you.
17. Language
This Policy is available in English and in French. Both versions are equally authoritative.