This policy explains what personal information AedoBuild collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to anyone who uses aedobuild.com, our condo management platform, or any related service.
1. Who we are
AedoBuild Inc. ("AedoBuild", "we", "us") is a Canadian corporation registered in Ontario. We provide condo and property management software to condominium boards, strata corporations, property managers, and the residents who live in those buildings. In privacy law terms, our role depends on who you are:
- If you're a condo board or property manager using AedoBuild for your building, we're a service provider / data processor. You decide what data goes into the platform.
- If you're a resident, your condo board controls the data about you. We process it on their behalf. Direct privacy requests to your board first; we'll support them in handling it.
- If you visit aedobuild.com directly (marketing site, signup, support), we're the controller of that data.
2. Information we collect
2.1 Account & profile
- Name, email address, phone number (if you choose to provide)
- Password (stored as a bcrypt hash — we never see the plaintext)
- MFA secret (if you enable two-factor authentication)
- Building, unit number, role (owner / tenant / board member / property manager)
- Profile photo (optional)
2.2 Use of the service
- Maintenance tickets you create, including descriptions and uploaded photos
- Payment records (amounts, dates, invoice references — card numbers are never on our servers, see Section 3)
- Announcement reads, amenity bookings, document downloads, message threads
- Vendor records, board meeting minutes, voting records (when used)
2.3 Technical & security
- IP address, browser type, device type, operating system
- Pages visited, timestamps, referring URL
- Session cookies (see Section 7)
- Audit log of sensitive actions (logins, role changes, exports)
3. Third parties who process your data on our behalf
AedoBuild runs on infrastructure provided by other companies (subprocessors). They process your data only to deliver our service. Current subprocessors:
- Neon (Database) — PostgreSQL database hosting. Stores all your account, building, ticket, and payment data. AWS us-east-1, Virginia, USA.
- Vercel (Hosting) — Web hosting and serverless functions. Receives every request to our site. AWS us-east-1 primary, global edge cache.
- Stripe (Payments) — Processes credit card and ACH payments. Card numbers and bank account details are entered directly into Stripe's iframe and never touch our servers. USA + Ireland.
- Resend (Outbound Email) — Sends transactional emails (ticket updates, invoices, password resets). USA.
- Cloudflare (DNS, CDN, Email Routing) — DNS, edge security, inbound email forwarding. Global infrastructure.
- Anthropic (AI features) — Powers AI ticket categorization, document Q&A, and announcement drafting. USA. Anthropic does not train models on API data by default.
- Sentry (Error monitoring, when enabled) — Captures unhandled errors and stack traces. May incidentally include user identifiers. USA.
- Twilio (Emergency SMS, when enabled) — Sends emergency SMS broadcasts to residents. USA.
We do not sell your personal information. We do not share data with advertising networks. We do not use your data to train third-party AI models.
4. International data transfers (US storage notice)
Most of your data is stored on servers in the United States. Specifically, our database (Neon) and primary hosting (Vercel) run in AWS us-east-1, Virginia, USA. This means:
- Your data may be subject to US laws, including the CLOUD Act, FISA, and other government access regimes.
- US authorities may, in some circumstances and with court orders, request access to data stored on US infrastructure.
- Our subprocessors maintain commercially recognized security certifications (e.g., SOC 2, ISO 27001, PCI-DSS for Stripe).
- For EU residents, we rely on Standard Contractual Clauses (SCCs) where applicable to ensure transfers are lawful under GDPR.
If your organization requires Canadian data residency (no data leaving Canada), please contact sales@aedobuild.com. We can discuss Canadian-region options on Enterprise plans.
5. Why we process your data (lawful basis)
- Contract performance — to give you the service you (or your condo board) signed up for. Covers most use of the platform.
- Legitimate interest — to keep the service secure, prevent abuse, debug errors, and improve features. We balance these interests against your privacy.
- Legal obligation — to comply with Canadian tax law, anti-money-laundering rules, court orders, and similar.
- Consent — for optional features (e.g., enabling AI features on your documents, enrolling in auto-pay). You can withdraw consent anytime; see Section 9.
6. How long we keep your data (retention)
- Active account data — kept while your account or building's subscription is active.
- After account cancellation — kept for 30 days in case you want to reactivate, then permanently deleted from our active database.
- Backups — encrypted backups roll off our backup system within 90 days.
- Financial records (invoices, payment receipts) — retained for 7 years after the transaction to comply with Canadian tax and audit requirements.
- Audit logs — security-relevant audit logs retained for the lifetime of the account, then deleted with the account.
- Legal holds — if a court order or active legal claim requires it, we may retain data longer than the periods above until the matter is resolved.
7. Cookies
- Session cookie (essential) — a single secure, HTTP-only JWT cookie keeps you logged in. Cannot be disabled while using the platform. Cleared when you log out or when the session expires.
- Preferences (optional) — localStorage entries for things like sidebar collapsed state. Local to your browser, never sent to our servers.
- No third-party tracking — we do not use Google Analytics, Facebook Pixel, Hotjar, or any advertising/tracking cookies on the application. Marketing pages may use privacy-friendly aggregate analytics in the future; this policy will be updated if so.
8. Children's data
AedoBuild is intended for use by adults responsible for condo management. We do not knowingly collect personal information from anyone under 14.
However, residents listed in a building (e.g., dependents in a unit's household member list) may include minors. In those cases:
- The condo board / property manager is responsible for obtaining any necessary parental consent and for the lawfulness of including a minor's information.
- We do not market to minors and do not create separate accounts for them under the age of 14.
- A parent or guardian can request removal of a minor's data by emailing privacy@aedobuild.com.
9. Your rights and how to exercise them
Depending on where you live (Canada — PIPEDA, EU — GDPR, California — CCPA, etc.), you have the right to:
- Access — request a copy of personal data we hold about you
- Correct — fix inaccurate or incomplete data
- Delete — request erasure of your data ("right to be forgotten")
- Export (portability) — receive your data in a machine-readable format
- Restrict — limit how we process your data
- Object — object to processing based on legitimate interest
- Withdraw consent — for any processing based on your consent
To exercise any of these rights: Email privacy@aedobuild.com with your request and the email address tied to your account. We will:
- Acknowledge your request within 5 business days
- Verify your identity (usually by confirming via your account email)
- Fulfill the request within 30 days (60 days if complex)
- Tell you in writing if we can't fulfill it and why
Withdrawing consent or requesting deletion may mean we can no longer provide certain features — we'll explain the trade-off before acting.
10. Security
We use industry-standard technical and organizational measures to protect your data: encryption in transit (TLS 1.2+), encryption at rest (database and backups), bcrypt password hashing, mandatory MFA for sensitive admin roles, role-based access control, rate limiting, and audit logging. No system is perfectly secure; if we ever experience a breach involving your personal data, we'll notify affected users and applicable regulators within the timelines required by law (e.g., PIPEDA's "real risk of significant harm" threshold).
11. Privacy Officer
Under PIPEDA, AedoBuild has designated a Privacy Officer responsible for compliance with this policy and Canadian privacy law. The Privacy Officer can be reached at:
Privacy Officer, AedoBuild
Email: privacy@aedobuild.com
Postal: address available on request
12. Filing a complaint
If you believe we've mishandled your personal data, please contact us first — we want to fix it. You also have the right to lodge a complaint with the relevant supervisory authority:
- Canada — Office of the Privacy Commissioner of Canada (priv.gc.ca)
- Ontario residents — Information and Privacy Commissioner of Ontario (ipc.on.ca)
- EU/EEA — your national data protection authority
- California — California Attorney General (oag.ca.gov)
13. Changes to this policy
We'll post any material changes here and update the "Last updated" date at the top. For significant changes that affect how we use your data, we'll email account admins before the change takes effect.
14. Contact
Questions about this policy or how we handle data? privacy@aedobuild.com.