Privacy Policy

Effective: September 1st, 2026 · Last updated: September 19th, 2026 · Applies to nestio.ca and the Nestio.ca platform.

1. Who we are

Nestio.ca is property management software operated by Nestio Inc ("Nestio.ca", "we", "us"), registered at 7849 Erasmus Wynd NW, Edmonton, Alberta, Canada, T6M 0S3. This policy explains how we handle personal information in connection with our website and the Nestio.ca platform (together, the "Service").

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Two different roles we play

This distinction matters, because it determines who you should contact about your information.

• As a service provider to our customers. Our customers are property managers, landlords, condominium corporations and similar organizations. When they use Nestio.ca to manage their properties, they upload information about residents, applicants, owners and vendors. That information belongs to the customer. We process it on their instructions, under our agreement with them, and we do not use it for our own purposes.
• For our own account holders and website visitors. When you create an account, subscribe, contact us or browse nestio.ca, we handle that information for our own purposes as described below.

If you are a resident, applicant, owner or vendor and want to access or correct your information, contact the property manager or landlord you deal with. They control that information; we act on their behalf. If you contact us directly, we will refer you to them.

3. Information we collect

Information you give us

• Account information — name, work email, phone number, company name, job role and password credentials.
• Billing information — subscription plan, unit counts, billing address and tax details. Card numbers are handled by our payment processor and are not stored on our systems.
• Enquiries — the contents of demo requests, contact forms and support correspondence, including portfolio size and province.

Information our customers upload

• Resident and applicant records — names, contact details, lease terms, tenancy history, payment records, maintenance requests and related correspondence.
• Financial records — ledgers, invoices, rent payments, owner distributions and tax data.
• Documents — leases, notices, signed agreements, photographs attached to maintenance requests, and other files uploaded to the platform.

Information collected automatically

• Technical data — IP address, browser and device type, pages viewed, and timestamps.
• Security and audit logs — sign-in events, administrative actions and changes to records, retained so account activity can be traced.
• Cookies — see section 10.

4. How we use information

• To provide, operate, secure and support the Service.
• To authenticate users and maintain audit trails.
• To process subscription payments and issue invoices.
• To send service communications — invitations, password resets, notifications and notices about changes to the Service.
• To respond to enquiries and provide customer support.
• To diagnose faults, monitor performance and improve the Service.
• To detect and prevent fraud, abuse and unauthorized access.
• To meet legal, regulatory, tax and audit obligations.

We do not sell personal information. We do not use our customers' resident or financial data to train general-purpose artificial intelligence models.

5. Where your information is stored

The Nestio.ca platform is hosted on Amazon Web Services infrastructure located in the United States (the us-east-1 region, Northern Virginia). Application servers, the platform database and uploaded files are stored there. Some of the third-party services listed in section 6 also process information outside Canada.

This means personal information you or your organization provides is stored and processed outside Canada. While it is held in the United States, it is subject to the laws of that country, and United States courts, law enforcement and regulatory authorities may in some circumstances be entitled to obtain access to it under United States law, including through orders that do not require notice to you.

We remain accountable for personal information transferred to service providers for processing, and we use contractual and security measures intended to provide a comparable level of protection to that required under Canadian law. If you have questions about cross-border storage, contact us at support@nestio.ca.

6. Service providers

We use the following third parties to operate the Service. They receive only the information needed to perform their function, and are bound to protect it.

• Amazon Web Services — hosting and infrastructure (United States).
• Stripe — subscription billing and payment processing, where payment processing is enabled for your organization.
• Twilio SendGrid — delivery of transactional email.
• DocuSign — electronic signature of leases and related documents.
• Intuit QuickBooks and Xero — accounting integrations, where a customer connects one.
• OpenAI — processing of the specific content submitted to an AI feature, as described in section 7.

We may also disclose information where required by law, to enforce our agreements, to protect the rights or safety of any person, or in connection with a corporate transaction such as a merger or sale of assets (in which case we will require the recipient to honour this policy).

7. AI features

The Service includes AI features that draft replies, categorize maintenance requests, and surface provincial compliance information. When one of these features runs, the relevant content is sent to a third-party AI provider for processing and a result is returned.

• A person remains in the loop on decisions that bind a lease or move money — AI output is a draft or a suggestion, not an action taken on its own.
• We do not permit our AI providers to use customer content to train their general-purpose models.
• AI output can be wrong. It is not legal, accounting or tax advice, and it should be reviewed before it is relied on.

8. Security

We use technical and organizational measures appropriate to the sensitivity of the information, including encryption in transit (HTTPS/TLS), role-based access controls, per-organization data separation, password hashing, audit logging and restricted administrative access.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.

9. How long we keep information

We keep account and billing records for as long as the account is active and afterwards as needed to meet legal, tax and audit obligations. Customer data uploaded to the platform is retained for the term of the customer's subscription; after termination it is deleted or returned in accordance with our agreement with that customer. Security and audit logs are kept for a limited period for investigation purposes.

10. Cookies

We use cookies that are necessary for the Service to function — keeping you signed in, maintaining your session and protecting against cross-site request forgery. Session cookies are set as HttpOnly and Secure. We also use limited analytics to understand how the website is used. Most browsers let you block or delete cookies, but blocking necessary cookies will prevent you from signing in.

11. Your rights

Subject to legal exceptions, you may:

• ask whether we hold personal information about you, and request access to it;
• request correction of information that is inaccurate or incomplete;
• withdraw consent to a use or disclosure, subject to legal and contractual restrictions and reasonable notice;
• request deletion of information we are not required to retain; and
• ask questions or make a complaint about how we handle personal information.

Write to us at support@nestio.ca. We will respond within the time limits set by PIPEDA, normally 30 days. We may ask you to verify your identity first. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

Again — if the information relates to a tenancy and you are a resident, applicant, owner or vendor, please contact the property manager or landlord you deal with.

12. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect personal information directly from children. Information about minor occupants may appear in a customer's tenancy records; that information is controlled by the customer.

13. Changes to this policy

We may update this policy from time to time. We will change the "last updated" date above, and for material changes we will give notice through the Service or by email before the change takes effect.

14. Contact us

Questions, access requests and privacy complaints can be sent to our Privacy Officer at support@nestio.ca, or by mail to Nestio Inc, 7849 Erasmus Wynd NW, Edmonton, Alberta, Canada, T6M 0S3.