Privacy Policy

Effective date: March 20, 2026  ·  Last updated: April 6, 2026

Vonulo ("we", "our", or "us") operates vonulo.com, a student housing platform connecting students with off-campus housing near Canadian campuses. We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable British Columbia privacy law.

By using Vonulo, you consent to the collection, use, and disclosure of your personal information as described in this policy.

1. Information We Collect

We collect personal information you provide directly, including:

• Account information: Email address, name, and password (stored encrypted via Supabase Auth).
• Profile information: University affiliation, housing preferences, roommate preferences, and profile details you choose to share.
• Listing information: Property address, photos, rental price, and lease terms submitted by landlords or subletters. In some cases, we may create listings on behalf of landlords who provide this information to us directly.
• Lease information: If you use our optional digital lease tools, the lease terms and digital signatures you provide.
• Communications: Messages sent between users through our platform, tour requests, and inquiries.
• Payment information: Security deposit transactions processed through Stripe, Inc. We do not store full card numbers — payment data is handled by Stripe under their privacy policy.
• Usage data: Pages visited, features used, listing views, search queries, and general activity on the platform.

2. How We Use Your Information

We use your personal information to:

• Create and manage your account and provide platform features.
• Facilitate connections between students and landlords or subletters.
• Process security deposits and send payment confirmations.
• Send platform notifications (tour approvals, new messages, listing alerts) via email.
• Verify student status using your university email domain (supported universities get a Verified Student badge).
• Improve and maintain the platform, including analytics on platform usage.
• Prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations.

We do not sell your personal information to third parties.

3. How We Share Your Information

We share personal information only in limited circumstances:

• Between users: When you make an inquiry or tour request, your name and email are shared with the relevant landlord or subletter. Listing details and contact information are shared with inquiring students.
• Service providers: We use the following third-party services to operate the platform:

• Legal requirements: We may disclose information if required by law, subpoena, or court order, or to protect the rights, safety, or property of Vonulo or its users.

4. Cross-Border Data Transfers

Your personal information may be transferred to and processed in the United States by our service providers listed above. By using Vonulo, you consent to this transfer. We ensure our service providers maintain appropriate safeguards consistent with PIPEDA requirements for the protection of your personal information.

5. Data Retention

We retain your personal information according to the following schedule:

• Active accounts: Data is retained for as long as your account is active.
• Closed accounts: Personal data is deleted within 30 days of account closure.
• Financial records: Transaction records are retained for 7 years as required by Canadian tax law.
• Communications: Messages between users are deleted when both parties have closed their accounts.
• Listing data: Listings are removed when the landlord or subletter deactivates them or closes their account.
• Aggregated data: Anonymised or aggregated data (which cannot identify you) may be retained indefinitely for analytics.

6. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encrypted data transmission (TLS/HTTPS) for all platform traffic.
• Row-level security (RLS) on all database tables, ensuring users can only access their own data.
• Authentication via Supabase Auth with secure session tokens.
• Access controls limiting who can view your data.
• Regular security reviews of platform code and infrastructure.

No method of transmission over the internet is 100% secure. If you become aware of any security concern, please contact us immediately.

7. Data Breach Notification

In accordance with PIPEDA's mandatory breach notification requirements, if we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will:

• Notify you as soon as feasible, describing the nature of the breach and the information involved.
• Report the breach to the Office of the Privacy Commissioner of Canada.
• Notify any other organization or government institution that may be able to reduce the risk of harm.
• Keep records of all breaches for a minimum of 24 months.

8. Your Rights (PIPEDA)

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Withdrawal of consent: Withdraw consent to certain uses of your data, subject to legal or contractual restrictions. Note that withdrawing consent may limit your ability to use the platform.
• Deletion: Request deletion of your account and associated personal data.
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

9. Cookies and Tracking

We use browser localStorage to store session tokens and user preferences (e.g., saved listings, campus selection). We do not use advertising cookies or third-party tracking pixels. Our platform loads fonts from Google Fonts and maps from Leaflet/OpenStreetMap, which may set their own cookies subject to their respective privacy policies.

If we introduce analytics or advertising tools in the future, we will update this policy and notify users before collecting any new data.

10. Children's Privacy

Our platform is intended for users aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us personal information, contact us immediately and we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users by email of any material changes and update the effective date above. Continued use of the platform after changes constitutes acceptance of the revised policy.