User Data Policy

Managing your data yourself

From your dashboard's Profile & settings page, you can view and update your public profile details, reusable tenant defaults (used to prefill rental applications), and account preferences at any time — no request needed.

Requesting a copy of your data

You can request an export of the personal data linked to your account. We confirm it's really you by asking you to re-enter your account password before starting the export. Once ready, the export is available to download for a limited time (7 days) before the file is deleted for security.

Requesting deletion of your data

You can request deletion of your account and associated data. As with exports, we ask you to confirm your password and give a brief reason. A deletion request is reviewed before it's carried out — it isn't instant — and we'll show you what the request affects. If part of your data is under an active legal hold (for example, an open dispute, investigation, or a document-preservation obligation), that portion is retained until the hold is released, even if the rest of the request is approved.

Some records can't be deleted outright even after your account closes, because we're legally required to keep them for a defined period — see “How long we keep your data” below. Where full deletion isn't possible, we anonymize direct identifiers instead so the underlying record stops being linked to you personally.

How long we keep your data

Account and profile data: kept for 2 years after your account closes, then direct identifiers are anonymized.

Property listings: expire on the date selected by the host (90 days by default). They are removed from public view at expiry. After a 30-day renewal window, we automatically redact public listing content and remove listing-only media unless a legal hold or a booking, lease, dispute, fraud-prevention, or legal obligation requires limited retention.

Leases, reservations, invoices, and payments: kept for 7 years to meet contractual, tax, and legal record-keeping obligations, and suppressed from ordinary account access once your account is closed.

Messages and support correspondence: kept for 2 years, then deleted unless a dispute or legal hold applies.

Consent and consent-withdrawal records: kept for 7 years as an append-only history, since we need to be able to show what you agreed to and when.

Identity and ownership verification documents: kept for 90 days after a decision is made, then the documents themselves are deleted — we retain only the decision and a non-sensitive verification hash, not the document.

Data export files: automatically deleted 7 days after they're generated.

Administrative and security audit events: kept for 7 years in restricted, access-audited storage.

Your rights

As a Canadian privacy law (PIPEDA) applies to how we handle your information, you have the right to know what personal information we hold about you, to access it, and to challenge its accuracy and have it corrected. If you're not satisfied with how we've handled a request, you can also raise a complaint with the Office of the Privacy Commissioner of Canada.

Contact us

To request an export, request deletion, correct inaccurate information, or ask a question about your data, contact FlexStay support using the email address connected to your account, or via support@flexstay.ca.