Legal

Privacy Policy

Last updated: April 21, 2026 · Questions: privacy@brikli.com

Scope

This Policy explains how we collect, use, disclose, and protect Personal Information when you visit our sites, create an account, or use our Services. It covers all regions where we operate, with specific notices for PIPEDA/Québec Law 25, GDPR/UK GDPR, and CCPA/CPRA. Brikli complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Law 25, and other applicable privacy laws.

What We Collect

Account and Profile
Name, email, phone, role, company, login identifiers.

Property and Tenancy Data
Tenant/landlord names, contact details, leases, unit addresses, rent amounts, payment history, maintenance requests, documents, communications.

Payment and Billing
Subscription details and tokens processed securely by our payment processor. We do not store full card numbers.

Files and Content
Receipts, invoices, leases, images, and documents uploaded to our secure cloud provider.

Usage and Device Data
Log files, IP, browser/device type, pages viewed, referring URLs, approximate location.

Integration Data
Data exchanged with integrations you enable via an integration provider, if configured by you.

AI Processing Inputs
Text, images, and documents you submit for AI parsing or summarization, processed via third-party AI service providers.

How We Use Information

Provide and operate the Services; authenticate users; process payments; maintain security.
Parse documents, generate summaries, and automate workflows (Contract/Legitimate Interests), with your configuration choices.
Customer support, service announcements, account communications (Legitimate Interests/Contract).
Improve Services, develop new features, analytics and quality assurance (Legitimate Interests). We use aggregated/anonymized data where feasible.
Legal compliance, fraud prevention, and enforcing terms (Legal Obligation/Legitimate Interests).
Where consent is required (e.g., certain marketing, cookies, or processing minors' data), we will seek opt-in consent.

Sharing and Disclosures

We share Personal Information with carefully selected service providers and sub-processors under contracts requiring confidentiality and security; with integrations you enable through an integration provider under their own terms; with our Payment Processor; with professional advisors; and with authorities when required by law.

We do not sell Personal Information.

Information Security

We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards to protect against unauthorized access, use, modification, and personal data disclosure in its control and custody.

No system is perfectly secure. We encourage strong passwords and multi-factor authentication.

International Transfers

We may process data outside Québec/Canada (e.g., U.S., EU). For EU/UK data, we rely on SCCs/UK Addendum. For Québec Law 25, we assess the adequacy of protections and adopt additional safeguards.

Retention

We keep Personal Information for as long as necessary to provide the Services and meet legal/contractual obligations. After account closure, we delete or anonymize within 90 days unless a longer period is required for disputes, auditing, or legal compliance.

Your Rights

Depending on your region, you may have rights to access, correct, delete, restrict, port, or object to processing. We respond to privacy rights requests within 30 days, or as otherwise required by applicable law. Québec residents may request de-indexing and portability under Law 25. EU/UK residents may lodge a complaint with their data protection authority.

Submit Rights Requests: privacy@brikli.com

Children and Minors

Our Services are not directed to children under 14. If you manage student housing, you must obtain required parental consent before entering a minor's data and configure role-based access appropriately. Contact us if you believe we processed a child's data without consent.

Data Processing Roles

As Processor: For landlord/tenant operational data, we act under Customer's instructions.

As Controller: For website, marketing, billing, and account data.

Breach Notification

If a security incident causes a Personal Data Breach, we will notify our Customers without undue delay and provide information to support regulatory/individual notifications where required.

Changes to This Policy

We will post updates with a new "Last updated" date and, for material changes, provide reasonable advance notice.

Questions or Requests

Contact our privacy officer at privacy@brikli.com