Privacy Policy

Status: Effective
Version: 2026-09-21-v1
Effective date: 2026-09-21

This legal instrument is currently owner-adopted in English and French. The English text is shown for this interface language until a reviewed convenience translation is available.

1. Accountability

KOTB Group Inc. operates iKOTB. The Privacy Officer, KOTB Group Inc., is accountable for the privacy program and can be reached at contact@ikotb.com.

2. Our role

For customer-managed property, tenant, occupant, vendor and similar records, the customer generally decides why information is entered and how it is used for property-management purposes, while KOTB Group Inc. processes it to provide and protect iKOTB. KOTB Group Inc. also handles certain information for account administration, security, support, legal compliance and business operations.

3. Information we handle

Depending on use, iKOTB may handle account/contact data; organization membership and roles; property/unit records; tenant and occupant information; leases and documents; rent-ledger and payment-status records without custody of funds; maintenance/work orders; messages/notices; vendor records; support/privacy requests; authentication, audit, security and operational metadata; and limited transactional-email delivery, bounce and complaint metadata.

4. Purposes and authority

We use personal information to authenticate and secure accounts; provide organization- and role-scoped functions; store and deliver records; process invitations and communications; provide support; send service/account email; detect abuse and security events; maintain audit records; operate and troubleshoot the Service; comply with law; and establish, exercise or defend legal rights. Where consent is required, it must relate to identified understandable purposes and may be withdrawn subject to legal or contractual limits.

5. Customer responsibility

Customers must have lawful authority for information they enter about other people, limit collection to what is reasonably necessary, keep access appropriately scoped, and comply with laws applicable to their own collection, use, disclosure, retention and decisions.

6. Providers and cross-border processing

Current providers include Supabase for production database/authentication/storage (us-west-2, United States), Vercel for application hosting, Amazon SES for transactional/Auth email (configured in ca-central-1, Canada), Google Workspace for business email, and Cloudflare for authoritative DNS. Providers and subprocessors may process information in other jurisdictions. Information outside a province or Canada may be subject to foreign law and lawful government access. KOTB Group Inc. remains accountable for personal information under its control and uses provider contracts, security controls and due diligence intended to protect it.

7. Cookies

iKOTB currently uses only first-party cookies or equivalent storage necessary for authentication, secure sessions and core functionality. It does not currently use advertising cookies, behavioural advertising pixels, cross-site tracking, third-party marketing analytics or session-recording tools. See the Cookie Disclosure.

8. Security

Safeguards include organization-scoped row-level security, private storage, role-based authorization, audit logging, authentication/session controls, TOTP/AAL2 for platform administrators, leaked-password protection, server-only credentials, security headers, rate limits, backups/recovery controls and transactional-email feedback handling. No security method can guarantee absolute security.

9. Retention and deletion

We retain personal information only as long as reasonably necessary for identified purposes, legal requirements, security, disputes and contractual obligations. iKOTB currently uses a documented manual retention/destruction process rather than an automatic customer-data deletion scheduler. Security/audit records are generally reviewed against a 24-month operational period; confidentiality-incident records are retained at least five years. Customer content is reviewed for return or deletion after offboarding, subject to legal holds, customer instructions and provider backup cycles.

10. Access and correction

Subject to applicable law and identity verification, individuals may request access to personal information under KOTB Group Inc.'s control and request correction of inaccurate or incomplete information. Some customer-controlled records may need to be addressed through the customer that entered or controls them. Requests may be submitted through available in-product privacy-request tools or to contact@ikotb.com.

11. Incidents

KOTB Group Inc. maintains a privacy-incident response process and incident register. Incidents are assessed under applicable legal thresholds and regulators/affected individuals are notified where required. Records of every federal breach of security safeguards are retained at least 24 months; the internal incident register is retained at least five years.

12. No sale or behavioural advertising

KOTB Group Inc. does not sell iKOTB customer personal information to advertisers and does not use customer property-management data for behavioural advertising.

13. Commercial electronic messages

The active iKOTB email path is for transactional/service communications. Promotional email is not activated through it unless a separate consent, identification, unsubscribe and recordkeeping process is implemented as required by law.

14. Occupants, complaints and changes

Property records may include information about occupants, including minors, where a customer has lawful authority and the information is reasonably necessary. iKOTB is not designed as an unsupervised consumer service for children. Privacy concerns may be sent to contact@ikotb.com and may also be raised with an applicable regulator. Material policy changes use version/effective-date controls and additional notice or consent where required.