Privacy Policy

Effective date: March 20, 2026  ·  Last updated: September 26, 2026

Vonulo ("we", "our", or "us") operates vonulo.com, a student housing platform connecting students with off-campus housing near Canadian campuses. We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable British Columbia privacy law.

By using Vonulo, you consent to the collection, use, and disclosure of your personal information as described in this policy.

1. Information We Collect

We collect personal information you provide directly, including:

• Account information: Email address, name, and password (stored encrypted via Supabase Auth).
• Profile information: University affiliation, housing preferences, roommate preferences, and profile details you choose to share.
• Listing information: Property address, photos, rental price, and lease terms submitted by landlords or subletters. In some cases, we may create listings on behalf of landlords who provide this information to us directly.
• Information from public rental advertisements: To find housing near campus we review rental adverts posted publicly on sites such as Kijiji, and may record the advertiser's name, the advertised details, a link to the original advert, and a contact number where the advert shows one. We use this only to contact the advertiser about listing with us. Nothing collected this way is published on Vonulo unless we have spoken to the advertiser and they have agreed to list. If you would rather we did not hold this, email hello@vonulo.com and we will delete it.
• Verification information: When you apply to be a Verified Landlord we collect a government-issued ID, a proof-of-ownership document (property tax notice, title document, utility bill, or signed management agreement), and the name as it appears on your ID for cross-checking. Subletters may optionally upload a copy of their current lease for the Lease-on-File trust badge.
• School email (optional): If you sign up with a personal email address, you may add a school email so we can grant you the Verified Student badge. We send a one-time verification link to that address; the school email is stored alongside your primary email but is not used for sign-in.
• Lease information: If you use our optional digital lease tools, the lease terms and digital signatures you provide.
• Communications: Messages sent between users through our platform, tour requests, and inquiries.
• Payment information: If you purchase an optional paid service from Vonulo (such as AI Lease Review or Featured Listings), payment is processed through Stripe, Inc. We do not store full card numbers — payment data is handled by Stripe under their privacy policy. Vonulo does not collect, hold, or process security deposits or rent payments; those are exchanged directly between landlord and tenant outside the platform.
• Usage data: Pages visited, features used, listing views, search queries, and general activity on the platform.

2. How We Use Your Information

We use your personal information to:

• Create and manage your account and provide platform features.
• Facilitate connections between students and landlords or subletters.
• Process payments for optional paid services (e.g. AI Lease Review, Featured Listings) and send receipts.
• Send platform notifications (tour approvals, new messages, listing alerts) via email.
• Verify student status using your university email domain (supported universities get a Verified Student badge).
• Improve and maintain the platform, including analytics on platform usage.
• Prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations.

We do not sell your personal information to third parties.

3. How We Share Your Information

We share personal information only in limited circumstances:

• Between users: When you make an inquiry or tour request, your name and email are shared with the relevant landlord or subletter. Listing details and contact information are shared with inquiring students.
• Roommate matching: If you create a roommate profile, the details you put in it are visible to other signed-in students using roommate matching. It is not visible to the public or to search engines. Your email address is not shown on your profile; it becomes reachable only once you and another student have connected, and either of you can then contact the other through the platform. You can delete your roommate profile at any time from your dashboard, which removes it from matching.
• Service providers: We use the following third-party services to operate the platform:

• Legal requirements: We may disclose information if required by law, subpoena, or court order, or to protect the rights, safety, or property of Vonulo or its users.

4. Who Can See Your Messages

People ask us this directly, so here is the specific answer rather than a general one.

• The two of you. A conversation between a student and a landlord appears in both parties' dashboards. That is its purpose.
• Vonulo does not read your conversations. There is no screen, report, or admin tool on our side that displays the back-and-forth between a landlord and a student, and nothing scans the contents of those messages.
• We do review the first enquiry. When you send an initial enquiry through a listing, that message is included in a daily internal summary of students who are waiting on a reply, so we can follow up with the landlord on your behalf. That is the one message a person at Vonulo routinely reads.
• Technical access is not the same as routine access. We operate the database, so stored data including messages is technically reachable by us, as it is for the operator of any website. We access it only to investigate suspected fraud or abuse, to resolve a support request you have raised, or where required by law.

What we never do: we do not use the contents of your messages for marketing, we do not sell them or analyses of them, and we do not share them with anyone other than the person you sent them to, except in the limited circumstances described above.

You are free to move any conversation off the platform to email or phone at any time.

5. Emails We Send, and How to Stop Them

We send two different kinds of email, and they are controlled separately.

• Because something happened. A student messaged you, a viewing was requested, a listing changed status, a payment receipt. These follow from your own use of the platform and are sent as they occur.
• Because we are checking in. Periodic messages to landlords asking whether a unit is still available, who moved in, or when it frees up again. These are sent at most once a week to any one landlord.

Every check-in email carries a one-tap link to stop them, and it takes effect immediately rather than within the ten business days Canada's Anti-Spam Legislation allows. Stopping the check-ins does not stop the first kind: you will still be told when a student messages you about your listing, because not telling you would cost you a tenant. If you would like those to stop as well, email hello@vonulo.com and we will remove you.

6. Your Account, and How You Get Into It

Three things about accounts and sign-in that are easy to be surprised by, so they are written down rather than left to be discovered.

• An account is created when you first enquire about a listing, or when a listing is created for you. You are not asked to choose a password or fill in a sign-up form, because a wall at that moment costs people the room they were writing about. The account exists so your messages have somewhere to live and so a landlord's reply reaches you. You can open it any time at vonulo.com/login, set a password, or delete the whole thing from your dashboard.
• Sign-in activity is recorded, with the IP address, for 180 days. Links requested, links used, sign-ins that worked and sign-ins that failed. It is kept so that somebody working through other people's addresses is visible, and so we can tell a person who cannot get in what actually happened. It is not used for advertising or profiling, and it is deleted with the rest of your data if you close your account.
• The links in our emails act as your key. A one-tap reply link, a sign-in link, an unsubscribe link: opening one is how we know it is you, so anyone you forward it to can do the same things you could. Do not forward them. Each has a time limit, each stops working if you change your password, and none of them will ever ask you for a password or a payment detail.

7. Cross-Border Data Transfers

Your personal information may be transferred to and processed in the United States by our service providers listed above. By using Vonulo, you consent to this transfer. We ensure our service providers maintain appropriate safeguards consistent with PIPEDA requirements for the protection of your personal information.

8. Data Retention

We retain your personal information according to the following schedule:

• Active accounts: Data is retained for as long as your account is active.
• Closing your account: From your dashboard (Profile, then "Your data", then "Delete my account") your account and your personal information are deleted immediately, and you receive an email confirming it. What stays, and why: a signed lease, because both parties to it need it; the other party's copy of conversations and enquiries you had, with your name and address removed; payment records, which the law requires us to keep; and a record that we sent you the deletion notice. If you cannot sign in, email hello@vonulo.com and we do the same within 30 days.
• Financial records: Transaction records are retained for 7 years as required by Canadian tax law.
• Communications: After you close your account, messages you sent stay visible to the person you sent them to, with your name and address removed. A conversation is deleted once both parties' accounts have been closed.
• Listing data: Listings are removed when the landlord or subletter deactivates them or closes their account.
• Verification documents: Government IDs and proof-of-ownership documents submitted by landlords are stored in a private, access-controlled bucket. Approved landlords' verification documents are deleted within 90 days of approval (the Verified Landlord badge on your profile is the durable record). Rejected applications' documents are deleted within 30 days. Optional subletter lease uploads remain attached to the listing while it is active and are removed when the listing is deactivated.
• Answers given at your door: If you tell us through our building form when your place could be available, which building it is in, who manages it and your first name, we use that only to find the next student for that place and to contact the landlord or manager you named. We mention you to them only if you said we could. Answers are deleted after 12 months, or your name is removed if the place has since been listed with us. If your own room is coming free, you can leave an email or phone number there for one reminder to list it; it is used for nothing else and deleted on the same 12-month schedule. Listing emails are a separate sign-up you confirm.
• Aggregated data: Anonymised or aggregated data (which cannot identify you) may be retained indefinitely for analytics.

9. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encrypted data transmission (TLS/HTTPS) for all platform traffic.
• Row-level security (RLS) on all database tables, ensuring users can only access their own data.
• Authentication via Supabase Auth with secure session tokens.
• Access controls limiting who can view your data.
• Regular security reviews of platform code and infrastructure.

No method of transmission over the internet is 100% secure. If you become aware of any security concern, please contact us immediately.

10. Data Breach Notification

In accordance with PIPEDA's mandatory breach notification requirements, if we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will:

• Notify you as soon as feasible, describing the nature of the breach and the information involved.
• Report the breach to the Office of the Privacy Commissioner of Canada.
• Notify any other organization or government institution that may be able to reduce the risk of harm.
• Keep records of all breaches for a minimum of 24 months.

11. Your Rights (PIPEDA)

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Withdrawal of consent: Withdraw consent to certain uses of your data, subject to legal or contractual restrictions. Note that withdrawing consent may limit your ability to use the platform.
• Deletion: Request deletion of your account and associated personal data.
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

12. Cookies and Tracking

We use browser localStorage and sessionStorage to store session tokens and preferences such as saved listings and your campus selection. We do not use advertising cookies or third-party tracking pixels. Our platform loads fonts from Google Fonts and maps from Leaflet/OpenStreetMap, which may set their own cookies subject to their respective privacy policies.

We do measure traffic, and here is exactly what that records: the page path, the referring page, whether the device is a mobile, the time, and which listing was viewed. It does not record your IP address, your device or browser fingerprint, or any identifier tying a visit to your account. We use it to see which listings students actually reach. We do not use third-party analytics products and we do not use advertising tools; if that changes we will update this policy before collecting anything new.

13. Children's Privacy

Our platform is intended for users aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us personal information, contact us immediately and we will delete it.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users by email of any material changes and update the effective date above. Continued use of the platform after changes constitutes acceptance of the revised policy.