Privacy Policy
How AA Location protects your personal information
Last updated:
This policy is designed to comply with the Act respecting the protection of personal information in the private sector (Law 25, Quebec) and the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada). It applies to anyone who visits or uses www.aalocation.com.
1. Identification of the controller
AA Location is the controller of the personal information collected through this website. Any communication regarding this policy can be sent to:
AA Location
Mailing address: 3 Place Ville-Marie, Suite 400, Montréal, QC H3B 2E3, CA
Email: contact@aalocation.ca
2. Privacy Officer
Pursuant to article 3.1 of Law 25, AA Location has designated a Privacy Officer. You may contact them for any request related to this policy, to exercise your rights, or to file an internal complaint:
Privacy Officer
Dedicated email: privacy@aalocation.ca
Target response time: 30 days (article 32, Law 25).
3. Personal information collected
We collect only the information necessary to deliver our services:
| Category | Examples | Source |
|---|---|---|
| Identification | Name, email, phone | Forms (owner evaluation, tenant application) |
| Property data (owners) | Address, type, bedrooms, target rent | Evaluation form |
| Financial capacity (tenants, on consent) | Net monthly income, income source, employment duration | Application and voluntarily provided documents |
| Rental history (on consent) | Prior-landlord references, TAL registry search | Provided documents + public TAL registry |
| Credit (on written consent) | Equifax or TransUnion report, credit score | Credit bureaus, after explicit authorization |
| Technical data | IP address, device type, pages visited | Server logs (essential) + GA4 (on consent) |
| Advertising identifiers | Meta Pixel — conversion events | Navigation, on marketing consent |
No information protected by the Quebec Charter (origin, age except legal majority, family status, religion, orientation, disability, etc.) is collected or used in tenant selection.
4. Purposes of collection
Your information is collected for the following purposes, and only these:
- Deliver the tenant-placement service (listing, pre-selection, verification, coordinated lease signing).
- Evaluate a tenant file on objective criteria permitted under the Quebec Charter (capacity, file, references, history, stability, consent).
- Communicate with you (responding to your request, transactional email, placement follow-up).
- Measure site performance (anonymized audience, user journey, conversions) — on consent only.
- Run and measure our ads (Meta Ads) — on consent only.
- Comply with legal obligations (TAL, OACIQ, taxation).
5. Cookies and profiling technologies
AA Location uses three cookie categories. No profiling cookie is activated until you give explicit consent via the banner shown at your first visit.
Essential
Authentication, language, signup cart. Always on — required to operate the site (article 12, Law 25).
Analytics
Google Analytics 4. Anonymized IP, no advertising sharing. Activated only with your consent.
Marketing
Meta Pixel (Facebook). Conversion measurement and audience creation. Activated only with your consent.
You can change or withdraw your consent at any time via .
6. Sub-processors and transfers outside Quebec
To deliver the service, AA Location entrusts certain processing to trusted providers. Per article 17 of Law 25, we assess the protection offered by each before any transfer outside Quebec and enter into contractual agreements governing the use of your information.
| Sub-processor | Purpose | Processing country |
|---|---|---|
| Vercel Inc. | Application hosting | USA |
| Supabase Inc. | Database and storage | USA |
| Resend Inc. | Transactional email | USA |
| Google LLC (GA4) | Audience measurement (on consent) | USA |
| Meta Platforms, Inc. | Ad measurement (on consent) | USA |
Transfers to the United States are governed by the providers' contractual terms (DPA, standard clauses) and their security certifications (SOC 2, ISO 27001 as applicable). A privacy impact assessment (PIA) is conducted for each material addition of sub-processor or purpose.
7. Retention periods
Per article 23 of Law 25, we retain your information only as long as necessary for the purpose, then destroy or anonymize it.
| Category | Duration |
|---|---|
| Active user account | While the account is active |
| Closed account | 12 months after closure, then anonymized |
| Owner evaluation requests | 24 months after last contact |
| Tenant applications (not selected) | 36 months (CDPDJ statute of limitations) |
| Signed leases and associated documents | 7 years (TAL and tax obligations) |
| Technical logs | 12 months maximum |
| Analytics data (GA4) | 14 months (GA4 setting) |
| Marketing data (Meta Pixel) | Per Meta settings (typically 180 days) |
8. Your rights
Law 25 and the Quebec Charter grant you the following rights. To exercise any, write to privacy@aalocation.ca with reasonable proof of identity.
Right of access
Obtain a copy of the information we hold about you.
Right to rectification
Have inaccurate or incomplete information corrected.
Right to withdraw consent
Withdraw your consent to analytics or marketing cookies at any time.
Right to erasure
Request deletion of information when the purpose has been fulfilled.
Right to portability
Receive your data in a structured, commonly used technological format (in force since September 2024).
Right to cessation of dissemination
Request that we stop disseminating information that prejudices you.
Right to information on automated decisions
Know the main information and factors behind a decision made exclusively by automated processing.
Right to complaint
File a complaint with the Quebec Access to Information Commission if our response is unsatisfactory.
No decision is rendered exclusively by automated processing at AA Location. Scoring tools (e.g., Tenant Profile Score) structure the human evaluation — the final decision always rests with the owner.
9. Security measures
We implement appropriate technical and organizational measures: TLS encryption for any transfer, password hashing (bcrypt), restricted and logged access, regular backups, SOC 2 / ISO 27001 certifications at our main sub-processors. In the event of a confidentiality incident presenting a serious risk of injury, we notify the Quebec Access to Information Commission and the persons concerned (article 3.5, Law 25).
10. Minors
AA Location does not knowingly address persons under 14 years of age. Any tenant application requires legal majority (18 in Quebec).
11. Policy updates
We may update this policy to reflect legal, operational or contractual changes. The date at the top of the page reflects the last substantive revision. Any material change (new sub-processor, new purpose, new category of information) triggers a fresh consent request.
12. CAI recourse
If our handling of your request is unsatisfactory, you can file a complaint with the Quebec Access to Information Commission:
13. Contact us
For any question regarding this policy or your personal information: