Privacy policy

1. Introduction

This policy says what Kohabit collects, where it keeps it and for how long.

This policy complies with Quebec's Act to modernize legislative provisions as regards the protection of personal information (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What we collect

We only collect information necessary for the platform to function:

• • Account Information: name, email address, phone number (optional)
• • Condo Information: condo name, address, number of units
• • Usage Data: information about your use of Kohabit, to keep it running and to fix it
• • Technical Data: IP address, browser type, operating system (collected automatically)

3. Email addresses left without creating an account

Four places on the site let you leave an email address without creating an account: the demo on a phone, which sends a link to pick it back up on a computer along with the document for your board; the board kit form; the contingency fund calculator, which sends its report and adds the address to the list only if its box is ticked; and the recap of the demo on a computer. These addresses form a contact list, separate from accounts.

What we keep: the email address; the source and the page it was left from, with their dates; the language; the type of device, phone or computer; for the demo on a phone, the ballot cast in the staged vote and whether the pick-up link was opened; the date each follow-up email was sent, or the date it was dropped because it would have arrived too late; the date of a reply to these emails; consent to product news when it was given; the date of an unsubscribe; and, where applicable, a note written after an exchange.

What we do not keep: no name, no condo, no IP address, nothing about the browser. Since September 2026, the IP address and user agent of contacts are no longer recorded, and existing values have been erased.

Why: to send what was asked for, then two follow-up emails, so three sends at most per address. Three days after the first request, Ben, the person who builds Kohabit, writes to ask one question; replies go straight to Ben's inbox. Fourteen days after, an email explains what Bill 16 requires by August 15, 2028 and what Kohabit does. Each one carries an unsubscribe link. Unsubscribing, replying or creating an account stops these emails. Signing up for product news is a separate consent, unchecked by default, withdrawn in the same place.

For how long: twelve months from the person's last action: a new request, opening a pick-up link, an unsubscribe. After that, the contact is deleted automatically.

How to have it removed: the unsubscribe link at the bottom of every email, or a request to info@kohabit.ca.

If the address creates a Kohabit account, it stops being treated as a contact: follow-up emails end, and the information tied to the account falls under the other sections of this policy.

4. How we use your information

We use your information only to:

• • Keep Kohabit running
• • Communicate with you regarding your account and our services
• • Ensure platform security
• • Comply with our legal obligations

We never sell your data to third parties.

5. Storage, security and retention

Your data is stored in Beauharnois, Québec, with OVH Hosting Inc. The site's traffic goes through Cloudflare, an American company, which protects it from attacks; notification emails go out through a sending provider. We use appropriate technical and organizational security measures to protect your information against unauthorized access, loss, or destruction.

Exception: optional Drive integration. If the manager turns on syncing with an external Drive (Microsoft OneDrive or SharePoint), copies of your documents are then stored with Microsoft, a US provider, and are no longer hosted exclusively in Canada. This option is off by default; as long as no Drive is connected, the statement above applies fully. Learn more.

Your data is encrypted in transit and at rest, and we perform regular backups to ensure its integrity.

Addresses left without creating an account have their own retention period, in section 3.

Retention: your data is kept for the duration of your use of the platform. Upon account closure, your personal data is deleted within 30 days, unless a longer retention period is required by law. Any copies placed on the manager's Drive (OneDrive / SharePoint) are outside Kohabit's control: it is up to the manager to delete them from their own Drive.

Deleting a co-ownership: the administration of a syndicate may request the permanent erasure of its co-ownership data. Kohabit reviews the request, then waits 90 days before erasing anything. Those 90 days exist so the syndicate can change its mind and retrieve its data; it can cancel at any time during that period, and a reminder is sent to members seven days before the deadline. After those 90 days, the register, the documents, the accounting and the maintenance log are erased from our servers and cannot be retrieved, not even from a backup.

What survives that erasure: the invoices and payments for the Kohabit subscription, which are our own tax records and which the law requires us to keep for six years. They describe what we billed, and they are detached from the co-ownership that no longer exists. The log of the operation is also kept.

What the law requires the syndicate to keep on its side does not depend on us: minutes and the maintenance log with no time limit, accounting records at least seven years, tax records six years. Before any deletion, it is up to the syndicate to retrieve those documents through the full export, available at any time from the application.

6. Sharing your information

We only share your personal information with your explicit consent or when required by law. We do not sell, rent, or share your data with third parties for commercial purposes. Apart from the optional Drive integration (Microsoft OneDrive / SharePoint), which the manager explicitly turns on and which then copies your documents to Microsoft, your documents stay with our host. Notification emails do travel through a sending provider. Learn more about this exception.

7. Your rights

In accordance with Quebec's Law 25 and PIPEDA, you have the right to:

• • Access your personal information
• • Correct inaccurate information
• • Request deletion of your data
• • Withdraw your consent
• • Export your data

To exercise these rights, contact us at info@kohabit.ca.

8. Privacy officer

In accordance with Quebec's Law 25, the President of Technologies Kohabit Inc. is designated as the Privacy Officer responsible for personal information protection within the organization.

For any privacy-related questions or to exercise your rights, you may contact them at info@kohabit.ca.

9. Privacy incidents

In the event of a privacy incident likely to cause serious harm to an affected individual, we commit to notifying the Commission d'accès à l'information (CAI) and the affected persons, in accordance with the obligations set out in Quebec's Law 25.

10. Cookies and similar technologies

We use essential cookies for the platform to function. You can manage your cookie preferences through our consent system. For more information, see our cookie policy.

11. Changes to this policy

We may update this privacy policy from time to time. For any substantial change affecting your rights or how we handle your data, we will notify you by email with reasonable advance notice before it takes effect.

12. Contact

For any questions regarding this privacy policy or to exercise your rights, contact us at info@kohabit.ca.