Privacy Policy

1. Introduction & Scope

Property Bounty Inc. (“Property Bounty”, “we”, “us”, “our”, or “the Platform”) operates the website at propertybounty.com and the related bounty-driven property sourcing service. We are committed to protecting the privacy and security of personal information entrusted to us by our users.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how we protect it, how long we keep it, and the rights you have in connection with that information.

We operate in compliance with Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), Quebec’s Act Respecting the Protection of Personal Information in the Private Sector as modernized by Law 25, Alberta’s Personal Information Protection Act (“PIPA”), British Columbia’s Personal Information Protection Act, and Canada’s Anti-Spam Legislation (“CASL”), as applicable to our activities.

This Policy applies to personal information collected through our website, mobile-optimized web interface, transactional email, and any service interaction connected to a Property Bounty account. It does not apply to third-party services we link to, which are governed by their own privacy policies.

2. Key Definitions

Personal information — Information about an identifiable individual. This includes direct identifiers (name, email) and indirect identifiers that could be combined to identify you (IP address, device fingerprint).
Buyer — A registered business user who posts bounties.
Bounty Hunter — A registered user who submits matching properties to bounties.
Submission — A property match sent by a bounty hunter to a buyer, including the property address and seller contact information.
Processor — A third-party service (such as Stripe) that handles personal information on our behalf under contractual obligations.
Aggregated or anonymized data — Data that has been stripped of identifiers such that it cannot reasonably be used to re-identify an individual.

3. Information We Collect

3.1 Information you provide directly

Account registration — First and last name, email address, hashed password, and (optionally) Google account identifier if you sign in via Google OAuth.
Profile data — First name displayed to counterparties on submissions under review; bounty hunter activation status; admin flag (if applicable).
Business verification (buyers only) — Business legal name, business number (optional CRA Business Number), business address, city, province, postal code, and business phone number. This information is reviewed by our team before we approve bounty posting.
Bounty content — Property criteria (type, bedrooms, square footage), geographic area, price range, reward amount, deadline, and any additional notes you include.
Submission content (bounty hunters only) — Property address, asking price, seller contact name, seller phone or email, and any additional notes.
Payment details — Payment card number, expiry, CVC, and billing postal code are collected directly by Stripe and not transmitted to or stored on our servers. We receive only a Stripe customer identifier and a transaction reference.
Bounty Hunter payout details — Banking information for payout is collected directly by Stripe through Stripe Connect; we do not see account numbers or routing information.
Dispute correspondence — Any messages, explanations, or evidence you submit during a dispute resolution process.
Support correspondence — The contents of any email or message you send us.

3.2 Information collected automatically

Session cookies — An encrypted session identifier to keep you signed in after authentication.
CSRF tokens — A per-session token stored in a cookie to prevent cross-site request forgery.
Server logs — HTTP request logs including IP address, user agent string, request URL, HTTP method, response status, and timestamp. Retained for security and troubleshooting.
Device information — Browser type and version, operating system, screen size, and language preference, inferred from request headers.
Approximate location — Derived from IP address for security purposes (such as detecting unusual sign-in activity). We do not use GPS or precise device geolocation.

3.3 Information from third parties

Google OAuth — If you sign in with Google, we receive your Google account email address, your name, and a stable Google user identifier. We do not receive your Google password or any Google services data (Gmail, Drive, Contacts, etc.).
Stripe — Transaction status, payout status, refund status, and Stripe Connect account status. We do not receive bank account numbers or card numbers.

3.4 Information we do not collect

Precise GPS location.
Government-issued identification numbers (SIN, driver’s licence, passport) unless specifically required for Stripe Connect onboarding, in which case they are collected by Stripe, not by us.
Health, political, religious, or sexual-orientation information.
Biometric data.
Information from children (see Section 17).

4. How We Use Your Information

We use personal information only for the purposes for which it was collected, and for reasonable compatible purposes. Specifically:

Providing the service — Creating and maintaining your account, posting and funding bounties, routing submissions to buyers, facilitating acceptance, closing, and payout workflows.
Authentication & access control — Verifying it’s you when you sign in, managing active sessions, and enforcing role-based access (buyer, bounty hunter, admin).
Payment processing — Charging and holding bounty funds, releasing payouts to bounty hunters, issuing refunds, and reconciling transaction records via Stripe.
Business verification — Reviewing buyer registrations against publicly available business records and our internal risk criteria before approving bounty posting.
Transactional communication — Sending you emails about bounty status, submission activity, closing reminders, payout confirmations, dispute notices, and account-security alerts.
Safety, fraud prevention, and integrity — Detecting abuse, preventing fraudulent bounties or submissions, investigating reports, and enforcing our Terms of Service. This may include correlating account activity with IP or device signals.
Dispute resolution — Reviewing evidence, adjudicating between buyer and bounty hunter, and issuing release or refund determinations.
Service improvement — Analyzing aggregate usage patterns to improve features and diagnose bugs. Wherever practical, this is done on aggregated or anonymized data.
Legal and regulatory compliance — Meeting tax, anti-money-laundering, record-keeping, and other applicable legal requirements; responding to lawful requests from government authorities.

We do not use your personal information for behavioural advertising, do not sell your personal information to third parties, and do not license your personal information for marketing by others.

5. Legal Basis for Processing (Consent)

Under PIPEDA and provincial equivalents, the primary legal basis for collecting, using, and disclosing personal information is consent. Depending on the circumstances, consent may be:

Express consent — Provided explicitly when you check a box, sign a terms agreement, or otherwise affirmatively opt in. We rely on express consent for the collection of sensitive or non-obvious information, such as business verification data and payment information.
Implied consent — Reasonably inferred from your actions and the context. For example, by registering an account you imply consent to the collection of information necessary to create and authenticate that account.
Required by law — In limited circumstances we may process information without consent where permitted or required by applicable law, such as responding to a court order, investigating fraud, or complying with tax-reporting obligations.

You may withdraw consent for optional processing at any time (see Section 14). Withdrawing consent for processing that is required to operate the service (such as maintaining your account or holding bounty funds) may mean we can no longer provide the service to you.

7. International Data Transfers

Property Bounty is based in Canada. However, some of our service providers store, process, or access personal information outside of Canada — primarily in the United States:

Stripe processes transactions through infrastructure located primarily in the United States.
Google (for OAuth, and optional analytics/ads if you consent) operates globally distributed infrastructure.
Meta processes optional advertising measurement data in the United States and other jurisdictions when you consent to marketing tracking.
X processes optional advertising measurement data in the United States and other jurisdictions when you consent to marketing tracking.
Cloudflare routes traffic through a global network of data centres.

When personal information is transferred outside Canada, it is subject to the laws of the destination country, including laws that may permit government authorities in those countries to access it. We require our service providers to implement contractual, organizational, and technical safeguards comparable to those required under Canadian law. By using the Platform, you acknowledge and consent to this cross-border processing.

8. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law. Our typical retention periods are:

Account records — For the life of your account. If you delete your account, we retain limited records as set out below.
Bounty and submission history — Retained for the life of the account and archived thereafter to support dispute resolution and regulatory reporting.
Financial records — Retained for seven (7) years following the end of the relevant fiscal year, as required by the Canada Revenue Agency and applicable provincial tax authorities.
Stripe transaction references — Retained for the same seven-year period to support reconciliation.
Server logs — Retained for up to 90 days for security, performance monitoring, and fraud detection. Aggregated logs with identifiers removed may be retained longer.
Dispute records — Retained for seven (7) years after resolution.
Support correspondence — Retained for up to two (2) years unless required longer for dispute or compliance reasons.

After the applicable retention period, we securely delete or irreversibly anonymize the information. Anonymized, aggregated information (which cannot be linked back to you) may be retained indefinitely for analytical purposes.

9. Data Security

We implement a layered set of technical and organizational safeguards that is proportionate to the sensitivity of the information:

Transport encryption — All traffic between your browser and our servers is encrypted using TLS 1.2 or higher.
Password handling — Passwords are never stored in plain text. They are salted and hashed using industry-standard algorithms.
Payment isolation — Card numbers, CVCs, and bank account details are handled entirely by Stripe and never touch our servers.
Session management — Sessions are invalidated on sign-out and when an account is suspended.
Access controls — Admin access to production data is restricted to authorized personnel, audited, and protected by authentication.
Infrastructure hardening — Production servers are protected behind a reverse proxy and DDoS mitigation, with regular security patching.
Principle of least privilege — Personnel only access the minimum personal information necessary to perform their role.

No method of transmission or storage is perfectly secure. While we use reasonable and appropriate safeguards, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at [email protected].

10. Breach Notification

If we experience a breach of security safeguards involving personal information under our control and that breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA’s mandatory breach reporting requirements. We will also notify applicable provincial regulators where required (including the Commission d’accès à l’information in Quebec). Notifications will describe the nature of the breach, the information involved, the steps we have taken, and the steps you can take to mitigate risk.

11. Cookies & Tracking Technologies

We use both strictly necessary cookies and optional marketing/measurement technologies. Optional tracking stays off unless you explicitly allow it through our privacy banner or privacy settings page.

Cookie	Purpose	Duration	Category
_property_bounty_session	Keeps you signed in after authentication. Encrypted.	Session	Strictly necessary
CSRF token	Prevents cross-site request forgery on form submissions.	Session	Strictly necessary
privacy_preferences	Stores whether you allowed or refused optional analytics and advertising measurement.	6 months	Strictly necessary
_fbc	Stores Meta click attribution from an `fbclid` landing-page parameter so we can measure ad performance.	90 days	Optional marketing / measurement
__cf_bm / cf_clearance	Set by Cloudflare for DDoS mitigation and bot detection.	Up to 30 days	Strictly necessary

We display a privacy banner for visitors who have not yet made a choice. You can allow or refuse optional tracking there, or change your mind later at any time through Privacy settings. If you refuse optional tracking, core site features still work.

12. Logs & Analytics

We use first-party logs for security and operations, and we also use optional third-party analytics and ad-measurement tools when you consent to marketing tracking. Those tools currently include Google Analytics, Google Ads conversion tracking, Meta Pixel, the Meta Conversions API, and X/Twitter conversion tracking.

Request timestamp, URL, HTTP method, and response status
IP address and user agent string
Referrer header (the previous page, if any)
Internal request identifier for correlation across systems

When optional tracking is enabled, these providers may also receive online identifiers, page URLs, referrers, browser/device metadata, and conversion events related to account creation or lead generation. We use that data to understand campaign performance, improve acquisition spend, and measure which channels bring in serious buyers and hunters.

Logs are used for security monitoring, performance troubleshooting, and fraud detection. See Section 8 for retention.

13. Marketing Communications & CASL

Canada’s Anti-Spam Legislation (CASL) regulates commercial electronic messages. The email you receive from Property Bounty falls into one of two categories:

Transactional / service email — Notifications directly related to your account or bounty activity (e.g., submission received, payout released, dispute filed). These are sent under CASL’s exemption for messages that facilitate or confirm a transaction the recipient has requested, and cannot be unsubscribed from while your account is active.
Commercial email — Newsletters or promotional messages. These are sent only with your express or implied consent under CASL. Every commercial message includes an unsubscribe mechanism. Withdrawal takes effect within ten (10) business days.

14. Your Rights

Subject to applicable law, you have the following rights with respect to your personal information:

Right of access — Receive a copy of the personal information we hold about you and information about how it is used.
Right of correction — Request that we correct inaccurate or incomplete personal information.
Right of deletion — Request that we delete your account and associated personal information, subject to retention requirements set out in Section 8.
Right to withdraw consent — Withdraw previously given consent for optional processing, including analytics and ad measurement, subject to legal and contractual limitations. You can do this any time through Privacy settings.
Right to data portability (where applicable) — Receive the personal information you have provided to us in a structured, commonly used electronic format.
Right to challenge compliance — File a complaint with our Privacy Officer or the Office of the Privacy Commissioner of Canada at priv.gc.ca.

15. How to Make a Privacy Request

To exercise any of the rights described in Section 14, email [email protected] from the email address associated with your Property Bounty account, and include:

Your full name and the email address on your account
A clear description of the right you wish to exercise
Enough detail for us to locate and verify your information

We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days, in accordance with PIPEDA. If we require additional time (for example, because a request is complex or voluminous), we will notify you and explain why. If we decline a request in whole or in part, we will explain the reason and inform you of your right to complain to the Office of the Privacy Commissioner of Canada. We will not charge a fee for straightforward access or correction requests.

16. Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects on you. Business verification decisions, suspension decisions, and dispute resolutions are reviewed and decided by human administrators based on documented criteria. We may use automated systems for routine tasks such as duplicate detection, spam filtering, or fraud-scoring to flag activity for human review, but final decisions in these areas rest with a person.

17. Children’s Privacy

The Platform is intended exclusively for users who are at least eighteen (18) years of age and who have the legal capacity to enter into a binding agreement. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact us at [email protected] and we will take steps to delete the information promptly.

18. Quebec Residents (Law 25)

If you reside in Quebec, you are covered by Quebec’s Act Respecting the Protection of Personal Information in the Private Sector as modernized by Law 25. In addition to the rights described above, you have:

Right of data portability — Since September 22, 2024, you may request a copy of computerized personal information you have provided in a structured, commonly used technological format, and have it transmitted to another party of your choice.
Right to be informed of cross-border transfers — We have informed you of the cross-border transfers in Section 7. Before transferring your personal information outside Quebec, we conduct a privacy impact assessment where required by Law 25.
Right to disagree with automated processing — Where personal information is used for a decision based exclusively on automated processing, you have the right to be informed and to submit observations to a human reviewer. See Section 16 — we do not currently use such processing.

Our designated Person in Charge of Protection of Personal Information (Privacy Officer) is responsible for ensuring compliance with Law 25. Contact details are in Section 23.

19. Other Provincial Privacy Laws

Alberta (PIPA), British Columbia (PIPA), and other provinces have privacy laws that may provide additional or different rights. Where provincial law grants you rights beyond what is described here, we honour those rights. Provincial privacy regulators can be reached through the Office of the Privacy Commissioner of Canada website.

20. Do Not Track

Some browsers send a “Do Not Track” (DNT) signal. We do not currently treat DNT as a standalone consent mechanism because there is no consistent industry standard for interpreting it. Instead, we rely on the privacy choices you make through our banner and Privacy settings. If you do nothing, optional tracking remains off by default.

21. Third-Party Links

The Platform may contain links to third-party websites (for example, Stripe, Google’s Privacy Policy, our service providers’ websites). We are not responsible for the privacy practices of those third parties. When you leave our Platform we encourage you to read the privacy policies of the websites you visit.

22. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will update the “Last updated” date at the top and, where appropriate, notify affected users by email or by a prominent notice on the Platform before the change takes effect. We encourage you to review this Policy periodically. Continued use of the Platform after an update constitutes acceptance of the revised Policy.

23. Contact Us

For privacy questions, access or correction requests, or to exercise any of the rights described in this Policy, contact our Privacy Officer (who also serves as the Person in Charge of Protection of Personal Information for the purposes of Quebec Law 25):

Privacy Officer

Property Bounty Inc.

Toronto, Canada

Email: [email protected]

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada: priv.gc.ca. Quebec residents may also contact the Commission d’accès à l’information du Québec: cai.gouv.qc.ca.