Privacy Policy

Chaabi.city serves two kinds of users: renters (people searching for, inquiring about, and applying to rentals) and landlords and property managers(people listing rentals). Chaabi.city is part of the wider Chaabi family of products, including the Chaabi property-management app used by landlords and managers.

Account & identity. Your name, phone number, and email address. We confirm your phone number by SMS before you can contact a landlord or submit an inquiry.

Renter profile (“Chaabi Passport”). Details you choose to add — such as your housing preferences, budget, move-in timing, employment and rental history, references, significant addresses, and documents you upload to support an application.

Listings & inquiries. If you list a rental, the listing details and photos you provide. If you inquire or apply, the message, preferences, showing availability, and application information you submit.

Nearby transit. Public listing pages may show nearby transit-stop names, routes, public stop locations, and distances using published transit-agency data. When a listing address is hidden, we use its approximate public area and adjust the displayed distance by up to 20 metres. We do not show live arrival times.

Search decisions & tour notes. We store the votes and comments you choose to share in Search Together, and the private checklists, questions and notes you save before or after a tour. Your private saved-list notes and tour notes are not shared with a search partner or host. A tour response or host follow-up is shared only when you choose the separate sharing action.

Reviewed inquiry reuse. You can choose up to three alternative rentals and review the inquiry details taken from your Passport before agreeing to share them. This does not share your full Passport, private search budget, income, documents or saved places, and it does not automatically create an application or tour booking. Existing inquiries are left unchanged. A minimal receipt records the review and rental identifiers to prevent the same consent from sending twice, including after an inquiry is removed.

Response follow-through. We record an optional lister-set response target for new inquiries and the first qualifying showing update recorded on Chaabi. Public timing summaries require at least ten distinct renters and exclude inquiries with no recorded showing update. Calls and emails outside Chaabi are not measured. A lister may mark an inquiry as answered elsewhere to clear a follow-up; this does not count as a measured response. In-app reminders may suggest continuing your search while the original inquiry stays open.

Landlord and organization verification. If you request a trust review, we collect the claim you want us to assess, registry details you provide, your declaration, reviewer correspondence, and any supporting property, organization, professional, authorization, or identity evidence you choose or are asked to supply. We ask you to redact unrelated account numbers, financial amounts, signatures, and information about other people.

Payments. If you purchase listing credits, payment is processed by our payment provider (Stripe). We do not store your full card number; we receive limited transaction details.

Usage & device data. Basic technical data such as pages viewed, approximate location derived from your IP address (used for regional availability), and standard server logs.

We use cookies to keep you signed in and to remember your session. Some Chaabi services — for example the Doors leads portal — set a longer-lived cookie so you don't have to sign in on every visit. We use only the cookies needed to operate the Service and keep you logged in; we do not use third-party advertising cookies.

We use your information to: operate the marketplace; verify that renters are real and reachable; assess a landlord's identity, organization, professional credential, or authority over specified inventory; deliver inquiries and applications to the relevant landlord; schedule showings; process listing payments; send you transactional emails and texts about your account and activity (see consent below); moderate listings and keep the Service safe; and comply with legal obligations.

Rental performance uses first-party aggregate counts, not a visitor list. Separately, you may opt in under Data & privacy to contribute one active saved-search alert to a daily demand summary. Only broad city, bedroom and $500 budget bands are used; groups smaller than 25 people are hidden and counts are rounded down. Names, private places, Passport details and messages are not included. This is off by default. Withdrawing stops contributions to future daily summaries; released summaries contain no names or account identifiers. Final closure of your seeker workspace removes its private tour preparation and responses, inquiry-reuse receipts and private Route drafts, and resets demand sharing off. Reopening does not restore those records or your old sharing consent.

By creating an account and providing your phone number, you consent to receive service-related SMS messages (such as verification codes). By providing your email, you consent to receive transactional emails about your account and activity. We follow Canada's Anti-Spam Legislation (CASL): any non-essential/marketing messages will include a way to unsubscribe, and you can opt out at any time. You can withdraw consent by contacting us, though some messages (like security codes) are necessary to use the Service.

Landlords / property managers. Inquiry information is shared with the landlord's organization so they can respond. Application details and documents are shared with the landlord's organization, limited to reviewers authorized for that listing, plus a Chaabi super administrator using the audited support override. Authorized recipients can save or copy information; screenshots and further sharing cannot be prevented.

Application-document access. Uploaded application files are encrypted at rest. When an authorized reviewer uses the applicant's access code, Chaabi's server decrypts, safely processes, and delivers a readable copy for review, then records the access. A five-use limit applies to full ZIP package exports, not individual authorized views. Saving, screenshots, photographs, and transcription cannot be prevented after delivery.

Verification-evidence access. Verification files are kept in private storage and are not shown on listings or storefronts. Only the submitting organization and authorized Chaabi trust reviewers can access them for the review; reviewer access is recorded. Registry checks are preferred where they can establish a claim without collecting a file. Government ID is an exceptional identity-only method and does not establish ownership or authority by itself.

The Chaabi app. Where a listing was published by a landlord using the Chaabi property-management app, your inquiry/lead may flow into that landlord's account in the app.

Private commute calculations. When you explicitly request a calculation, our routing service receives the rental's approximate location and up to six of your active private saved-place coordinates. We do not include your profile identifier, saved-place names or written addresses in that calculation request. The resulting estimates are not automatically shared with your search partner or a lister.

Optional shared commute estimates. In an authorized Search Together decision room, you can separately choose one of your own private places and consent to share a rounded driving-time estimate with your current search partner for that saved rental. The routing service receives the two coordinates for that calculation; your partner receives the rounded minutes and calculation/expiry times, not your place name, address or coordinates. Estimates expire after 24 hours. You can withdraw your own estimate, and withdrawing the relevant list or relationship sharing clears it. Previously seen information cannot be recalled from another person's memory or screenshots.

Supabase, Amazon Web Services, and Vercel. Supabase, running on Amazon Web Services infrastructure, provides our database, authentication, private file storage, and server-side functions. Vercel hosts the web application and routes web requests. These services may receive account or marketplace data and ordinary request metadata as needed for those functions.

Twilio Verify and Twilio SendGrid. When provider credentials are enabled, Twilio receives your phone number and verification request details to deliver and check SMS sign-in codes. SendGrid receives your email address and the content of transactional account or marketplace emails.

Stripe. Stripe receives customer, purchase, and payment-session information when you start or manage a paid purchase or subscription. Stripe handles full payment-card data; Chaabi receives limited customer and transaction details and does not store your full card number.

Apple Maps and Core Location. In the native iOS app, Apple provides typed address and cross-street suggestions, exact geocoding, maps, directions, and travel estimates. After three characters, typed address text may be sent to Apple for suggestions; full saved addresses, coordinates, and route endpoints may be processed for the feature you request. Native typed-address fields show this notice before the provider threshold.

Upstash Redis. When configured, Upstash supports distributed rate limits for security and marketplace workflows. Chaabi sends an HMAC-pseudonymized opaque rate-limit key, a counter, and a short window expiry. Our application is designed not to send the raw phone, email, profile, or IP value used to form that key.

Apple Push Notification service (APNs). If iOS push is enabled and you register a device, Apple receives the device token, app and delivery metadata, and a limited notification envelope containing generic alert text and allowlisted routing/action identifiers. Chaabi does not copy arbitrary event or customer-written fields into that envelope. Push delivery is currently deferred until Apple production credentials and real-device verification are available.

We review and limit what the application sends to each provider. A provider's own retention, subprocessors, processing locations, and cross-border transfers are also governed by its terms, settings, and our applicable agreements; we do not represent those provider-side facts as verified until the relevant account and contract review is complete.

Legal. We may disclose information where required by law or to protect the rights, safety, and security of our users and the Service.

We do not sell your personal information.

Our primary database is hosted on Supabase, running on Amazon Web Services infrastructure in Canada. Access is protected by row-level security so organizations can only reach their own data, and sensitive files are encrypted at rest.

Some of our service providers (for example, application hosting, email, SMS, distributed rate limiting, push delivery, and payments) may process or store data outside of Canada, including in the United States. Where that happens, your information may be subject to the laws of those jurisdictions. We use reputable providers and share only what is needed to deliver the Service.

We keep your information for as long as your account is active and as needed to provide the Service, resolve disputes, and meet legal obligations. You can ask us to delete your account and associated personal information; we will do so unless we are required to retain certain records (for example, transaction records for tax purposes).

The raw upload copy is quarantined and queued for deletion after Chaabi creates a separately addressed, safely processed review copy. That private review copy receives a deletion schedule after a decision, customer removal, or abandoned-upload expiry. The Verification centre shows that scheduled date and whether deletion has completed. Government-ID review copies use the shortest window in this workflow. Provider deletion is retried until it is confirmed; after the review copy is removed, we retain limited receipt metadata, the evidence category and fingerprint, claim outcome, reviewer rationale, and audit history so we can demonstrate what was decided without retaining the document itself.

Under PIPEDA you have the right to access the personal information we hold about you, to ask us to correct it, and to withdraw consent (subject to legal or contractual limits). You can manage much of your information directly in your account, or contact us to make a request. We will respond within the timeframes required by law.

If you are a resident of Quebec, you have additional rights under Quebec's Law 25, including the right to be informed of automated processing and, in certain cases, data portability. You may exercise these rights by contacting us at the address below.

Chaabi.city is intended for adults (18+) entering into rental arrangements. We do not knowingly collect personal information from children.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.

Questions or requests about your privacy? Contact our privacy team at onnuco@proton.me, or write to Onnuco Labs Ltd., Ontario, Canada.