Last updated 2026-09-26
This describes what LeaseLab actually does with information, in plain language. It has not been reviewed by a lawyer, and it deliberately makes no claim about certifications, data residency, or deletion deadlines that we cannot back up.
LeaseLab is operated by Jiajian Yang, a sole proprietorship based in Ontario, Canada. "We" and "us" below mean that operator.
This policy covers the LeaseLab web application, its API, and this website. Questions go to privacy@leaselab.ai.
Working through the product, the categories are:
LeaseLab charges nothing and processes no payments, so it collects no card details. Rent never passes through LeaseLab.
AI is optional; LeaseLab’s core record works without it. It is used to suggest a classification for a receipt you upload; the receipt you provided is processed by the model.
AI suggestions don’t change your records. Receipt classifications stay unconfirmed until you confirm them.
Maintenance requests are not sent to a model, and LeaseLab does not send AI-written messages to your tenants.
Inference runs on Cloudflare Workers AI, on the same platform that runs the rest of the service. We do not claim that the model provider retains nothing or trains on nothing, because we have not verified any such term — we state only what we do, which is not to send your data to any other AI provider.
An owner or admin can create a key that lets an agent of their choosing work with the workspace through LeaseLab’s API. The key sets what the agent may read and which actions it may take. Tenant contact details are not readable unless that is explicitly granted.
When an agent reads data through its key, LeaseLab sends that data to the agent. From that point, the agent and whoever provides it handle the data under their own terms and policies, not this one. LeaseLab does not choose, operate, or control your agent. You can revoke a key at any time; it stops working immediately.
Actions an agent takes are checked against the key and your limits, and recorded with the key that made them.
We use the following providers to run LeaseLab. This list reflects what the system actually uses today; it is not maintained as a formal subprocessor register, and we do not represent it as exhaustive for all time.
We use Cloudflare Web Analytics to measure aggregate site traffic. It does not use cookies or local storage and does not build visitor profiles. To deliver the service, Cloudflare processes technical request data such as your IP address and browser user agent; we only receive aggregated statistics and never receive your IP address.
Our providers operate globally distributed infrastructure, and your data may be processed or stored outside Canada. We do not promise Canadian-only storage, because nothing in the current setup guarantees it.
We keep your data for as long as your workspace exists. A billing or payment outcome never deletes anything or changes your access.
Imported source files are removed on a rolling basis roughly a month after the import finishes; the records you committed from them stay in your portfolio.
An owner can generate and download an export of the workspace’s records from organization settings, and anyone can download their own account data from their profile. You can also close your own account.
Deleting a workspace ends access to it, but it does not erase the stored records. You can ask for data to be erased by emailing privacy@leaselab.ai; a person reviews each request. There is no self-service or automatic erasure today, and some records may have to be kept, so we will tell you what can be removed and what cannot. We do not publish a guaranteed turnaround, because we would rather not commit to a deadline we have not operationalised.
Because the record of changes is append-only, correcting a mistake adds a correcting entry rather than erasing history. That is what makes the audit trail trustworthy, and it is worth knowing before you enter something you would later want no trace of.
Each organization’s data is scoped to that organization at the database layer, and every request — from a person or from an agent’s key — is checked against that organization before it can read or write anything. Access to the application requires signing in through our authentication provider; agent keys are checked on every request and can be revoked. Credentials and API keys are held as platform secrets, not in code. Traffic to our providers is encrypted in transit by those providers.
We do not hold SOC 2, ISO 27001, PCI or any other certification, and nothing here should be read as claiming one. No system is perfectly secure, and we make no absolute guarantee.
If you believe you have found a security problem, email support@leaselab.ai.
Most of the personal information in LeaseLab is about your tenants, not about you. When you enter it, or grant an agent access to it, you are confirming that you are entitled to do so and that you are handling it in line with your own obligations as a landlord.
Tenants do not have LeaseLab accounts and cannot sign in. A tenant who wants to know what is held about them, or to have it corrected, should contact you; we will help you respond.
If this policy changes materially, we will update the date below and, where the change affects how we handle your data, tell you by email.
Privacy questions, access requests, corrections, and erasure requests: privacy@leaselab.ai. Security reports: support@leaselab.ai. General support: support@leaselab.ai.
See also Terms of Service and how your data is handled.