Privacy Policy
My Roof Group Ltd. · Effective Date: February 15, 2026 · Last Updated: February 15, 2026
1. Introduction
My Roof Group Ltd. ("we," "us," "our," or the "Company") operates Randy BC AI (the "Service"), an artificial intelligence-powered assistant that provides general information about the British Columbia Residential Tenancy Act. This Privacy Policy describes how we collect, use, disclose, and protect your personal information in accordance with the British Columbia Personal Information Protection Act ("BC PIPA") and the Personal Information Protection and Electronic Documents Act ("PIPEDA").
By creating an account or using the Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy.
2. Information We Collect
2.1 Information You Provide
- Account Information: Name, email address, and role (tenant or landlord) when you register
- Case Information: Details about your tenancy situation that you share during conversations with Randy, including issue descriptions, dates, addresses, and other facts relevant to your inquiry
- Form Data: Information you provide when completing Residential Tenancy Branch (RTB) forms through our Service, including names, addresses, phone numbers, and tenancy details
- File Uploads: Documents, images, or other files you upload during conversations (e.g., tenancy agreements, notices, photographs)
- Consultation Details: Information related to booking consultations, including preferred dates and times
2.2 Information Collected Automatically
- Session Data: Session identifiers, conversation timestamps, and conversation state
- Usage Data: Interactions with the Service, features used, and pages visited
- Device Information: Browser type, operating system, and IP address
2.3 Information We Do Not Collect
- We do not collect financial or payment card information (payment processing, when available, is handled by third-party payment processors)
- We do not use cookies for advertising or tracking purposes
3. How We Use Your Information
We use your personal information for the following purposes:
- Providing the Service: To operate Randy BC AI, generate responses to your inquiries, pre-fill RTB forms, and manage your tenancy cases
- Account Management: To create and maintain your account, authenticate your identity, and manage your sessions
- Service Improvement: To understand how the Service is used and to improve its accuracy and functionality
- Communications: To send you service-related notifications (e.g., form completion confirmations, appointment reminders)
- Legal Compliance: To comply with applicable laws, regulations, and legal processes
- Security: To detect, prevent, and address fraud, unauthorized access, and other illegal activities
4. Data Storage and Residency
All personal data is stored in Canada. Specifically:
- User accounts, cases, conversations, form drafts, file attachments, and audit logs are stored on servers located in Canada Central (Supabase Pro, Canadian data center)
- Signed documents and form templates are stored on servers located in Toronto, Ontario, Canada (DigitalOcean Canadian data center)
We are committed to keeping your personal information within Canadian jurisdiction.
5. Cross-Border Data Processing
Your data may be processed by service providers located in the United States for the purpose of providing the Service. These services process data transiently and do not permanently store your personal information:
- Anthropic (Claude AI): Our AI provider processes your chat messages to generate responses. Anthropic operates as a stateless API — your messages are processed and a response is returned, but your personal information is not retained by Anthropic after the interaction.
- Cloudflare Workers: Our form creation service relays form data to generate RTB documents. Data passes through but is not stored.
- n8n Cloud: Our workflow orchestration platform processes session data during interactions. Only temporary execution logs are maintained.
In accordance with BC PIPA and PIPEDA, we notify you that your personal information may be transferred to jurisdictions outside of Canada for processing, where it may be subject to the laws of those jurisdictions, including laws that may permit access by courts, law enforcement, and national security authorities. We ensure appropriate contractual safeguards are in place with all third-party processors to provide a comparable level of protection.
6. Disclosure of Your Information
We do not sell, rent, or trade your personal information. We may disclose your information in the following circumstances:
- Service Providers: To third-party service providers who assist us in operating the Service (as described in Section 5), subject to contractual obligations to protect your information
- Legal Requirements: When required by law, regulation, legal process, or governmental request
- Protection of Rights: To protect the rights, property, or safety of My Roof Group Ltd., our users, or the public
- Consent: With your express consent for any purpose not described in this Privacy Policy
- Business Transfer: In connection with a merger, acquisition, or sale of assets, provided the successor entity is bound by this Privacy Policy
7. Data Retention
- Active account data is retained for as long as your account is active
- Archived cases are anonymized (personal identifiers removed) but case structure is retained for service improvement
- Conversation logs are retained for the duration of your session and stored in your case history
- Uploaded files are retained as long as the associated case is active; files are anonymized when a case is archived
- Audit logs are retained for a minimum of 24 months as required for compliance purposes
You may request deletion of your account and associated data at any time by contacting us (see Section 13).
8. Data Security
We implement reasonable security measures to protect your personal information, including:
- Encryption in transit (TLS/HTTPS) for all data transmissions
- Encryption at rest (AES-256) for stored data
- Row-Level Security (RLS) policies that restrict data access to authorized users only
- Private file storage with time-limited signed URLs (1-hour expiry)
- Separation of API keys (public anon key for frontend, service key restricted to server-side only)
- Audit trail logging for all case operations
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
9. Data Breach Notification
In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will:
- Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible
- Notify affected individuals as soon as feasible, including a description of the breach, the type of information involved, and steps individuals can take to reduce their risk of harm
- Maintain records of all breaches for a minimum of 24 months
10. Your Privacy Rights
Under BC PIPA and PIPEDA, you have the right to:
- Access your personal information held by us
- Correct inaccurate or incomplete personal information
- Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
- Request deletion of your personal information
- File a complaint with the Office of the Information and Privacy Commissioner for British Columbia (OIPC) or the Office of the Privacy Commissioner of Canada (OPC)
To exercise any of these rights, contact us using the information in Section 13.
11. Children's Privacy
The Service is intended for individuals who are at least 19 years of age (the age of majority in British Columbia). We do not knowingly collect personal information from individuals under 19. If we become aware that we have collected personal information from a person under 19 without appropriate parental consent, we will take steps to delete that information.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on the Service and updating the "Last Updated" date. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our privacy practices, please contact:
My Roof Group Ltd.
Privacy Officer
Email: privacy@myroofgroup.com
Website: https://myroofgroup.com
You may also contact the Office of the Information and Privacy Commissioner for British Columbia:
Or the Office of the Privacy Commissioner of Canada:
Randy BC AI
Back to Login