Privacy policy

The person responsible

Mathis Desgagné is responsible for the protection of personal information at Dewin. Any question, or any request for access, correction or deletion, goes to notifications@getdewin.com and receives an answer within thirty days.

If that answer does not satisfy you, you may complain to Quebec's Commission d'accès à l'information. Outside Quebec, PIPEDA applies and the Office of the Privacy Commissioner of Canada receives complaints.

What Dewin collects, and why

To open and keep your account: your name, your email address, and a hash of your password. The password itself is never stored, and is readable by no one.

To run the product: what you enter into it — property addresses, prices, income, expenses, leases, tenant names, uploaded documents. This information is yours, and serves only to give it back to you.

For billing: your email address and the state of your subscription. Card numbers never pass through Dewin's servers: on the web, the payment page is Stripe's; in the mobile app, payment goes through Apple or Google.

For security: the IP address and time of a password reset request or a verification code, so that you can recognise a request that did not come from you. They appear in the email and are kept nowhere else.

To improve the journey: anonymous hourly counters group public page views, registration clicks, pricing views, calculator use, and guided analyses started and prepared, along with language, screen format, referring-site category and campaign labels. These counters, which are Dewin's own, contain no visitor identifier, IP address, full referring URL or fingerprint, and cannot reconstruct a visit — the separate HeyCatch measurement described further down works differently, and that section says so plainly. For accounts, we keep activity days and first milestone dates (useful analysis, property added, neighbourhood shared), without the contents of your records. They support aggregate administration statistics, are included in your export and disappear when the relevant account or workspace is deleted.

To know which advertisement works: if you arrived through a link carrying a campaign label, that label — three words, such as « google », « cpc » and the campaign's name — is kept with your account. It says nothing about you: no page visited, no advertising identifier, no browser fingerprint. It serves to add campaigns up, never to reconstruct a visit, it travels with your export, and it disappears with the account.

What Dewin does not do

No information is sold, rented or traded. Ever, to anyone, for any amount.

No advertising cookie, no social network pixel, no third-party tracker is placed in your browser. The cookies used keep your session open, remember your chosen language, and — if you asked to save a calculation made before you had an account — carry the figures you just entered through to your workspace, then erase themselves. The guided analysis flow instead keeps a dated draft — the property address or name, figures, extracted details and source — in this browser's local storage. Dewin stops using it after seven days and removes it the next time Dewin opens; it sends this draft into the workspace only after you sign in and ask to view the results, then removes it once the analysis is created. If you choose to have a link or file read before signing in, that source is sent immediately for reading, but only after the consent box described below; Dewin does not retain the raw source before sign-in. Local storage itself serves only to do what you requested, which is why no general consent banner is shown.

No decision about you is made automatically. Dewin's calculations are about buildings, never about people.

Where your data lives

The database and the documents you upload sit on a server located in Montreal, Quebec, at OVH. They do not leave Quebec.

Backups are encrypted at rest by the server's file system and are accessible only to the person responsible.

The six providers that receive something

Stripe (United States) processes payments. It receives your email address and the billing details you give it directly. Dewin never sees your card number.

Resend (United States) sends Dewin's emails. It receives your email address and the content of the message — a verification code, a reset link, a deadline reminder.

Groq (United States) powers assisted extraction, which reads a listing or a document to pull figures from it. In a workspace, this feature stays off until its owner turns it on in settings; while it is off, nothing is sent. In the public analysis before sign-in, the box immediately before submission gives one-time consent for that reading alone. Groq then receives the text of the listing or document submitted; Dewin does not retain the raw source before sign-in.

HeyCatch measures how the site and the app are used: pageviews, clicks, screen changes, and the outcomes that matter to us — a completed sign-up, a subscription starting. Unlike the counters described above, this measurement is tied to you by name once you have an account: it receives your account id, your email address, your name and your plan, so that usage attaches to a person rather than to an anonymous visitor. It receives nothing from inside your file: no property address, no rent, no expense, no document, no tenant name.

Expo (United States) relays push notifications to your phone, through Apple or Google. Nothing is sent until you accept notifications in the mobile app. It then receives your device's delivery token and the text of each notification — deliberately short: "Rent overdue · unit 3 · $1,250". It receives no tenant name, no property name and no address.

RevenueCat (United States) keeps the record of subscriptions bought in the mobile app. It is involved only if you buy a plan in the app. It then receives your Dewin account identifier and, from Apple or Google, the state of the purchase — product, dates, renewal. It receives neither your email address, nor your portfolio, nor your card numbers, which Apple and Google keep to themselves.

These six transfers leave Quebec. Each was assessed before being put in place, each is limited to what is necessary, and none transmits your file as a whole.

For how long

Your data is kept as long as your account exists. It is not deleted because a subscription ends: a property portfolio is held for decades, and losing its history by changing plan would make no sense.

When you delete your account, the portfolio, analyses, documents and uploaded files are permanently erased. Backups retain a trace for at most eight weeks, the length of their rotation, after which they are gone too.

Billing records are kept for six years, as tax law requires.

What you can require

To see what Dewin holds about you: the account export, in your settings, returns all of your data in a machine-readable format. It is available at any time, with or without a subscription, without having to ask.

To have inaccurate information corrected: most of it is editable directly in the application; for the rest, write to us.

To take your data elsewhere: the same export, in a structured and commonly used format.

To withdraw lasting consent to assisted extraction: a switch in your settings, with no consequence for the rest of the product. Before sign-in, simply leave the box unchecked: that consent is one-time and is never stored as a preference.

To have your account deleted: in your settings as well, without a service request and without a retention call.

If an incident occurs

Should a confidentiality incident presenting a risk of serious injury occur, the people concerned and the Commission d'accès à l'information would be notified promptly, and a record of the incident would be kept, as the law requires.

Changes to this policy

This policy carries its last-modified date at the top. A change affecting your rights or the nature of the information collected will be sent to you by email before it takes effect, rather than discovered afterwards.