Privacy Policy

Your information, and what we do with it

Last updated September 22, 2026

Diverse Innovations Inc. operates Renewal Option. This policy explains what personal information we collect, why, who we share it with, and what you can do about it. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies to you, the GDPR and UK GDPR.

Questions, requests, or complaints: support@renewaloption.ca

What we collect

Information you give us

  • Account information: your email address. We do not use passwords, so we never collect or store one. Sign-in works by sending a single-use link or a sign-in code to your email address.
  • Documents you upload: your lease, agreement to lease, or other file you submit. We read the file once to extract its text, and we keep the extracted text, not the original file. That text commonly contains your business name, the premises address, rent and financial terms, and the names of the parties.
  • Questionnaire answers: your responses about timing, financial position, priorities, the premises, your province, and your landlord relationship.
  • Assistant conversations: if you use the assistant on our public pages, what you type or say to it and its replies, kept as a text transcript. Voice is converted to text and not recorded. The assistant cannot see your account, and you should not share lease details or other personal information with it.
  • Call requests: if you ask us to call you, your name, business name, phone number, the month your lease ends and the best time to call if you give them, and an email address if you choose to. We also keep a record of the consent you gave: the exact wording you agreed to, when, and the page you were on, together with the “how you found us” details described below.
  • Correspondence and feedback: anything you send us by email or through the feedback control in the app, including a contact email address if you choose to give one.

Information generated by your use

  • Analysis outputs: the findings, grades, and reports produced from your documents, and a set of key lease facts extracted from them (for example province, commencement and expiry dates, area, rent structure, and renewal notice timing).
  • Purchase records: the details of each purchase, including the transaction identifier, amount, product, date, and entitlement status. Payment card details are handled by Paddle; we never receive or store them.
  • How you found us: if you arrive from another website, or from a link or advertisement carrying campaign tags, we record the campaign details in the link, the advertising platform’s click identifier if there is one, the page you landed on, and the name of the referring website (its domain only, never the full address). If you then create an account, this is attached to it once and not updated afterwards. A visit that arrives directly records nothing.
  • Technical and usage data: IP address, browser and device type, pages requested, and timestamps, collected in server and security logs.

Why we use it, and on what basis

Create and operate your account; produce and deliver your analysis
Basis: Performance of our contract with you
Process payments and keep purchase records
Basis: Contract; legal obligation (tax and accounting)
Provide support and respond to you
Basis: Contract; our legitimate interests
Call you about Renewal Option, and email or text you, only if you asked us to
Basis: Your express consent, which you can withdraw at any time
Keep the Service secure, prevent abuse, enforce service limits, debug faults
Basis: Our legitimate interests
Retain your documents and history so you can return to them
Basis: Your consent
Understand which advertising and links bring people to the Service
Basis: Our legitimate interests
Improve the Service using de-identified, aggregated information
Basis: Our legitimate interests
Send you product emails, if you opt in
Basis: Your consent

We do not use your documents or questionnaire answers for advertising, and we do not sell personal information to anyone.

Automated processing

Your analysis is produced automatically, including by an AI model. It is an informational report: it does not decide anything about you, and it produces no legal or similarly significant effect on its own. You remain free to disregard it, and our Terms tell you plainly that you should verify it and take independent legal advice. If you want a person to look at a result you think is wrong, email us.

Who we share it with

We use service providers to run the Service. They act on our instructions and may only use the information to provide their service to us:

  • Supabase: database and authentication. The text of your documents and your analyses are stored in Supabase’s Canadian region (ca-central-1).
  • Vercel: application hosting and delivery.
  • Anthropic: artificial intelligence processing of your document to produce the analysis. Anthropic does not use content submitted through its API to train its models.
  • Paddle.com Market Limited: payment processing, invoicing, and sales tax, as merchant of record.
  • Resend: email delivery.
  • ElevenLabs: runs the assistant on our public pages, including converting speech to text. It receives only what you say or type to the assistant. If you ask us to call you, the call may be made by our AI voice assistant, which also runs on ElevenLabs, through a telephone service provider.

We do not share the “how you found us” information with advertising platforms. It is used only by us, to understand which of our advertising and links bring people to the Service.

We may also disclose information where we are legally required to, to establish or defend a legal claim, or in connection with a sale or reorganisation of our business (in which case this policy continues to apply to the information transferred).

International transfers. Your documents and analyses are stored in Canada. Other parts of the Service are not: our AI processing and assistant providers operate in the United States, our payment processor in the United Kingdom and the European Union, and our hosting provider delivers the site from data centres worldwide. Information handled by those providers may be accessible to courts and authorities in those countries under their laws. Where the GDPR or UK GDPR applies, transfers rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

  • Your documents, questionnaire answers, and reports are kept while your account is open, so you can return to your lease history. You can delete any document at any time.
  • Deletion is real deletion. When you delete a document, we delete its extracted text, the questionnaire answers, and the analysis. We do not keep a hidden copy or a soft-deleted record. Short-term disaster-recovery backups held by our database provider are purged within 30 days.
  • Purchase records are kept separately and survive document deletion. If you have paid for a report, the record of that purchase (account identifier, transaction identifier, amount, product, date, entitlement status, and the name the document had at the time) is retained even after you delete the underlying document. This protects your proof of purchase and meets our tax and accounting obligations. Canadian tax law requires business records to be kept for six years from the end of the last tax year they relate to; we keep purchase records for seven years.
  • Account information, including how you found us, is deleted when your account is closed, apart from what we must retain as above.
  • Assistant conversations are kept as text transcripts for 30 days and then deleted automatically. No voice recordings are kept.
  • Call requests are deleted automatically 12 months after the month you told us your lease ends, or 12 months after your request if you did not give one. If you withdraw your consent, your request is deleted within 30 days. We keep your phone number on our internal do-not-call list, and nothing else, so that we never call it again.
  • Technical and security logs are kept for no longer than 30 days.

Your rights

You may:

  • access the personal information we hold about you;
  • correct it if it is wrong;
  • delete your documents from within the Service, and ask us to close your account;
  • withdraw consent to retention or marketing at any time (this may mean we can no longer provide parts of the Service). To stop calls, tell the caller or email us, and we will not call you again;
  • export your reports; and
  • complain to us first at support@renewaloption.ca and, if you are not satisfied, to the Office of the Privacy Commissioner of Canada, or to your local supervisory authority if you are in the EU or UK.

Where the GDPR or UK GDPR applies to you, you also have rights to restriction, objection, and data portability. We respond to requests within 30 days.

Security

We protect your information with:

  • encryption in transit (HTTPS/TLS) and encryption at rest through our infrastructure providers;
  • database-level row security, so your records are reachable only by your own account;
  • a database access key with no elevated privileges for everything you do in the app, so no signed-in user can grant themselves access to another account’s data or to a paid report. The one privileged key is held only on our server and used only to record payments and refunds Paddle has confirmed;
  • access controls limiting who can reach production systems; and
  • security headers and standard hardening on the application.

No system is perfectly secure. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Cookies

We use cookies that are necessary to run the Service: keeping you signed in, holding your session, and security.

We also set one first-party cookie, ro_acq, when you arrive from another website or from a link or advertisement carrying campaign tags. It holds the “how you found us” details described above, is read only by us, and expires after 90 days. It is not needed to use the Service, and blocking cookies does not stop anything from working.

Our public pages load the ElevenLabs assistant from ElevenLabs’ servers. As with any content loaded from another server, ElevenLabs receives your IP address and browser details when the page loads. A conversation is only created if you start one. The assistant does not load on the signed-in pages where your leases and reports are.

We do not use advertising cookies, and we do not run third-party analytics or tracking scripts. If that changes, we will update this policy before it does.

Children

The Service is a business tool and is not directed at children. Do not use it if you are under 18.

Changes

We may update this policy. Material changes will be posted on the site with an updated date, and where the change affects how we use information you have already given us, we will contact you.

Contact

Diverse Innovations Inc., Peterborough, Ontario, Canada
support@renewaloption.ca