Privacy Policy
My Roof Group Ltd. · Effective Date: February 20, 2026 · Last Updated: March 23, 2026
1. Introduction
My Roof Group Ltd. ("we," "us," "our," or the "Company") operates the Randy BC™ Tenancy Assistant (the "Service"), an artificial intelligence-powered assistant that provides general information about the British Columbia Residential Tenancy Act. The Service is available at randybc.ca and through our mobile application.
This Privacy Policy describes how we collect, use, disclose, and protect your personal information in accordance with British Columbia's Personal Information Protection Act ("PIPA") and the Personal Information Protection and Electronic Documents Act ("PIPEDA").
By creating an account or using the Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy.
2. Information We Collect
2.1 Information You Provide
- Account Information: Name, email address, phone number, and role (tenant or landlord) when you register.
- Case Information: Details about your tenancy situation that you share during conversations with Randy, including issue descriptions, dates, addresses, and other facts relevant to your inquiry.
- Form Data: Information you provide when completing Residential Tenancy Branch (RTB) forms through our Service, including names, addresses, phone numbers, and tenancy details.
- File Uploads: Documents, images, or other files you upload during conversations (e.g., tenancy agreements, notices, photographs). Files are limited to 10 MB each and restricted to approved file types.
- Consultation Details: Information related to booking consultations, including preferred dates and times.
2.2 Information Collected Automatically
- Session Data: Login session identifiers used to manage active sessions and prevent unauthorized account sharing.
- Usage Data: Timestamps of interactions, features used, and conversation metadata.
- Device Information: Browser type, operating system, and screen size to ensure the Service functions correctly.
2.3 Information We Do Not Collect
- We do not collect financial information such as credit card numbers. Payment processing is handled entirely by our payment processor; we never see or store your payment details.
- We do not use cookies for advertising or tracking purposes.
3. How We Use Your Information
We use your personal information for the following purposes:
- Providing the Service: Powering AI-assisted conversations about BC tenancy law, generating and pre-filling RTB forms, analyzing uploaded documents, and managing your tenancy cases.
- Account Management: Creating and maintaining your account, authenticating your identity, managing your subscription, and enforcing session limits.
- Service Improvement: Reviewing conversations to improve Randy's accuracy, correct errors, and update our knowledge base.
- Communications: Sending service-related notifications such as account confirmations, form completion confirmations, and important updates.
- Security: Detecting, preventing, and addressing fraud, unauthorized access, and other illegal activities.
- Legal Compliance: Complying with applicable laws, regulations, and legal processes.
4. Third-Party Services
To deliver the Service, we share certain data with the following categories of third-party providers:
| Service Category |
Purpose |
Data Shared |
| AI processing providers |
Natural language understanding and document analysis |
Conversation messages, uploaded documents |
| Cloud database and authentication |
User authentication, data storage, file management |
Account data, conversations, uploaded files |
| Cloud hosting provider |
Server hosting (Canadian data centre) |
Application data processed on our servers |
| Payment processor |
Payment processing |
Billing information (handled directly by payment processor) |
| Document generation engine |
RTB form generation and signing |
Form field data for document creation |
| CDN and security provider |
Content delivery and form relay |
Form data (processed transiently, not stored) |
| Workflow automation |
Service orchestration |
Session data (temporary execution logs only) |
Each third-party provider operates under its own privacy policy and is contractually required to protect your data. We do not sell, rent, or trade your personal information to any third party.
5. Data Storage and Residency
5.1 Where Your Data Is Stored
- User accounts, cases, conversations, and file attachments: Stored on cloud infrastructure hosted in Canadian data centres.
- Signed documents and form templates: Stored on dedicated servers located in Toronto, Ontario, Canada.
Your data is primarily stored and processed within Canada.
5.2 Cross-Border Data Processing
Some data may be processed in the United States through our cloud providers for the purpose of providing the Service. These services process data transiently and do not permanently store your personal information.
In accordance with PIPA and PIPEDA, we notify you that your personal information may be transferred to jurisdictions outside of Canada for processing, where it may be subject to the laws of those jurisdictions, including laws that may permit access by courts, law enforcement, and national security authorities. We ensure appropriate contractual safeguards are in place with all third-party processors to provide a comparable level of protection.
6. AI-Specific Disclosures
Randy is an AI-powered assistant. When you use the Service:
- Your messages are sent to third-party AI providers for processing. These providers may process your data on servers outside Canada.
- AI-generated responses are informational and do not constitute legal advice. Always verify information with a qualified legal professional.
- We may review conversations to improve the accuracy and quality of Randy's responses. Reviewed conversations are accessed only by authorized personnel.
- We do not use your conversations to train third-party AI models. Our use of AI provider APIs is subject to their respective enterprise data processing terms, which prohibit using customer data for model training.
7. Disclosure of Your Information
We do not sell, rent, or trade your personal information. We may disclose your information in the following circumstances:
- Service Providers: To third-party service providers who assist us in operating the Service (as described in Section 4), subject to contractual obligations to protect your information.
- Legal Requirements: When required by law, regulation, legal process, or governmental request.
- Protection of Rights: To protect the rights, property, or safety of My Roof Group Ltd., our users, or the public.
- Consent: With your express consent for any purpose not described in this Privacy Policy.
- Business Transfer: In connection with a merger, acquisition, or sale of assets, provided the successor entity is bound by this Privacy Policy.
8. Data Retention
- Account data: Retained for as long as your account is active, plus a reasonable period afterward to comply with legal obligations.
- Conversation history: Retained for the duration of your account to allow you to review past interactions and for service quality assurance.
- Uploaded files: Retained while associated with an active case. You may request deletion at any time.
- Archived cases: Personal identifiers are removed; case structure may be retained for service improvement.
- Session logs: Automatically purged when sessions expire or are replaced.
- Audit logs: Retained for a minimum of 24 months for compliance purposes.
When you delete your account, we will remove your personal information within 30 days, except where retention is required by law.
9. Data Security
We implement reasonable technical and organizational safeguards to protect your personal information, including:
- Encryption of all data in transit using industry-standard TLS protocols.
- Encryption at rest for all stored data.
- Database-level access controls to isolate user data.
- Private file storage with restricted file types and time-limited access URLs.
- Secure authentication with concurrent session limits.
- Separation of credentials between client-facing and server-side systems.
- Administrative access restricted to authorized personnel.
- Audit trail logging for all case operations.
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
10. Data Breach Notification
In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will:
- Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible.
- Notify affected individuals as soon as feasible, including a description of the breach, the type of information involved, and steps individuals can take to reduce their risk of harm.
- Maintain records of all breaches for a minimum of 24 months.
11. Your Privacy Rights
Under PIPA and PIPEDA, you have the following rights regarding your personal information:
- Access: You may request a copy of the personal information we hold about you.
- Correction: You may request corrections to inaccurate or incomplete personal information.
- Deletion: You may request that we delete your personal information, subject to legal retention requirements.
- Withdrawal of Consent: You may withdraw your consent for the collection, use, or disclosure of your personal information at any time. Note that withdrawing consent may limit your ability to use the Service.
- Complaint: You have the right to file a complaint with the Office of the Information and Privacy Commissioner for British Columbia (OIPC) or the Office of the Privacy Commissioner of Canada (OPC).
To exercise any of these rights, contact us at info@myroofgroup.com. We will respond to your request within 30 days.
12. Children's Privacy
The Service is intended for individuals who are at least 19 years of age (the age of majority in British Columbia). We do not knowingly collect personal information from individuals under 19. If we become aware that we have collected personal information from a person under 19 without appropriate parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at info@myroofgroup.com.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the "Effective Date" and "Last Updated" date at the top of this page.
- Notify registered users by email or through an in-app notice.
Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
My Roof Group Ltd.
British Columbia, Canada
Email: info@myroofgroup.com
You may also contact the Office of the Information and Privacy Commissioner for British Columbia:
Or the Office of the Privacy Commissioner of Canada:
Randy BC
Back to Login