Privacy policy
Effective 2026-10-17. This policy covers Rental Deal Analyzer, the hosted service, run by Songeko Software, referred to here as "we." If a local version is still distributed, that version sends nothing to us; this policy is about the hosted service.
- Version
- 2.4.0
- Last updated
- 2026-10-25
The short version
- The free analysis runs on our servers. What you type is sent there, worked out, and sent back. We don't save it.
- If you buy a report, The PDF is stored privately for 24 hours, counted from when your purchase completes. When that window ends, access ends immediately; an automated cleanup deletes the file soon after, though not always at the exact second.
- Card details go to Stripe, our payment processor. They never reach our servers.
- A one-off purchase needs no account and no sign-in. The checkout form asks for an email address, because Stripe needs one to confirm a payment; depending on your payment method, it may also ask for a billing name, country or postal code. All of it goes to Stripe, not to us.
- We don't sell personal information, and we don't sell or share the listing content you upload.
- If you write to us through the contact form, your message goes to one mailbox that one person reads, with the address you gave for a reply. We use it to answer you. We keep it only as long as we need it to answer you and to have a record of what was asked.
Who is responsible
Songeko Software, New Brunswick, Canada. This is a home-based, one-person business with no public mailing address; the contact form is the fastest and most reliable way to reach us. The owner of Songeko Software is responsible for privacy here, and will give their name on request.
Songeko Software is a business name registered in New Brunswick, Canada. The business is run by one person as a sole proprietorship, not a corporation; the owner is the party responsible for personal information here and is named on the New Brunswick business registry.
What we collect, and why
When you run an analysis (free)
The figures and listing details you enter go to our servers so the analysis can run. The result comes back to your browser. We don't store your inputs, and we don't write them to our logs.
In your browser
The form keeps what you type in it, so a reload doesn't lose it. It also keeps any deal you choose to save, and your light or dark setting. These stay in your browser until you delete them; we can't see them. If you pick a language, a cookie remembers that choice (see Cookies below). A purchase adds one more, kept on its own clock: when you start one, your browser holds the figures and listing details that report is made from, along with the purchase's reference numbers. It is there so the report can still be produced when the payment form sends you back, or after a reload part-way through paying — delivery, not convenience: without it, a report you paid for can't be made at all. Nothing from the payment form goes into it. Your browser holds it for that purchase's 24-hour window, and it is removed once the window has closed; clearing your browser's data removes it sooner.
When you buy a report
- Session cookie. Before you pay, we set one cookie that links this browser to your purchase. It contains nothing about you. It lasts 24 hours. This cookie is required for a purchase, and it isn't something we can turn off: it is the only thing that ties a payment to the browser that made it, and there is no account or sign-in to fall back on. If your browser blocks cookies for this site, buying a report isn't possible. Running an analysis still works.
- Payment. A one-off purchase needs no account and no sign-in. The checkout form asks for an email address, because Stripe needs one to confirm a payment; depending on your payment method, it may also ask for a billing name, country or postal code. All of it goes to Stripe, not to us. Stripe gives us whether the payment went through, the amount and currency, and its reference numbers. We never see or store your full card number.
- Purchase record. With the payment, we ask Stripe to store a scrambled fingerprint of the report's inputs, the version of our software that made it, and the random session code. The fingerprint can't be turned back into your address or figures.
- The PDF. The report includes what you entered, such as the property address and your figures. The PDF is stored privately for 24 hours, counted from when your purchase completes. When that window ends, access ends immediately; an automated cleanup deletes the file soon after, though not always at the exact second.
- Download record. When a paid report is downloaded, we record which purchase it was for, when, and whether the whole file went out, along with what the request looked like: the IP address, the country, the browser's own description of itself, and Cloudflare's id for the request. It doesn't carry your name, your email address or the property address. It is how we can show a report was delivered if a payment is disputed later, and it is what a refund request is checked against. We keep it for 120 days, the usual window for a card dispute.
When you write to us
The contact form asks for two things: the message you write, and an address for us to reply to. We use them to answer you, and for nothing else. Your message is emailed to one mailbox, which one person reads, and the reply comes from there; our servers hold it only for as long as the request that sends it takes, and it goes into no database of ours. That mailbox is on this site's own domain and no separate email service sits in between, so the copies that last are the one in the mailbox, the one in your own sent mail, and whatever the company that runs the mail for our domain holds while it is there. We keep it only as long as we need it to answer you and to have a record of what was asked. You can ask us to delete it, under Your choices and requests below.
Operational logs
Our hosting providers record standard request data: IP address, time, the page or service requested, and the result. We use it to keep the service running and to stop abuse, for example rate limits. These logs are kept for 30 days.
What we don't do
We use no advertising or cross-site trackers, and one analytics product: Cloudflare Web Analytics, which measures how quickly pages actually loaded for the people visiting them. We don't sell personal information. We don't sell, license or share the listing content you upload, and we don't use it to train AI models. We don't build a profile of you. The analytics sets no cookie and keeps nothing in your browser; each page view gets a one-off number that is stored nowhere, so two visits can't be tied together; and nothing in it follows you to another site. The code running in your browser that is Cloudflare's rather than ours is its check for automated traffic and its page-timing analytics, both described under Cookies and browser scripts below.
Cookies and browser scripts
- Session cookie — set by us, only when you start a purchase. Links this browser to what you bought. Lasts 24 hours.
- Payment cookies — set by Stripe inside its own payment form, for payment security and fraud checks.
- Language cookie — set only when you press a language button. Remembers that choice, and holds nothing else. Lasts up to a year.
The session and payment cookies are needed for the service to work, and the session cookie is the one a purchase can't go ahead without. The language cookie isn't needed: without it, the site uses your browser's language if it offers that language, and English otherwise. There are no advertising or tracking cookies.
Cloudflare's check for automated traffic
Cloudflare, the network in front of this site, runs a small script in your browser to tell automated traffic from people. It reads signals about your browser and device for that purpose. It is Cloudflare's, not ours; we never see what it reads, and it is neither advertising nor the page-timing analytics described below. Cloudflare also asks your browser to report failed or timed-out requests to a Cloudflare address, so that problems between you and this site are visible to it, and it may load a page early if it looks like you are about to open it.
Page-timing analytics
A second Cloudflare script measures timing: how long this site's pages took to appear for you, on your device and your connection. It reads the page address, where you arrived from, your browser's own description of itself and a rough idea of your connection speed, and reports how long things took. It sets no cookie, keeps nothing in your browser, and reads none of the device details that would make your browser recognisable. The numbers go to Cloudflare and we see them as totals. It is here for one reason: it is the only way we can find out how the site behaves on a real phone on a real network, rather than on a simulation of one.
Who processes data for us
- Vercel — serves the website. Handles your requests, including what you type, in transit, and request logs.
- Cloudflare — the network in front of this site, the servers that run the analysis and make the PDF, private file storage (R2), and page-timing analytics. Every request to this site reaches Cloudflare first, so it handles your requests, including what you type, in transit and while the analysis runs, and keeps its own request logs. It also holds the stored file for 24 hours, hands the paid PDF to your browser when you download it, and records that the download happened. Its analytics script measures how quickly pages loaded for you and reports those timings to Cloudflare.
- Stripe — payments. Handles card and billing details and payment records. A one-off purchase needs no account and no sign-in. The checkout form asks for an email address, because Stripe needs one to confirm a payment; depending on your payment method, it may also ask for a billing name, country or postal code. All of it goes to Stripe, not to us.
- Our mail host — runs the support mailbox on this site's own domain. A message sent through the contact form, and the address given for a reply, arrive there as ordinary email and stay in that mailbox. No separate email-sending service is used, so nothing about your message is handed to a party that is not on this list.
Stripe also uses payment data for its own fraud prevention, under Stripe's own privacy policy.
Where this runs
Your request reaches Cloudflare first, at whichever of its locations is nearest to you; if you are outside Canada, so is that location, and Cloudflare is a United States company. Vercel serves the website from Montreal, Canada. The analysis and the PDF run on Cloudflare's servers. We haven't been able to confirm which region those servers, or the R2 storage where a paid PDF is held, run in; until we can, treat both as potentially outside Canada. Data processed outside Canada is subject to that country's laws.
How long we keep things
- Your inputs, on our servers — not kept after the response.
- Generated PDF — The PDF is stored privately for 24 hours, counted from when your purchase completes. When that window ends, access ends immediately; an automated cleanup deletes the file soon after, though not always at the exact second.
- Download link — 60 seconds after it is made.
- Session cookie — 24 hours.
- Language cookie — up to a year.
- Download record — 120 days, the usual window for a card dispute.
- Payment records, in Stripe — kept by Stripe under its own financial record-keeping rules, not ours to set.
- Hosting logs — 30 days.
- Data in your browser (the form, deals you save, your appearance setting) — until you delete it.
- Pending purchase, in your browser — 24 hours, the same window as the purchase it belongs to; removed once that window has closed.
- Your message to the support mailbox, with the reply address you gave — kept only as long as we need it to answer you and to have a record of what was asked.
Your choices and requests
You can see, correct or delete personal information we hold about you. Send a privacy request through the contact form. We answer within 30 days.
A one-off purchase has no account, so we may ask for something that ties you to the payment, such as the Stripe receipt number, or the date, amount and last four digits of the card.
Some records we must keep. Deleting a PDF doesn't delete the payment record Stripe keeps for tax and fraud rules. We can delete a PDF before its deadline if you ask.
You can clear what's kept in your browser yourself, on the Saved deals page or in your browser settings.
If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or the privacy regulator for your province.
Security
The PDF storage is private; no file is public. A download link is made only after we check your purchase. Each download link works for 60 seconds after it is made. A new link can be requested until the 24-hour window closes. Card details never touch our servers. No system is perfectly secure. If a breach puts you at real risk of significant harm, we'll tell you and the Privacy Commissioner, as the law requires.
Who this is for
The service is meant for people 18 or older. We don't knowingly collect personal information from anyone younger.
Changes
If this policy changes, we'll update the date at the top. If the change is significant, we'll say so on the site before it takes effect.