Privacy Policy

The controller of your personal data is Kabanalouer, operating the platform at kabanalouer.ca.

For any questions regarding the protection of your data, you may contact our Privacy Officer at: info@kabanalouer.ca

We collect the following categories of data:

Your data is used to:

• Create and manage your user account.
• Display your listings to travelers on the platform.
• Enable communication between owners and travelers via the built-in messaging system.
• Process subscription payments via Stripe.
• Send transactional notifications (new messages, subscription expiry, etc.).
• Improve the platform by analyzing browsing behavior (aggregated and anonymized data).
• Comply with our legal and regulatory obligations.
• Handle your feedback and reports, fix technical errors and improve the platform, including automated sorting of your feedback by Anthropic's AI.

We never sell your data. Only with your consent (see section 7), the Meta Pixel sends Meta information about your visit (pages viewed, request sent, sign-up) to measure how well our Facebook and Instagram ads work and show them to people likely to be interested.

We engage trusted service providers to operate the platform. These third parties act as processors and may only use your data for the purposes for which we have engaged them.

• Supabase : Database and authentication. Data stored on AWS servers (us-east-1 region). Policy: supabase.com/privacy
• Vercel : Platform hosting and deployment. Access logs retained according to Vercel's policy. Policy: vercel.com/legal/privacy-policy
• Stripe : Owner subscription payment processing. Stripe is PCI-DSS certified. Policy: stripe.com/privacy
• Google Analytics : Web traffic analysis (aggregated and anonymized data). IP addresses are truncated. Only with your consent (see section 7). Policy: policies.google.com/privacy
• Anthropic (Claude AI) : Writing help (descriptions, titles, bio), listing import and listing translation; automated sorting of feedback sent with “Ideas or issues?” (the message is sent, without your name or email). Data sent through the API is not used to train Anthropic's models. Policy: anthropic.com/legal/privacy
• Google Cloud Translation : Automatic French-English translation of messages and reviews. Only the text to translate is sent. Policy: policies.google.com/privacy
• Resend : Sending platform emails (account confirmation, notifications). Your email address and the email content are sent. Policy: resend.com/legal/privacy-policy
• Twilio : Sending text notifications, only if you turn them on. Your mobile number and the message text are sent. Policy: twilio.com/legal/privacy
• Meta (Meta Pixel) : Measuring our ads on Facebook and Instagram: pages viewed and actions on the site (request sent, sign-up), linked to a browser identifier. Only with your consent (see section 7). Meta may process this data outside Québec. Policy: facebook.com/privacy/policy

Beyond these service providers, we do not share your data with any third party, except as required by law (response to a competent authority, court order).

In accordance with Quebec's Law 25, you have the following rights regarding your personal information:

• Right of access : You may request to view the personal information we hold about you.
• Right to rectification : You may request the correction of inaccurate, incomplete, or ambiguous information.
• Right to erasure : You may request the deletion of your personal information, subject to our legal retention obligations.
• Right to data portability : You may request to receive your personal information in a structured, commonly used technological format.
• Right to de-indexing : In certain circumstances, you may request that a hyperlink providing access to your information be de-indexed.
• Right to object : You may object to the use of your data for certain purposes, particularly for communication purposes.

To exercise these rights, send your request to info@kabanalouer.ca. We will process your request within 30 days.

• Active account : Your data is retained for the lifetime of your account.
• Expired subscription : Your listing data remains stored indefinitely after your subscription expires, so you can renew at any time. No automatic deletion is applied.
• Deleted account : Your personal data is deleted within 30 days of account deletion. Data required to meet our legal obligations (billing) may be retained longer.
• Messaging : Messages are retained as long as both accounts involved exist. Deleting an account results in the anonymization of associated messages.
• Browsing data : Access logs are retained according to Vercel's policies (generally 30 days). Google Analytics data is aggregated and retained for 14 months. Meta Pixel data is retained by Meta under its policy (_fbp cookie: 90 days).
• Feedback and technical data : Feedback you send us is kept for 24 months, technical error reports for 12 months after they last occurred, and anonymous visit totals for 25 months.

We use the following types of cookies:

• Essential cookies : Required for platform operation (authentication session, navigation preferences). Cannot be disabled.
• Audience measurement cookies (with your consent) : Google Analytics, to understand how the platform is used. Off by default: they are only enabled if you click “Accept” in the banner shown on your first visit. Data kept for 14 months.
• Advertising cookies (with your consent) : Meta Pixel, to measure how well our Facebook and Instagram ads work. Off by default: they are only enabled if you accept advertising in the banner (“Accept” or “Customize”). _fbp cookie kept for 90 days.

You can change your mind at any time with the “Manage cookies” link at the bottom of every page: if you withdraw consent, the related cookies are deleted. We also measure, without any cookie or identifier, how many visits go through each step of the site (anonymous daily totals), and we log technical errors to fix them.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, modification, or destruction:

• Data transmission encrypted via HTTPS (TLS 1.2+).
• Passwords hashed with bcrypt (via Supabase Auth).
• Database access restricted by Row Level Security (RLS).
• Sensitive API keys stored as environment variables, never exposed client-side.
• Regular review of access and permissions within our team.

In the event of a data breach likely to create serious risk to your rights, we will notify you within the timeframes required by law (72 hours for authorities, as soon as possible for affected individuals).

For any questions, requests to exercise your rights, or complaints about the processing of your personal data, contact us at:

info@kabanalouer.ca

If you believe your rights are not being respected, you may also file a complaint with the Commission d'accès à l'information du Québec (CAI).