Legal
Privacy Policy
Last updated: May 2026
This privacy policy describes how Kabanalouer ("we", "our") collects, uses, and protects your personal data when you use the platform at kabanalouer.ca. It complies with the Act to modernize legislative provisions as regards the protection of personal information (Law 25, Quebec) and the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada).
1. Data controller
The controller of your personal data is Kabanalouer, operating the platform at kabanalouer.ca.
For any questions regarding the protection of your data, you may contact our Privacy Officer at: support@kabanalouer.ca
2. Data collected
We collect the following categories of data:
Registration data
- Email address
- First and last name
- Password (stored in hashed form, never in plain text)
- Role (owner or traveler)
Listing data (owners)
- Cabin information (title, description, address, amenities, rates)
- Uploaded photos
- CITQ number
- Availability calendar and iCal links
Browsing data
- IP address
- Browser type and operating system
- Pages visited and session duration
- Traffic source (referrer)
Messaging data
- Content of messages exchanged between owners and travelers via the platform
- Message timestamps
Payment data (owners)
- We do not store your payment data. Transactions are processed directly by Stripe. We only retain your Stripe subscription ID.
3. Use of data
Your data is used to:
- Create and manage your user account.
- Display your listings to travelers on the platform.
- Enable communication between owners and travelers via the built-in messaging system.
- Process subscription payments via Stripe.
- Send transactional notifications (new messages, subscription expiry, etc.).
- Improve the platform by analyzing browsing behavior (aggregated and anonymized data).
- Comply with our legal and regulatory obligations.
We do not use your data for targeted advertising to third parties and never sell it.
4. Data sharing
We engage trusted service providers to operate the platform. These third parties act as processors and may only use your data for the purposes for which we have engaged them.
- Supabase : Database and authentication. Data stored on AWS servers (us-east-1 region). Policy: supabase.com/privacy
- Vercel : Platform hosting and deployment. Access logs retained according to Vercel's policy. Policy: vercel.com/legal/privacy-policy
- Stripe : Owner subscription payment processing. Stripe is PCI-DSS certified. Policy: stripe.com/privacy
- Google Analytics : Web traffic analysis (aggregated and anonymized data). IP addresses are truncated. Policy: policies.google.com/privacy
- Anthropic (Claude AI) : Automatic listing description generation (optional feature). Only listing content is transmitted, with no personally identifiable data. Policy: anthropic.com/privacy
Beyond these service providers, we do not share your data with any third party, except as required by law (response to a competent authority, court order).
5. Your rights (Law 25)
In accordance with Quebec's Law 25, you have the following rights regarding your personal information:
- Right of access : You may request to view the personal information we hold about you.
- Right to rectification : You may request the correction of inaccurate, incomplete, or ambiguous information.
- Right to erasure : You may request the deletion of your personal information, subject to our legal retention obligations.
- Right to data portability : You may request to receive your personal information in a structured, commonly used technological format.
- Right to de-indexing : In certain circumstances, you may request that a hyperlink providing access to your information be de-indexed.
- Right to object : You may object to the use of your data for certain purposes, particularly for communication purposes.
To exercise these rights, send your request to support@kabanalouer.ca. We will process your request within 30 days.
6. Data retention
- Active account : Your data is retained for the lifetime of your account.
- Expired subscription : Your listing data remains stored indefinitely after your subscription expires, so you can renew at any time. No automatic deletion is applied.
- Deleted account : Your personal data is deleted within 30 days of account deletion. Data required to meet our legal obligations (billing) may be retained longer.
- Messaging : Messages are retained as long as both accounts involved exist. Deleting an account results in the anonymization of associated messages.
- Browsing data : Access logs are retained according to Vercel's policies (generally 30 days). Google Analytics data is aggregated and retained for 14 months.
8. Data security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, modification, or destruction:
- Data transmission encrypted via HTTPS (TLS 1.2+).
- Passwords hashed with bcrypt (via Supabase Auth).
- Database access restricted by Row Level Security (RLS).
- Sensitive API keys stored as environment variables, never exposed client-side.
- Regular review of access and permissions within our team.
In the event of a data breach likely to create serious risk to your rights, we will notify you within the timeframes required by law (72 hours for authorities, as soon as possible for affected individuals).
9. Policy changes
We may update this privacy policy to reflect changes in our practices or to comply with legal requirements. For material changes, we will notify you by email or via a visible notice on the platform at least 15 days before the changes take effect. The date of the last update is shown at the top of this page.
10. Contact
For any questions, requests to exercise your rights, or complaints about the processing of your personal data, contact us at:
If you believe your rights are not being respected, you may also file a complaint with the Commission d'accès à l'information du Québec (CAI).