Draft

DRAFT — pre-lawyer-review copy. The final version must be reviewed by Québec counsel and reflect Loi 25 obligations before launch.

Privacy Policy

Last updated: 2026-05-27 (draft)

This Privacy Policy explains what personal information HomyEvent collects, how we use it, who we share it with, how long we keep it, and how you exercise your rights under Québec's Loi sur la protection des renseignements personnels dans le secteur privé (Loi 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). The French-Canadian (fr-CA) version is the authoritative text for users located in Québec.

1. What information we collect

Account information you provide: email, display name, optional avatar, locale preference, and your acceptances of the Terms and this Privacy Policy. Listing information you submit: venue or provider details, photos and videos, availability, pricing, and other content you publish. Activity information generated by your use: messages, reviews, search and filter history (in aggregate). Payment metadata via Stripe — we do not store full card numbers. Limited technical metadata: a truncated IP address (last octet removed) and user-agent string, retained for security and abuse prevention.

3. Legal basis

We process your personal information under Loi 25 and PIPEDA on the following grounds: (a) your manifest, free, and informed consent given at signup and again whenever this Policy or the Terms change materially (Loi 25 §8; PIPEDA Principle 3); (b) the performance of our contract with you, the Terms of Service; (c) secondary uses compatible with the original purpose disclosed at collection, where permitted by Loi 25 §12 (for example, anonymized analytics on aggregate platform health); and (d) our legal obligations under Québec, Canadian, and applicable provincial law (tax, anti-fraud, court orders). We record consent capture as an audit row per user, per document type, with the document version hash, locale, timestamp, and truncated source IP — kept so we can demonstrate to the Commission d'accès à l'information that your consent was specific, informed, and given for each disclosed purpose.

4. When we share information

We share information only with sub-processors that need it to operate the Service. The complete list, by category and location: CockroachDB (primary database, Canadian region); Cloudflare (hosting, edge network, image storage; HQ United States with Canadian region for data at rest); Cloudflare Hyperdrive (database connection pooling, Canada); Better Auth (self-hosted authentication on our infrastructure, Canada); Stripe (payments and billing, United States and Ireland); Mapbox (map tiles and address autocomplete, United States); Resend (transactional email, United States); Google and Facebook (only if you choose them as identity providers, United States). Each sub-processor is bound by standard data-processing terms requiring a level of protection equivalent to Loi 25. §9 of the Terms also names these providers. We may share information when required by law, in response to a valid Canadian legal process, or to protect rights, safety, or property. We do not sell, rent, trade, or use your personal information to train AI models.

5. Cookies and tracking

We use essential cookies — session, CSRF, Stripe checkout — without which the Service cannot function; these are set without consent under Loi 25 §8.1 as strictly necessary. Non-essential cookies are off until you opt in via the cookie banner on your first visit, by category: (i) functional (locale, theme; first-party; expires after 1 year); (ii) analytics (aggregate usage; provider identified in the banner; expires after 13 months); (iii) location (map feature, third-party Mapbox; expires after session). You can change your cookie preferences at any time from the Privacy settings page, per category, and withdrawal of consent applies prospectively without affecting service functionality.

6. Your privacy rights

Under Loi 25 §28-45 and PIPEDA, you have the right to: (i) access the personal information we hold about you (free, within 30 days of request); (ii) request rectification of inaccurate or incomplete information; (iii) request deletion of your account and associated personal data; (iv) receive a portable copy of your data in a structured, commonly used format; and (v) withdraw consent for non-essential processing. You can exercise these rights at /dashboard/settings/privacy or by emailing privacy@homyevent.com. Deletion requests trigger a 30-day grace window during which the account is suspended but recoverable — you may cancel the deletion at any time before the window closes by signing in and re-confirming. Access and rectification requests continue to be served during the grace window. After the grace window closes, deletion is performed irrevocably and only the minimum legal-acceptance audit row is retained, de-identified, to demonstrate consent compliance.

7. Data retention

Account information is retained for the duration of your account plus the 30-day post-deletion grace window. Legal-acceptance audit rows (your record of accepting the Terms and Privacy Policy, with document version hash and timestamp) are retained for the duration of the account and may be retained in de-identified form after deletion — only the document version hash, acceptance timestamp, and locale are kept; the user identifier is replaced by a one-way pseudonym so the row demonstrates aggregate consent compliance without identifying you. Truncated IP addresses are retained for a maximum of 13 months and then nulled. Stripe billing records are retained as required by Canadian tax law (typically 7 years).

9. Data residency and international transfers

Your data is stored at rest in a CockroachDB cluster operating in a Canadian region (the exact region is published on our security page). Loi 25 §17 disclosure for transfers outside Québec: before any cross-border transfer, we conduct a privacy impact assessment (PIA) of the receiving jurisdiction. (i) Categories transferred: account identifiers, billing metadata, and (for Stripe) payment metadata; truncated technical metadata for analytics. (ii) Purposes: payments (Stripe), map tiles (Mapbox), transactional email delivery (Resend), social sign-in (Google, Facebook if you elect them). (iii) Receiving jurisdictions: United States (Stripe, Mapbox, Resend, Google, Facebook, Cloudflare HQ); Ireland (Stripe EU operations). (iv) Equivalent-protection assessment: each sub-processor is bound by standard contractual clauses providing a level of protection assessed as equivalent to Loi 25 by reference to Commission d'accès à l'information guidance. The Cloudflare edge network may route encrypted traffic through edge locations outside Canada for performance, but at-rest storage and processing of your personal information occur in Canada. You may request the PIA documentation by writing to privacy@homyevent.com.

10. Privacy officer and complaints

Under Loi 25 §3.1, the person with the highest authority at HomyEvent is the designated person responsible for the protection of personal information by default. That person may be reached at privacy@homyevent.com. We will publish the named privacy officer on this page once formally appointed; until then, contacting privacy@homyevent.com reaches the responsible person. We respond to privacy-related inquiries and access requests within 30 days of receipt. If you are not satisfied with our response, you have the right to lodge a complaint with the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca/) or the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/). We will also notify the Commission and affected users of any confidentiality incident presenting a serious risk of harm, as required by Loi 25 §3.5.