Legal
Privacy Policy
Last updated October 9, 2026. The plain-language summary is first; the full policy follows.
In short: We collect what we need to run hosts' booking sites, take payments and keep Rehostly safe. Our servers, database and files are in Canada, but some of the companies that help us (such as Stripe and our hosting and email providers) are outside Canada, mostly in the United States. We never see or store guests' card numbers, we don't sell personal information, and we don't use advertising trackers. When you book a stay, your host receives your details to provide it. You can ask to see, correct or delete your information by writing to support@rehostly.ca.
This policy explains how Rehostly handles personal information. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), where each applies.
1. Who we are and how to contact us
1.1 Rehostly is a Canadian-based company, built and run on Vancouver Island, British Columbia. In this policy, "Rehostly", "we", "us" and "our" mean Rehostly.
1.2 Our Privacy Officer is responsible for how we protect personal information and for this policy:
- Privacy Officer, Rehostly
- Email: support@rehostly.ca
1.3 Who this policy covers:
- Hosts: people with a Rehostly account who offer properties for rent.
- Guests: people who book, or start to book, a stay on a host's Rehostly site.
- Visitors: anyone who visits rehostly.ca or a host's site.
1.4 Hosts, guests and Rehostly. Each host runs their own booking site with Rehostly. When a guest books, the guest's details are shared with the host so the host can provide the stay. For those details:
- The host is responsible for how they use guest information to provide the stay and run their rental (for example, messages they send and records they keep). Questions about that should go to the host.
- Rehostly stores and processes guest information on the host's behalf to run their site and bookings. We also use it for our own purposes: processing payments and refunds, preventing fraud, providing support, keeping financial records and meeting legal requirements. For those uses, this policy applies and you can contact us directly.
If you are not sure who to ask, contact us and we will help.
2. What we collect
2.1 From hosts
| Type | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, phone number (if you give it), password (stored only in scrambled, hashed form by our sign-in provider), whether you asked for host tips and updates | You |
| Listings and sites | Property address and town, photos, descriptions, house rules, prices, fees, calendar and availability, check-in instructions, guest manual, your custom guest emails, site design, your own domain (if you connect one), and links to your Airbnb or Vrbo calendars | You |
| Payments and payouts | Your Stripe account ID and status, any verification steps Stripe still needs, payout schedule, the last four digits of your payout bank account, and records of payments, fees, transfers, refunds and payouts | Stripe and our system |
| Approval and fraud prevention | From your Stripe account: the name and any business name on it, email, phone number, the country of the account and of its address, currency, and for each payout bank account its country, currency, bank name, routing (transit and institution) number, last four digits and a "fingerprint" (a code that lets us tell whether two accounts use the same bank account without seeing the account number). Also our review notes and decision. | Stripe and our staff |
| Support | Messages and any screenshots or files you send us | You |
| AI writing helper | The details you enter to have text drafted (such as town, style, amenities and tone) | You |
| Technical | Sign-in records, IP address, browser and device type, pages used, and error logs | Your device and our providers |
Stripe collects identity documents, date of birth, Social Insurance Number and full bank account numbers directly from you to verify your Stripe account. We do not receive those. Stripe's own privacy policy applies to them.
2.2 From guests
| Type | What it includes | Where it comes from |
|---|---|---|
| Booking details | Name, email address, phone number, dates, number of guests and pets, your reason for staying (only if the host asks), cancellation reasons and messages about your booking | You |
| Payment | Amounts paid and refunded, payment status, and Stripe reference numbers. Your card is saved with Stripe (not with us) when a balance will be charged later | You, Stripe and our system |
| Host notes | Any notes your host adds to their guest list about you | The host |
| Technical | IP address, browser and device type, and error logs | Your device and our providers |
Card details. You enter your card details into Stripe's secure payment form. They go straight to Stripe. Rehostly never sees or stores your full card number or security code. Stripe also collects information about your device to help detect fraud when you pay.
2.3 From visitors
When you visit rehostly.ca, a host's site or the host dashboard, we collect:
- Analytics. Page views and simple events (such as clicking "Start for free" or creating an account), with the page address, referring website, any campaign tags in the link (such as utm_source), device type, browser, operating system and approximate country. We use Vercel Web Analytics, which does not use cookies and is designed not to identify individual visitors.
- Performance data. How quickly pages load, using Vercel Speed Insights.
- Maps. On host sites, the map image is loaded directly from Mapbox, so Mapbox receives your IP address and browser details. The map shows only the town, not the property's exact address.
3. How we use it
We use personal information to:
- Run Rehostly: create and secure accounts, build and publish hosts' sites, show listings and availability, and sync calendars.
- Handle bookings and payments: take bookings, collect deposits and balances, retry failed payments, issue refunds, pay hosts, and keep the records needed for accounting, tax and disputes.
- Review hosts and prevent fraud: decide whether to approve a host, look for signs of fraud (for example, the same bank account behind several accounts), and protect guests, hosts, Stripe and us. A person makes every approval decision; we do not make these decisions by automated means alone.
- Send service emails: booking confirmations, requests and reminders, payment receipts and failure notices, check-in details, cancellation notices, and messages a host sets up for their guests (sent by Rehostly on the host's behalf).
- Provide support: answer questions and fix problems.
- Draft text with AI: when a host uses "Write it for me", we send the details they entered to Anthropic to draft text. We do not send names, contact details or guest information.
- Improve Rehostly: understand how Rehostly is used, find and fix errors, and measure how well our marketing works.
- Send host tips and updates: only to hosts who asked for them.
- Meet legal obligations: keep records, respond to lawful requests, and enforce our Terms.
We do not sell personal information. We do not use it for advertising profiles or share it with advertisers.
4. Consent
4.1 How we get consent. We collect, use and share personal information with your consent, or where the law allows without it. When you create an account or make a booking, you consent to the uses described in this policy that are needed to provide that service. For anything optional, such as host tips and updates, we ask for your express consent, and you can say no and still use Rehostly.
4.2 Withdrawing consent. You can withdraw your consent at any time, subject to legal or contractual limits, by contacting us. If you withdraw consent to something we need to provide a service (for example, processing a payment), we may not be able to provide it, and we will explain what that means.
4.3 Without consent. The law allows us to use or share information without consent in limited cases, such as to prevent or detect fraud, to collect a debt, to comply with a court order or law, or in an emergency that threatens someone's life, health or security.
4.4 Email. Service emails about your account or booking are sent because you need them. Host tips and updates are sent only with your consent, and every one includes a way to unsubscribe, as Canada's anti-spam law (CASL) requires. Hosts can also switch them off in Settings.
5. Who we share it with
5.1 Hosts and guests. When a guest books, the host receives the guest's booking details. The guest sees the host's site, the listing and the details the host provides for the stay, including the exact address after booking.
5.2 Service providers. We use these companies to run Rehostly. They may use personal information only to provide their services to us, and must protect it.
| Provider | What they do for us | Where the information is processed |
|---|---|---|
| Supabase | Database, sign-in and file storage (including photos) | Canada (Montréal). Supabase is a US company and its support staff and content delivery network may access or cache data outside Canada |
| Vercel | Website hosting, web analytics and performance data | Our servers run in Canada (Montréal), and servers worldwide deliver pages close to visitors. Web analytics and performance data are processed in the United States |
| Stripe | Payments, refunds, payouts, host account verification and fraud prevention | Canada, the United States and other countries |
| Resend | Sending emails | United States |
| Sentry | Error monitoring on our servers | United States |
| Anthropic | The AI writing helper | United States |
| Mapbox | Maps on host sites and address suggestions when hosts enter their address | United States |
5.3 Stripe's own role. Stripe also uses some payment and verification information for its own purposes, such as meeting its legal obligations and preventing fraud, under its own privacy policy.
5.4 Other platforms. If a host links a calendar from Airbnb, Vrbo or another platform, we read that calendar. The calendar we export for hosts to use on other platforms shows only that dates are reserved, never guests' names or details.
5.5 Legal reasons. We may share information where the law requires or allows it, for example with tax authorities, law enforcement, courts or regulators, or with a provincial or municipal short-term rental authority where the law requires us to.
5.6 Business changes. If Rehostly, or part of it, is sold, merged or reorganized, personal information may be shared with the other party, under an agreement to protect it and use it only as this policy allows.
6. Where it's stored and transfers outside Canada
6.1 Our servers, database and file storage are located in Canada, in Montréal.
6.2 Some of our service providers process personal information outside Canada, mainly in the United States (see section 5.2). When information is outside Canada, it is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities.
6.3 Before we transfer personal information outside Québec, we assess whether it will be adequately protected, including the sensitivity of the information, why it is being transferred, the protections in place and the laws where it will be held. We use written agreements with our providers to protect the information.
7. How long we keep it
We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. Then we delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Host account and listing information | While your account is open, and for 2 years after it closes |
| Booking, payment, refund and payout records (including guests' names and contact details in them) | 7 years after the end of the year the booking took place, to meet tax and accounting laws |
| Guests' details in a host's guest list, outside those records | Until the host deletes them, or 2 years after the guest's last stay, whichever comes first |
| Host approval and fraud-prevention information | While the account is open, and for 5 years after it closes or after we decline it |
| Support messages | 2 years after the issue is closed |
| Error logs | Up to 90 days |
| Records of privacy incidents | At least 2 years |
| Backups | Overwritten on a rolling basis, within 30 days |
We may keep information longer if we need it for a legal claim, an investigation or a dispute, or if the law requires.
8. Your rights and how to use them
8.1 Your rights. Subject to limits set by law, you have the right to:
- access the personal information we hold about you and learn how we have used and shared it;
- correct information that is inaccurate or incomplete;
- withdraw consent (see section 4.2);
- ask us to delete information we no longer need or have no right to keep;
- if you live in Québec, receive information you gave us in a structured, commonly used technological format, or have it sent to another organization;
- if you live in Québec, ask us to stop sharing your information or to de-index a link to your name, where the law provides for it; and
- complain to us or to a privacy regulator.
8.2 How to make a request. Hosts can delete their account themselves, in Settings: their listings go offline, their sites and photos are removed and their login is deleted, and we keep booking and payment records for as long as section 7 says. For anything else, email support@rehostly.ca or write to our Privacy Officer at the address in section 1.2. We may ask you to confirm your identity. We will answer within 30 days, or tell you if we need more time and why, as the law allows. There is no charge, unless a request is unusually large and the law allows a modest fee; we will tell you first.
8.3 Guests. For information about how a host uses your details, you can contact the host directly. We will also help.
8.4 If we can't do what you ask. We will explain why in writing, unless the law prevents us, and tell you how to complain.
8.5 Complaints. Please contact us first so we can try to resolve your concern. You can also complain to:
- the Office of the Privacy Commissioner of Canada (priv.gc.ca);
- the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca); or
- if you live in Québec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
9. Security and incidents
9.1 How we protect information. We use safeguards suited to how sensitive the information is, including:
- encryption in transit (HTTPS) and encryption of stored data by our providers;
- access controls in our database, so hosts can see only their own listings and guests;
- limiting staff access to those who need it;
- leaving card details entirely with Stripe, which is certified to the highest payment card security standard (PCI DSS Level 1); and
- monitoring for errors and unusual activity.
No system is perfectly secure. Please keep your password private, and keep guest booking links private, since anyone with a booking link can view and cancel that booking.
9.2 If something goes wrong. If personal information is lost, stolen, or accessed or shared without authorization, we will act quickly to limit the harm. If there is a real risk of significant harm (or, in Québec, a risk of serious injury), we will notify the people affected and the relevant privacy regulator, as the law requires. We keep a record of every such incident.
10. Cookies and analytics
10.1 What we use. We keep cookies and similar technology to a minimum:
- Sign-in cookies keep hosts signed in to their dashboard. They are needed for Rehostly to work.
- Payment cookies. Stripe sets cookies on checkout and payment pages to help prevent fraud.
- Browser storage. rehostly.ca and our sign-up pages remember which link or campaign brought you to us for the length of your visit, and the dashboard remembers some preferences (such as display settings) on your device.
10.2 Analytics without cookies. Our analytics (Vercel Web Analytics and Speed Insights) do not use cookies and do not track you across other websites.
10.3 No advertising trackers. We do not use advertising cookies, tracking pixels or cross-site trackers.
10.4 Your choices. You can block or delete cookies in your browser settings. If you block sign-in cookies, you will not be able to use the host dashboard, and blocking Stripe's cookies may stop a payment from going through.
11. Children
Rehostly is not meant for anyone under 18. Hosts must be 18 or older, and bookings must be made by an adult. Children may stay as part of an adult's booking, but we ask only for the number of guests, not their details. If we learn that we have collected personal information from someone under 18 without the consent the law requires, we will delete it.
12. Changes to this policy
We may update this policy as Rehostly changes or the law changes. The date at the top shows when it last changed. If we make a significant change, we will tell hosts by email and show a notice on rehostly.ca before it takes effect. If a change means we want to use your information for a new purpose, we will ask for your consent first where the law requires.
13. Contact
Questions, requests or concerns about your privacy? Contact our Privacy Officer:
- Email: support@rehostly.ca