Privacy Policy

Stay & Save ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to stayandsave.app and related services.

We are based in Ontario, Canada and handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Information we collect

Account information: name, email address, password (hashed), and (for hosts and businesses) business details you enter.

Content you provide: property and business listings, coupons, host notes, images, and messages.

Payment information: processed by Stripe. We receive limited billing details (last 4 digits, expiry, country) but do not store full card numbers.

Guest redemption data: when a guest generates a redemption code, we store a short-lived anonymous session identifier, the coupon and property involved, and a timestamp. We do not require guests to create an account.

Usage and device data: IP address, browser type, pages visited, and referring URL, collected via standard server logs and privacy-respecting analytics events.

Cookies and local storage: used to keep you signed in, remember preferences, and protect against abuse.

2. How we use your information

• Operate, maintain, and improve the Service;
• Process subscriptions, invoices, and refunds;
• Deliver coupons and enable in-person redemption;
• Communicate with you about your account, receipts, and service updates;
• Detect, prevent, and respond to fraud, abuse, and security issues;
• Comply with legal obligations.

3. Legal bases

We collect and use personal information because it is necessary to perform our contract with you, to comply with legal obligations, or based on our legitimate interests in running and securing the Service. Where required, we rely on your consent (for example, non-essential cookies or marketing communications) and you may withdraw it at any time.

4. Sharing your information

We do not sell your personal information. We share it only with:

• Service providers who help us run the platform, including Stripe (payments), Supabase (database and authentication), Cloudflare (delivery and security), and our email provider.
• Businesses and hosts where necessary to fulfill a redemption or listing (e.g. a host sees which of their coupons a guest redeemed, in aggregate).
• Authorities when required by law, court order, or to protect rights, property, or safety.
• Successors in the event of a merger, acquisition, or sale of assets, subject to equivalent protections.

5. Data storage and transfers

Data is stored on infrastructure operated by our providers, which may process information in Canada, the United States, or the European Union. Where information is transferred outside Canada, it remains subject to protections comparable to those under Canadian law and may be accessible to foreign authorities under applicable laws.

6. Retention

We keep personal information for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution needs (typically up to 7 years for financial records). Anonymous redemption data may be retained for analytics.

7. Your rights

You have the right to:

• Access the personal information we hold about you;
• Ask us to correct inaccurate information;
• Withdraw consent or ask us to delete your account and associated data, subject to legal retention requirements;
• Unsubscribe from non-essential emails via the link in the email footer;
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated.

To exercise these rights, email support@stayandsave.app.

8. Security

We use industry-standard measures to protect your information, including encryption in transit (HTTPS), encrypted authentication tokens, row-level database security, and regular security scans. No system is perfectly secure; please notify us immediately at the email above if you suspect a breach involving your account.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.

10. Changes

We may update this Policy. Material changes will be posted here and, where practical, communicated by email.

11. Contact

Privacy questions or requests: support@stayandsave.app.