Privacy Policy

1. Introduction

Homesbyli ("Homesbyli", "we", "us", "our") operates the short-term rental booking platform available at homesbyli.com (the "Platform"). We are based in Montreal, Quebec, Canada and we are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform. It applies to guests, hosts, and visitors. By using the Platform you consent to the practices described in this policy.

2. Information We Collect

2.1 Personal Information

We collect information you provide directly:

• Account Information: Full name, email address, phone number, password (stored as a one-way bcrypt hash — we never store passwords in plaintext).
• Profile Information: Profile photo, bio, preferred language, and (for hosts) business details.
• Payment Information: Billing address. Card details are entered directly into Stripe and never touch our servers. Hosts also provide bank account details to Stripe Connect for payouts.
• Booking Information: Guest names, check-in / check-out dates, number of guests, special requests, and messages exchanged with the host.
• Identity Verification: Government-issued ID is required from guests before booking and from hosts before listing. Images are stored encrypted, used only for verification, and automatically purged after a defined retention period.
• Communication: In-platform messages, reviews, and customer-support inquiries.

2.2 Automatically Collected Information

• Device Information: IP address, browser type, operating system, device identifiers.
• Usage Data: Pages viewed, features used, time spent on the Platform, referring URLs.
• Approximate Location: Derived from IP address — used for fraud prevention and to show locally relevant listings.
• Cookies and Local Storage: Session tokens, language preference, and minimal analytics. See section 10.

2.3 Information from Third Parties

• Stripe: Payment confirmation status, last four digits of card, country of issuance.
• Mapbox: Geocoding results when displaying property locations.
• External calendars: If a host connects an iCal feed (Airbnb, Booking.com, Vrbo), we ingest the booking dates to keep their availability in sync.

3. How We Use Your Information

4. How We Share Your Information

4.1 With Other Users

• After a booking is confirmed, hosts can see the guest's first name, profile photo, contact email/phone, and booking details. Guests likewise see the host's name, profile, and contact details for that booking only.
• Reviews and ratings you write are publicly visible alongside your first name and profile photo.
• Profile photos and reviews on a host's listing page are public.

4.2 With Service Providers

We share the minimum information necessary with the following processors:

• Stripe Inc. — payment processing and host payouts (PCI DSS compliant). United States.
• Resend Inc. — transactional email delivery. United States.
• DigitalOcean LLC — managed MongoDB database hosting. Toronto, Canada.
• Mapbox Inc. — map tiles and geocoding. United States.
• Functional Software, Inc. (Sentry) — application error monitoring. United States.

We do not sell or rent your personal information to third parties for advertising. We do not share your email or phone number with marketers.

4.3 Legal Requirements

We may disclose information when required by law, including:

• Court orders, subpoenas, or warrants from Quebec or Canadian authorities
• Lawful requests from foreign authorities under applicable mutual legal assistance treaties
• Tax authorities (host income reporting, GST/QST)
• Municipal short-term rental compliance authorities (e.g., CITQ)

4.4 Business Transfers

If Homesbyli is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred to the successor entity. We will notify you by email and on the Platform before any such transfer takes effect.

5. Data Security

We implement industry-standard safeguards to protect your information:

Note: No method of transmission over the internet is 100% secure. While we use reasonable measures, we cannot guarantee absolute security. In the event of a breach that creates a risk of significant harm, we will notify affected users and the Commission d'accès à l'information du Québec ("CAI") as required by law.

6. Your Privacy Rights

6.1 Access & Portability

You may request a copy of the personal information we hold about you in a structured, commonly used machine-readable format. We will respond within 30 days.

6.2 Correction

You can update most of your profile information at any time through your account settings. Contact us if you need help correcting information you cannot edit yourself (e.g., booking history).

6.3 Deletion

You may request deletion of your account and associated data. Note that we may retain certain information as required by law or for legitimate business purposes — in particular financial records (kept for 7 years for Canada Revenue Agency / Revenu Québec compliance) and information needed to defend a legal claim.

6.4 Withdraw Consent / Opt Out

• Marketing emails: Use the unsubscribe link in any marketing email, or update preferences in your account.
• Cookies: Adjust your browser settings (see section 10).
• Account deactivation: Contact support@homesbyli.com at any time.

6.5 Right to be Informed of Automated Decisions

Homesbyli does not currently use solely automated decision-making that produces legal or similarly significant effects. If we introduce such a feature, we will notify you and provide the right to request human review.

6.6 No Sale of Personal Information

We do not sell your personal information to third parties.

7. Data Retention

We retain your information only as long as necessary:

• Active accounts: for as long as the account exists.
• Closed accounts: 90 days after closure for fraud prevention, then anonymized.
• Booking and financial records: 7 years (Canadian tax law).
• Identity verification images: automatically purged after a defined retention window once verification is complete.
• Marketing consent records: until consent is withdrawn plus 24 months for proof of compliance.

8. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, please contact support@homesbyli.com and we will delete it promptly.

9. International Data Transfers

Some of our service providers (notably Stripe, Resend, Mapbox, and Sentry) operate in the United States. When your information is transferred outside Quebec or Canada, we rely on contractual safeguards equivalent to those required under Quebec's Law 25 and PIPEDA. If you are located in the European Economic Area or United Kingdom, transfers are covered by Standard Contractual Clauses or equivalent mechanisms.

10. Cookies and Local Storage

We use cookies and browser local storage for the following purposes:

• Essential: session token (kept in localStorage) so you stay logged in.
• Preferences: language, currency, and recent searches.
• Analytics: aggregate usage measurement.

We do not use third-party advertising cookies. You may clear cookies and local storage at any time in your browser settings; doing so will log you out and reset preferences.

11. Third-Party Links

The Platform may contain links to third-party websites (e.g., a host's personal site, Stripe payouts dashboard). We are not responsible for their privacy practices and encourage you to review their privacy policies before providing any information.

12. Quebec Law 25 & PIPEDA Compliance

Homesbyli complies with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and the Act respecting the protection of personal information in the private sector as amended by Quebec Law 25.

Privacy Officer: Our designated person in charge of personal information protection can be reached at support@homesbyli.com with the subject line "Privacy Officer".

If you are not satisfied with our response to a privacy concern, you may contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, for matters under federal jurisdiction, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by email to your account address and via an in-Platform notice at least 30 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance.

14. Contact Us

For privacy questions, complaints, or to exercise your rights: