Privacy Policy

Canterra Stays, the operating name of 16596461 Canada Inc. ("Canterra Stays," "we," "us," or "our"), provides professionally managed short-term and extended-stay accommodation across the Greater Toronto Area. We respect your privacy and are committed to protecting the personal information you entrust to us, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws. This Privacy Policy explains what we collect, how we use, disclose and protect it, and the choices and rights available to you.

1. Who we are and what this policy covers

This policy applies to personal information we collect through our website, when you enquire about or make a booking with us, when you stay at one of our properties, and when you communicate with us by email, phone, messaging or through a third-party booking platform. It does not apply to the independent practices of third parties — including the booking platforms described below — which have their own privacy policies that govern their handling of your information.

2. Information we collect

Information you provide to us

When you enquire, book, or stay with us, we may collect your name, email address, phone number, mailing or billing address, the dates and details of your stay, the number and (where required) names of guests, government-issued identification or age-verification details where needed to confirm a reservation or comply with the law, payment information, and any messages, preferences or special requests you send us.

Information collected automatically

When you visit our website, we may automatically collect technical and usage information such as your IP address, approximate location derived from it, device and browser type, pages viewed, referring pages, and the dates and times of your visits, using cookies and similar technologies (see Section 8).

Information from third parties

When you book through a third-party platform such as Airbnb, Vrbo, Booking.com or Expedia, that platform shares booking and guest information with us so we can host your stay — typically your name, contact details, reservation dates, guest count and platform messages. We may also receive information from our property-management and pricing systems, payment processor, and service providers who help us operate.

Long-stay enquiries and applications. When you ask about a long stay we collect your name, email address, the kind of stay and dates you are looking for, the number of people in your household, who will be paying (for example you, a family member, an employer or an insurer) and anything you choose to tell us. We use it only to answer your enquiry and, if you go ahead, to prepare your agreement or lease. We do not ask for, and do not use, information about citizenship, place of origin, religion, age, family or marital status, disability or receipt of public assistance in deciding who we let to. If you apply for a Residence, the application will ask for what a landlord in Ontario may lawfully request, and we will tell you at that point what it is and why.

3. How we use your information

• To respond to enquiries and provide quotes and availability;
• To process, confirm and manage your reservation and stay, including check-in instructions and guest communications;
• To process payments, security deposits, refunds and any additional charges;
• To verify identity and age, prevent fraud, and protect the safety and security of guests, properties and neighbours;
• To comply with legal, tax, licensing and regulatory obligations applicable to short-term rentals;
• To operate, maintain, secure and improve our properties, website and services;
• To send you service messages and, where you have consented, marketing about our properties and offers (you may opt out at any time).

4. Consent

We collect, use and disclose personal information with your consent, except where otherwise permitted or required by law. Consent may be express or, depending on the sensitivity of the information and the circumstances, implied. By making a booking or providing information to us, you consent to the handling of your information as described in this policy. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, by contacting us — though doing so may limit our ability to provide certain services, including hosting a stay.

Commercial electronic messages (CASL)

When we send commercial electronic messages, we comply with Canada's Anti-Spam Legislation (CASL). We may send service and transactional messages relating to your enquiry or Booking on the basis of your request or our existing business relationship with you. We send marketing or promotional messages only where you have given consent, and every such message identifies Canterra Stays and includes a simple way to unsubscribe. You may withdraw consent or opt out of marketing at any time using the unsubscribe link in any such message, on our email preferences page (where you can also choose which kinds of email you receive: news and offers, review requests, notes from your host team, price alerts, and updates for corporate and partner teams), by replying to a message with "unsubscribe", or by contacting us at privacy@canterrastays.com. We act on every unsubscribe at once and keep a record of each consent and each withdrawal (the wording you saw, when, how and from which network address) as the law requires. Unsubscribing from marketing does not stop messages about a booking you hold, such as confirmations, payment reminders and check-in details.

5. When we share your information

We do not sell your personal information. We share it only as needed to operate, including with:

• Service providers who act on our behalf — for example, our property-management system (Hostaway), our pricing tools (such as PriceLabs), our payment providers and banks, cleaning, maintenance and guest-support vendors, and IT and hosting providers — who are bound to use the information only to provide services to us and to protect it appropriately;
• Booking platforms (Airbnb, Vrbo, Booking.com, Expedia and similar) where your reservation originates or is managed through them;
• Authorities and advisors where required to comply with law, respond to lawful requests, enforce our terms, collect amounts owed, or protect the rights, property or safety of guests, our business or others. This includes banks, payment providers, regulators and law-enforcement authorities where the law requires or permits it, for example to prevent or investigate fraud, money laundering or another offence;
• Successors in connection with a sale, merger, financing or reorganization of our business, subject to appropriate confidentiality protections.

6. Payment processing

Payments are handled by regulated payment providers and banks, including Stripe (payment cards, Apple Pay, Google Pay, UnionPay, WeChat Pay and Alipay), PayPal, Payoneer, and the banks that operate Interac e-Transfer and bank transfers. Those providers are responsible for securely handling your card or account details under their own privacy and security practices. We do not receive or store full payment-card numbers.

To take and record a payment we collect and keep: the name of the payer; where the payer is not the guest or tenant, their relationship to the stay and, for a company, its name and contact; the method used; the amount, date and currency; and the provider's transaction reference. We use this information to process your booking, stay or tenancy, deposits, refunds and amounts properly due; to issue receipts; to keep the accounting and tax records the law requires; and to prevent and detect fraud, money laundering and other financial crime. For those last purposes we may ask who is paying, how they are connected to the stay, where the funds come from and for identification, and we may decline or return a payment we cannot match to a named payer.

7. Booking platforms

Many of our reservations are made through third-party short-term-rental platforms. When you book through Airbnb, Vrbo, Booking.com, Expedia or another platform, your use of that platform — and the information you provide to it — is also governed by that platform's own privacy policy and terms, which operate independently of this policy. We encourage you to review the privacy policy of any platform you use. Information that the platform passes to us in order to host your stay is handled in accordance with this Privacy Policy.

Guest reviews. Where we show a review a guest left on a booking platform, we show the reviewer's first name and the initial of their last name, the month of the stay and the platform, never their full name. After a stay booked on canterrastays.com we may email you once to ask for a review; every guest is asked, whatever the stay, and you can unsubscribe from that email. A review you write on canterrastays.com is published only if you tick the box to publish it, with the name you choose (your full name, your first name and initial, or your first name only), your rating and the month of your stay; unticked, it reaches our host team only. We keep a record of what you agreed to and when. You can ask us to change the name shown or remove your review at any time, using the contact details in section 17.

Price alerts. When you ask us to watch dates on canterrastays.com, we keep your email address, the dates, the number of guests, the home (if you chose one) and the prices we told you about, to send the alert you asked for. Nothing is watched until you confirm from the email we send. An alert sends at most three emails and ends the day before check-in, after 90 days, or when you stop it from any of its emails; we then delete it within 30 days. We never use an alert address for anything else.

Group votes. When you start a group vote from your saved homes on canterrastays.com, we keep the homes you picked and, if you add them, a name for the trip, your first name, the dates, the number of guests and when voting closes. People who vote may add their first name. Each browser that votes is told apart by a random key kept on that device; a vote never asks for an email address or a phone number. Anyone with the vote's link can see the homes, the votes and the first names, so keep anything private out of it. A vote, its votes and the names in it are deleted 180 days after it starts.

Today's spin. When you spin, we keep the email address you enter, the prize you land on and its code for 90 days, so that the code can be checked when you book. So that each inbox spins once every 7 days, we also keep the day of its last spin for 90 days, against a one-way fingerprint of the address, never the address itself. The code is sent only to that address. If you tick "Send me news and offers", we add your address to our news list with the words you agreed to and the date (express consent under Canada's Anti-Spam Legislation). It stays there until you unsubscribe: every marketing email from us has a one-click unsubscribe link, and unsubscribing takes your address off the list.

WhatsApp. If you message us on WhatsApp, we receive your phone number, your WhatsApp profile name and your messages, and use them to answer you and to look after your stay. WhatsApp is a Meta service, which handles the messages under its own terms and privacy policy.

Copies of our messages. Every email we send you, and every message our website sends you through Airbnb, Booking.com, Vrbo, Expedia or Hostaway, is also copied to our own mailbox (info@canterrastays.com). So is every message our marketing system sends you on Instagram or Facebook (an automatic reply to a keyword, an answer from Cora, our AI assistant, or a private reply to your comment): its copy holds what we sent, who sent it, your username or name when the platform gives it, and when, never what you wrote, and it waits in our marketing system only until it reaches our mailbox, never more than 7 days. The copies are our record of what we told you, and they let whoever on the host team picks up your next message see the whole conversation. They are kept and protected as described in this policy.

Security cameras. Every house we list has an exterior Ring security camera covering its driveway and parking area, which may record video and sound of anyone there. As our Terms (section 15) say, exterior monitoring is used only for security, safety and the protection of property. No home has a camera inside, and our condos have none of ours. Indoor noise-level monitors, where a home has one, measure loudness only and record no audio or video.

8. Cookies and analytics

Our website uses cookies and similar technologies to operate the site, remember your preferences, understand how the site is used, and measure performance. You can control cookies through your browser settings; disabling some cookies may affect how the site functions. Where we use third-party analytics, those providers process information on our behalf under their own terms. We honour applicable browser privacy signals where required by law, including Global Privacy Control.

Analytics and advertising cookies (such as Google Analytics or the Meta pixel) are used only if you choose "Accept all" in our cookie banner; with "Essential only", they are never loaded. You can change your cookie choices at any time.

Our social posts and messages. When you open a canterrastays.com/go/ link from one of our social posts or messages after choosing "Accept all", and your browser sends no Global Privacy Control signal, we set a first-party cookie, cs_vid, holding a random visitor id (it lasts 180 days from the last such link you open), so we can see which of our posts led to a booking made directly on canterrastays.com. Your cookie choice is kept in a cookie of its own, cs_consent, for a year. With "Essential only" or a Global Privacy Control signal, no visitor id is created or used, and choosing "Essential only" removes one set earlier. With "Accept all", your browser also remembers for 90 days which post or message your visit came from; otherwise only until you close the tab. When a direct booking is confirmed, our marketing system receives the guest's email and keeps it only as a one-way hash, to match the booking to a conversation the guest had with us by direct message. A long-stay enquiry or a price alert is reported with the post it came from only, never with your email or anything you wrote. Our marketing system deletes its records of link taps, availability requests and Instagram or Facebook conversations 93 days after the tap, the request or the conversation's last message (a little longer only while its daily clean-up catches up). For a booking made on canterrastays.com it removes the visit details (the visitor id, the link, the email hash and your answer to "how did you hear about us") 3 days after the booking, and deletes the rest of that record, which holds no name or email, 365 days after the booking or 60 days after check-out, whichever is later. If you opt out of our automated messages, it keeps only a one-way code of the conversation and the date, so they never resume. Without "Accept all", a tap on one of those links is counted anonymously, with a one-way key of your network address and browser that changes every day and is deleted within five days. A report our site has not yet confirmed with our marketing system is kept on our site, without any email, and tried again for up to 36 hours, then deleted. We never sell any of this information.

9. Data retention

We keep personal information only as long as necessary to fulfil the purposes described in this policy, after which we securely delete or de-identify it. Booking and financial records are generally retained for the period required by applicable tax and accounting law (typically up to seven years from the end of the relevant year). Guest communications and reservation details are retained for the duration of the relationship and for a reasonable period afterward to handle disputes, refunds, safety matters and legal obligations. Marketing contact information is retained until you opt out or it is no longer needed.

10. Security and breach response

We use reasonable administrative, technical and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, disclosure, copying or modification, appropriate to its sensitivity. Access is limited to those who need it to do their work. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a breach of security safeguards involving your personal information that poses a real risk of significant harm, we will notify affected individuals and the appropriate authorities as required by applicable law, and take steps to contain and remediate the incident.

11. Cross-border transfers

Some of our service providers, payment providers and booking platforms are located outside Canada, including in the United States, the European Union and, for payments made with WeChat Pay or Alipay, China. As a result, your personal information may be stored or processed outside your province or country and may be subject to the laws of those jurisdictions, including lawful access by courts, law enforcement and authorities there. We take reasonable steps to ensure that service providers protect personal information in a manner consistent with this policy. By using our services you acknowledge this transfer and processing.

12. Your rights

Subject to applicable law, you may request access to the personal information we hold about you, ask us to correct inaccurate or incomplete information, and withdraw your consent to certain uses. To make a request, contact our Privacy Officer using the details below. We may need to verify your identity before responding, and some information may be exempt from access in accordance with law. We will respond within the time required by applicable law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

13. Automated processing

We use automated tools, including dynamic-pricing software, to set rates and operate efficiently. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement. Pricing and availability decisions are applied at the property and date level, not to profile individuals.

14. Children

Our website and bookings are intended for adults who have reached the age of majority in their province or territory. We do not knowingly collect personal information from children. Reservations must be made by an adult, who is responsible for any minors included in the stay.

15. Third-party links

Our website may link to third-party websites and services that we do not control. This policy does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

16. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent version. Material changes will be posted on this page, and your continued use of our services after changes take effect constitutes acceptance of the updated policy.

17. Contact us

If you have questions, concerns or requests regarding this policy or your personal information, please contact our Privacy Officer:

Canterra Stays (16596461 Canada Inc.) — Privacy Officer
Email: privacy@canterrastays.com
Mail: 44 Natronia Trail, Brampton, ON L6P 3N1, Canada