Data Processing Terms

We process guest personal information only to provide Cardinal to you, and only on your documented instructions - which include your use of the application's features.

We do not use guest personal information for our own purposes, do not sell it, and do not use it to train models.

Categories of people: your guests, and the staff you give accounts to.

Categories of information: name, contact details, stay dates and room, folio and payment records (card brand, last four digits and expiry only), whether a guest needs an accessible room, and any notes you or your staff record.

Some of that can be sensitive. An accessibility need is recorded because it is needed to give the guest a room they can use. Free-text note fields accept whatever your staff type, and in a hotel that sometimes includes an allergy or a mobility need. We do not ask for special categories of information and we do not use any of it for our own purposes - but we cannot control what is typed into a note, so deciding what your property records there, and telling your staff, is yours. We treat whatever is in those fields with the same protections as the rest.

Access is limited to personnel who need it, under confidentiality obligations. Data is encrypted in transit and at rest, and each property's data is isolated from every other property's at the database level, enforced by the database itself rather than by the application.

Accounting entries are append-only and cannot be altered or deleted once written, so the financial history of a stay cannot be rewritten. Operational actions such as check-ins and rate changes are shown in an activity view in the application.

Our database is hosted in Canada (Montreal). Sub-processors that operate elsewhere are listed below.

We use: Supabase (database and hosting), Amazon Web Services (application server and backups), Vercel (web delivery), Stripe (payment processing), Resend (transactional email), and Google (analytics on the booking page - loaded only for guests who accept it, and not at all if they do not).

We also send your property's own address - not guest information - to OpenStreetMap and Open-Meteo, to place the map and the weather on your booking page.

We will tell you before adding a sub-processor that handles guest personal information. If you object, we will work with you to find a way around it; if we cannot, you may end this agreement without penalty and we will refund the unused part of what you have paid.

If a guest exercises a right of access, correction, deletion or portability with you, we will help you respond. You can correct a guest's details yourself in the application, and export your guest and reservation records in a machine-readable format. For a request about one guest in particular - a copy of everything held about them, or a deletion - tell us and we will do it, within the limits of the accounting record described in the Subscription Agreement, which cannot be erased. We will always tell you exactly what was removed and what remains.

We will assist with privacy impact assessments and with any consultation with the Commission d'accès à l'information, to the extent the information is ours to give.

We will notify you without unreasonable delay after becoming aware of a confidentiality incident affecting your data, with what we know, so that you can meet your own notification obligations.

We maintain a register of confidentiality incidents as Law 25 requires.

On termination we return or delete guest personal information at your choice, subject to the retrieval window in the Subscription Agreement, to the append-only accounting record, and to anything we are independently required to keep. We will tell you what was kept and why.

On reasonable request we will provide the information needed to demonstrate our compliance with these terms.