Privacy Policy

Cardinal Operating Systems Inc. ("we") makes Cardinal, the reservation system this property uses to take and manage your booking.

The PROPERTY decides what information to ask you for and what to do with it. For your booking information, the property is responsible, and it is the property you deal with first.

We handle that information on the property's behalf and on its instructions. We do not decide what is collected or why.

We are responsible in our own right for a narrower set of information: the accounts we give the property's staff, and the technical and analytics information described below that our booking page collects.

Law 25 requires us to name a Privacy Officer, and ours can be reached at hello@cardinal-os.com - for the information we are responsible for, and to help if you cannot get an answer from the property.

When you book: your name, email, phone, and the dates and room of your stay. We need these to hold the reservation, to contact you about it, and to give you a receipt.

We send you email about your booking itself - a confirmation, and your invoice. Your phone number is held so the property can reach you about your stay.

If you tick the optional box asking for offers when you book, that consent is recorded for the PROPERTY, and any offers come from the property rather than from us. You can withdraw it by telling them. We do not sell or rent your information to anyone.

If you pay online: your payment is processed by Stripe. We never see or store your full card number - what is kept is the card brand, the last four digits and the expiry date, so the property can recognise which card was used.

Automatically on our booking page: standard technical data (IP address, browser type) and, only if you agree, analytics that tell us which parts of the booking page people use.

We do not sell your personal information. We do not share it for anyone else's advertising.

We share it only with the property you booked, and with the services that make the booking work. Those are listed in full in the Data Processing Terms our properties agree to; they are Supabase and Amazon Web Services (hosting, database and backups), Vercel (web delivery), Stripe (payments), Resend (email), and - only if you accept analytics - Google.

Our database is hosted in Canada, in the Montreal region (ca-central-1), and our backups are kept in Canada as well, encrypted.

Some of our service providers - for example email, payment processing and analytics - may process information outside Quebec. Where that happens we rely on the privacy commitments in our agreements with them, and we assess the transfer as Law 25 requires before relying on it.

Reservation and financial records are kept for at least six years, because Canadian tax law requires businesses to retain the records supporting their returns (Income Tax Act s.230).

Information not tied to a financial record - for example a note about a preference - is kept only as long as it is needed for what it was collected for.

Please read this together with your rights below, because the two limit each other. The accounting records behind a stay are deliberately permanent: the ledger Cardinal keeps cannot be altered or erased once written, which is what makes it trustworthy as a book of account. A request to delete your information is honoured for the parts we are free to delete - your contact details, your notes, your marketing preference - and the underlying financial record of the transaction remains for as long as the law requires it.

You can ask to: see the personal information held about you; have it corrected if it is wrong; have it deleted, so far as it is not information the law requires be kept; or receive a copy in a portable, machine-readable format.

Ask the property, the property you booked with. They are responsible for your booking information and they are the ones who can act on it. Law 25 gives them 30 days to answer you.

We help them do that. If you cannot reach the property, or it does not answer you, write to us at hello@cardinal-os.com and we will help - and we will tell you what we can and cannot do ourselves, since the information belongs to the property's records rather than ours.

Either way, if you are not satisfied with the answer, you may complain to the Commission d'accès à l'information du Québec.

Our booking page uses cookies that are strictly necessary for it to work; these cannot be switched off.

It can also use Google Analytics to understand how the booking page is used. These are NOT loaded unless you accept them, and you can change your mind at any time from the link at the bottom of the booking page.

We keep a register of confidentiality incidents, as Law 25 requires. If an incident occurs that presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected, and where the information belongs to a property's records we will tell that property promptly so it can meet its own obligations.

If we change this policy we will update the date at the top. Material changes will be brought to your attention.