Balcosa Inc. ("Balcosa", "we", "our") is committed to protecting your personal information. This policy explains what we collect, why, and how.
1. Information We Collect
Account information: name, email address, and password when you register.
Profile information: profile photo, host bio, and contact preferences.
Listing data: photos, descriptions, location (neighbourhood-level), and pricing of spaces.
Transaction data: booking details, payment references (we do not store full card numbers), and booking history.
Usage data: pages visited, search queries, device type, and IP address for analytics and fraud prevention.
2. How We Use Your Information
To operate the marketplace and facilitate bookings between Guests and Hosts.
To communicate with you about your account, bookings, and platform updates.
To improve our services through aggregated analytics (no individual profiling sold to third parties).
To detect and prevent fraud, abuse, and violations of our Terms of Service.
To comply with applicable law, including Canadian privacy legislation (PIPEDA / Law 25).
3. How We Share Your Information
With the other party to a booking (e.g., a Host receives a Guest's first name and avatar; a Guest receives a Host's name and listing address only after booking confirmation).
With payment processors (Stripe) under their own privacy policies.
With infrastructure providers (database, file storage, search) under data-processing agreements.
We do not sell your personal data to advertisers or data brokers.
4. Data Retention
Account data is retained for as long as your account is active, plus 2 years.
Transaction records are retained for 7 years to comply with accounting obligations.
You may request deletion of your account at any time via Settings → Account → Delete Account.
5. Cookies & Tracking
We use essential cookies for authentication and security.
We use analytics cookies (privacy-preserving, no cross-site tracking) to understand usage patterns.
You may refuse non-essential cookies via your browser settings without affecting core functionality.
6. Your Rights
Access: request a copy of the personal data we hold about you.
Rectification: correct inaccurate data.
Erasure: request deletion of your data, subject to legal retention obligations.
Portability: receive your data in a machine-readable format.
To exercise these rights, contact {{emailPrivacy}}.
7. Security
All data is transmitted over TLS (HTTPS). Passwords are hashed using bcrypt.
Access to production data is restricted to authorised personnel on a need-to-know basis.
We conduct regular security audits and promptly address reported vulnerabilities.
8. Changes to This Policy
We may update this policy from time to time. Significant changes will be communicated by email or an in-app notification at least 14 days before they take effect.
9. Contact
Questions or concerns? Contact us at {{emailPrivacy}} or by mail at {{company}}, Montréal, Québec, Canada.