Privacy policy

Hostasoirée is responsible for the personal information it collects on the platform. Its contact details are in the Legal notice.

The person in charge of the protection of personal information can be reached at: [SENSITIVE]. Requests for access and correction, and complaints, go to that person.

We collect only what is needed for the service requested.

If you visit the site without an account: the server's technical logs (IP address, browser type, pages viewed, date and time), used for security and troubleshooting. No tracking cookies, no profiling.

If you buy a ticket: your name, your email, the tickets bought and their amount, the order status, the card brand and last four digits as passed to us by the payment provider (never the full number), and your choice about the organizer's communications.

If you organize events or book a room: your name, your organization, your email, your password (stored hashed, unreadable to us), your requests, your events, your messages on the platform and, if you sell tickets, the payout details you give the payment provider.

If you manage a bar: the same information, plus your room's description, its address, your contact details, your calendar, your subscription and the people you add to your guest book. For that guest book, you are responsible for the information you record; we host it for you.

To provide the service: issue and validate tickets, collect and pay out payments, connect an organizer with a bar, send confirmations and reminders tied to an order or a booking.

To keep things secure: prevent fraud, protect accounts, keep a record of transactions.

To meet our legal obligations: keeping accounting records, answering requests from authorities when the law requires it.

To write to you for commercial purposes, only if you consented separately. That consent is never pre-checked and can be withdrawn in one click, at the bottom of every email.

Most processing is needed to perform the contract you enter into: buying a ticket, booking a room, taking a subscription. We inform you of the collection when it happens, and your consent is shown by continuing.

Commercial communications, and any processing not needed for the service, rest on a separate, express consent that you may withdraw at any time.

Some retention rests on a legal obligation, in particular tax rules.

With the organizer of the event you buy a ticket for: your name, email, tickets and attendance at the door, to run the event. It is responsible for its use of them; it may write to you for commercial purposes only if you checked the box provided for that.

With the bar, when you book its room: your name, your organization, your request and your messages.

With our technical providers, who process information on our behalf and under our instructions. They are located in the United States, outside Québec:

• Vercel (site hosting and code execution);
• Supabase (database, authentication and file storage);
• Stripe (payment and payout processing);
• Resend (transactional email delivery).

Before entrusting information to a provider located outside Québec, we assess the privacy-related factors, as the law requires, and frame the transfer by contract. These providers may not use your information for their own purposes.

We do not sell or rent your information. We disclose it to an authority only when the law requires us to.

Orders, tickets, payments and accounting records: seven years after the end of the year of the transaction, as tax laws require.

Your account and what it contains: as long as the account exists, then 30 days after its deletion to allow reactivation in case of error. After that, the information is deleted or anonymized, except what we must keep under the previous point.

Technical logs: 90 days.

Consents to commercial communications, and their withdrawal: for the duration of the relationship, then three years, so we can prove we respected your choice.

You may ask to see the information we hold about you, have it corrected if it is inaccurate or incomplete, withdraw a consent, and obtain in a structured, commonly used technological format the computerized information you provided to us. You may also ask to close your account.

Write to [SENSITIVE] with your name and the email tied to your account or order. We reply in writing within 30 days. We may ask you to confirm your identity before acting.

If you are not satisfied with our reply, you may file a complaint with the Commission d'accès à l'information du Québec.

We use no tracking, advertising or audience-measurement cookies. There is therefore no banner to accept.

We use only cookies strictly necessary for the site to work: your session when you are signed in, your display language, and form protection. They serve no other purpose.

If we ever add an audience-measurement tool, it will be turned on only with your prior consent, and this policy will be updated.

Information is encrypted in transit and at rest with our providers. Access is limited to the people who need it, and each role sees only what concerns it. Passwords are hashed; card numbers never pass through our servers.

We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned, with what they need to know to protect themselves.

The platform is meant for adults. We do not knowingly collect personal information from a person under 14 without the consent of the person having parental authority. If you believe a minor has given us information, write to us and we will delete it.

We make no decision based exclusively on automated processing that would produce legal effects or significantly affect you. An account suspension or a payout hold is always reviewed by a person.

The date of the current version appears at the top of the page. A material change is announced to you by email if you have an account, or by a notice on the site, before it takes effect.