AIRSTAY
Privacy Policy
Last updated: August 19, 2026
This text is a compliance-oriented template. Have a Canadian lawyer review it before you take the site live.
1. Who we are
This Privacy Policy describes how AIRSTAY (“AIRSTAY”, “we”, “us”, “our”) collects, uses, discloses and protects personal information when you use airstay.ca and related pages (the “Site”). AIRSTAY is a Canada-outbound travel metasearch and comparison service. We do not sell travel and we do not process booking payments.
For privacy questions, access or deletion requests, or to reach our Privacy Officer (including the person in charge of the protection of personal information for Quebec Law 25), contact: Privacy Officer, AIRSTAY, email privacy@airstay.ca.
This Policy is designed to align with the Personal Information Protection and Electronic Documents Act (PIPEDA), substantially similar provincial laws (Alberta PIPA, British Columbia PIPA, and Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25), Canada’s Anti-Spam Legislation (CASL), and applicable consumer-protection and accessibility rules. It is a compliance-oriented template and should be reviewed by a Canadian lawyer before commercial launch.
2. Scope and application
This Policy applies to personal information we collect in the course of commercial activity on the Site, including account creation, saved searches, cookie preferences, contact messages and partner click-throughs.
When you leave AIRSTAY and book on a partner website (for example Kayak, Expedia, Booking.com, Airbnb, an airline or a car-rental brand), that partner is a separate organization. Their privacy policy, terms and booking contract apply to that transaction. We are not responsible for partner privacy practices.
3. Personal information we collect
Identity and account data: name, email address, password (stored as a salted one-way hash), province or territory of residence, age confirmation, and timestamps for consent.
Travel search data: Canadian origin airport, destination, dates, traveller counts, cabin class, trip type and saved-search labels. We do not need your passport, frequent-flyer number or payment card to run a search.
Communications: messages you send through the contact form, and whether you gave express CASL consent to receive commercial electronic messages about deals.
Technical and consent data: language preference, cookie choices, approximate device type, and pages viewed. If you refuse analytics and marketing cookies, we do not set those cookies.
We do not intentionally collect social insurance numbers, health information, precise geolocation, biometric identifiers, or payment card data. Do not submit that information to us.
4. Why we collect it (identified purposes)
To operate the Site and show Canada-outbound search results and partner deeplinks.
To create and secure your account, remember saved searches, and honour your privacy and marketing choices.
To respond to questions and privacy requests.
With your express consent only, to send commercial electronic messages about travel deals (CASL).
To maintain security, prevent abuse, and meet legal obligations, including breach and confidentiality-incident duties.
To measure Site performance if you opt in to analytics cookies.
We will not use personal information for a new purpose without identifying that purpose and obtaining fresh consent, unless the law allows it.
5. Consent (PIPEDA, Law 25 and CASL)
We rely on meaningful, informed consent. Necessary processing to provide a service you request (for example creating an account or running a search you submit) is based on that request. Optional analytics, marketing cookies and promotional email require express opt-in. Boxes are never pre-checked.
Quebec Law 25: consent must be clear, free, informed and given for specific purposes. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may limit some features (for example deal emails or saved preferences).
CASL: we send commercial electronic messages only if we have express consent (or another CASL exemption that actually applies), we identify AIRSTAY, and we include a working unsubscribe mechanism. A purchase or account alone is not treated as consent for promotional mail unless the law clearly allows it and we disclose that.
You may refuse or withdraw consent by using cookie settings, account communication settings, the unsubscribe link in any email, or by writing to privacy@airstay.ca.
6. Children and youth
The Site is intended for individuals 16 years of age or older. Under Quebec Law 25, we do not knowingly collect personal information from a minor under 14 without the consent of the person having parental authority. If you believe we have collected information from a child contrary to this rule, contact privacy@airstay.ca and we will delete it.
7. Limiting collection, use, disclosure and retention
We collect only what we need for the purposes above. We do not sell personal information.
We retain account data for as long as the account is open and then for a short winding-up period (generally up to 24 months, or longer if the law requires, for example to handle a dispute or a confidentiality incident).
Contact-form messages are kept long enough to respond and document the request. Cookie consent records are kept to show what you chose.
When information is no longer required, we destroy it or de-identify it so that it can no longer identify you in a reasonably foreseeable way.
8. Who we share information with
Service providers: hosting, content delivery and related infrastructure (the Site is designed to run on providers such as Vercel). They may process data only on our instructions.
Travel partners: when you click a partner offer we send the search parameters needed to open that partner’s booking page (origin, destination, dates, traveller counts). That is a disclosure you initiate. The partner then deals with you under its own policy.
Legal and safety: we may disclose information if required by law, a court, or to protect the Site, our users or the public.
We do not disclose your account to partners for their independent marketing unless you separately consent.
9. Transfers outside Quebec and Canada (Law 25 and PIPEDA)
Personal information may be stored or processed on servers outside Quebec or outside Canada (including the United States) by our hosting provider. In those places, local law may allow courts, national-security agencies or regulators to access information.
Before transferring personal information outside Quebec, Law 25 requires us to assess the sensitivity of the information, the purposes, the protection offered, and the legal framework of the destination, and to conclude a written agreement with appropriate safeguards. We will complete that assessment before any commercial transfer of Quebec residents’ information.
By using the Site you are informed of this possible cross-border processing. If you do not want information stored outside Canada, do not create an account and limit the information you submit.
10. Safeguards
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. Passwords are stored as salted hashes (PBKDF2). Sessions are kept in your browser. Transmission should occur over HTTPS in production.
No method of transmission or storage is perfectly secure. Please use a unique password and sign out on shared devices.
Quebec Law 25 confidentiality incidents: if we have cause to believe a confidentiality incident presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec and the affected persons, and keep the required incident register. Under PIPEDA we will report a breach of security safeguards that poses a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to affected individuals, and keep records of all breaches.
11. Your rights
You may request access to the personal information we hold about you, a correction of inaccurate information, and, where the law allows, deletion or de-indexing.
Quebec residents also have rights relating to automated decision-making (we do not currently make legal or similarly significant automated decisions about you), data portability in the circumstances set out in Law 25, and information about technology used to identify, locate or profile you. We do not use profiling to evaluate work performance, economic situation, health, preferences, interests or behaviour except to remember your language, cookie and search preferences with your knowledge.
Alberta and British Columbia residents have access and correction rights under PIPA.
To exercise rights, email privacy@airstay.ca from the address on your account. We will verify your identity and respond within the time the applicable statute requires (generally 30 days under PIPEDA, subject to permitted extensions).
You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) if you are in Quebec, or the provincial privacy commissioner in Alberta or British Columbia.
13. Language (Quebec Charter of the French Language)
A French version of this Policy and of our Terms of Service is available on the Site. If you are in Quebec, you may deal with us in French. If there is a discrepancy that affects a Quebec consumer contract of adhesion, the French version prevails for that consumer to the extent required by Quebec law.
14. Changes
We may update this Policy. The “Last updated” date will change. If we make a material change to purposes or to how we handle sensitive information, we will ask for new consent where the law requires it. Last updated: August 19, 2026.