1. Who we are
Where2 ("Where2", "we", "us") operates the Where2 mobile apps and the website at where2.ca (together, the "Service"). Where2 is based in Montreal, Quebec, Canada, and is responsible for the personal information described in this policy.
This policy applies to everyone who uses the Service: people discovering and booking things to do, and the businesses, venues and hosts who list them. It does not cover the separate privacy practices of a business you book with; they handle your information under their own policies.
2. Information we collect
Information you give us
| What | Examples |
|---|---|
| Account | Name, email address, password (stored only as a secure hash), phone number if you add one, age range, profile photo. |
| Preferences | Favourite categories, vibes and budget, language, theme, distance unit, search and notification radius, notification choices, privacy settings. |
| Bookings and orders | Tickets, reservations, appointments, menu orders and tabs, guest details you enter for a booking, notes to a venue, reviews. |
| Messages and social | Messages you send to other users or venues, friends you add, plans you share. |
| Business and host details | Business name, address, contact details, menus, events, photos, staff accounts, and payout details handled by our payment provider. |
| Verification | For hosts who apply to be verified: a photo of government ID and a selfie (see Host verification). |
| Support and contact | What you tell us in a support ticket or through our contact form, and your email address so we can reply. |
Information collected automatically
- Location. Your device's location when you allow it, and the last location you used the app from (see Location).
- Usage. Pages and listings you view, searches and filters you use, buttons you tap, and how you arrived at a listing. We use this to improve Where2 and to give businesses aggregate statistics about their listings.
- Device and app. Platform (iPhone, Android or web), app version, and a push notification token if you allow notifications.
- Logs. Our servers record technical information such as IP address, time and the address requested, to keep the Service secure and working.
Information from others
- Sign in with Google or Apple. If you choose this, we receive your name, email address and an account identifier from that provider. We never see your Google or Apple password.
- Businesses you book with may add details to your booking, such as a table or check-in status.
- Public business registries. To verify a business, we may look up publicly available registration information.
3. How we use it
- To run the Service: create your account, sign you in, show listings near you, and process bookings, tickets and orders.
- To personalize what you see, based on your preferences and location.
- To send you booking confirmations, reminders, verification codes and, if you've turned them on, notifications about new events and messages.
- To verify hosts and businesses and keep the community safe, including preventing fraud, abuse and repeated failed sign-ins.
- To answer your questions and support requests.
- To understand how Where2 is used, fix problems and build new features.
- To give businesses statistics about how their listings perform. These are aggregated and don't identify you.
- To meet legal, tax and accounting obligations, and to enforce our Terms & Conditions.
We rely on your consent, which you give when you create an account and when you allow features such as location and notifications. You can withdraw consent at any time (see Your rights and choices), though some features may then stop working.
4. How we share it
We do not sell or rent your personal information.
- With the business you book with. When you book, buy a ticket or place an order, that business receives what it needs to serve you, such as your name, booking details and any notes you add.
- With other users, as you choose. Your profile, plans and messages are visible to the people you share them with. Your profile is private unless you make it public, and your location is hidden from friends by default.
- With service providers who work on our behalf and may only use your information to provide their service to us:
- DigitalOcean: hosting, database, file storage and the AI model behind our translation and concierge features.
- Stripe: payments, payouts and refunds.
- Microsoft 365: sending email.
- Google Firebase and Apple: push notifications.
- Google Maps: maps, place search and addresses.
- Google and Apple: sign-in, if you choose it.
- For legal reasons, when required by law or to protect the rights, safety and property of our users, the public or Where2.
- In a business transfer, such as a merger or sale, where your information would remain protected by this policy.
5. Location
Location is what makes Where2 useful: it lets us show events and places near you, order results by distance, and send nearby-event notifications if you turn them on. We ask for permission before using your device's location, and you can turn it off in your device settings at any time. Without it, you can still search by entering an address or area.
We store the last location you used the app from so nearby results load quickly. Your location is never shown to other users unless you choose to share it.
6. Host verification
Hosts who apply for verification upload a photo of government-issued ID and a selfie. We use these only to confirm your identity and protect guests. They are encrypted before they are stored, only authorized reviewers can view them, and the selfie is removed once the review is complete. We keep the ID image only as long as needed to verify you and meet our legal obligations.
7. Payments
Payments are processed by Stripe. Your card number goes directly to Stripe; Where2 never sees or stores your full card details. We keep a record of your transactions (amount, date, what was purchased) for bookings, refunds, disputes and accounting. Businesses that receive payouts provide their banking and identity details to Stripe under Stripe's own terms and privacy policy.
8. Cookies and local storage
Where2 uses a small amount of storage in your browser or app to keep you signed in and to remember your language, theme and location settings. We use a short-lived cookie during Google or Apple sign-in. We do not use advertising cookies or third-party ad trackers.
Map features are provided by Google Maps, which may set its own cookies under Google's privacy policy. Clearing your browser storage signs you out and resets these preferences.
9. AI features
Where2 offers optional AI features, such as translating a listing between English and French and an AI concierge that suggests things to do. When you use them, the text involved is sent to the AI model we run on DigitalOcean to produce the answer. We don't use your conversations to advertise to you. Please don't include sensitive personal information in what you ask.
10. Where your data is stored
Our servers, database and file storage are hosted by DigitalOcean in Toronto, Canada. Some of our service providers, such as Stripe, Google, Apple and Microsoft, may process information in the United States or other countries. When that happens, your information may be subject to the laws of those countries. We choose providers that protect personal information to a standard comparable to Canadian law.
11. How long we keep it
We keep your information while your account is open and for as long as we need it to provide the Service. After you close your account we delete or anonymize your personal information, except what we must keep for legal, tax, accounting or dispute purposes, such as transaction records, which we keep for the period the law requires. Server logs are kept for a limited time for security.
12. Your rights and choices
Depending on where you live, including under Quebec's Act respecting the protection of personal information in the private sector and Canada's PIPEDA, you have the right to:
- Access the personal information we hold about you.
- Correct information that is inaccurate or incomplete.
- Delete your account and personal information.
- Withdraw consent to a use of your information.
- Receive a copy of information you gave us in a commonly used format.
To make a request, email our Privacy Officer at jaidenbruce@where2.ca. We'll confirm your identity and respond within 30 days. Many settings can be changed yourself in the app: your profile, preferences, notification choices, whether your profile is public, and whether friends can see your location.
If you're not satisfied with our answer, you can contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
13. Security
We protect your information with encryption in transit (HTTPS), hashed passwords, encrypted storage for identity documents, limits on repeated sign-in attempts, and access restricted to people who need it. No system is perfectly secure; if a breach puts you at risk of serious harm, we will notify you and the authorities as the law requires.
14. Children
Where2 is not intended for children under 14, and we don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it. Some events and venues have their own age requirements.
15. Changes to this policy
We may update this policy as Where2 changes. We'll change the date at the top, and if a change is significant we'll let you know in the app or by email before it takes effect.
