Effective Date: 2026-07-31
Version: 2.0
Applies to: kominotelakay.com (web) and the Kominote Lakay mobile application (iOS and Android)
1. Who We Are
Kominote Lakay (“Kominote,” “we,” “us,” or “our”) is operated by Philippe-Remy Enterprise Corp., a Canadian corporation based in Clarence-Rockland, Ontario, Canada.
We are committed to protecting your personal information and being transparent about how we collect, use, store, and share it. This Privacy Policy applies to all visitors, registered users, business owners, and advertisers who interact with our platform on the web or in our mobile applications.
- General contact: hello@kominotelakay.com
- Privacy inquiries: privacy@kominotelakay.com
- Postal: Philippe-Remy Enterprise Corp., Clarence-Rockland, Ontario, Canada
2. Privacy Officer
In accordance with Quebec Law 25 and Canadian privacy best practices, we have designated a Privacy Officer responsible for our compliance with this Policy and applicable privacy law.
- Privacy Officer: Eddy Remy
- Contact: privacy@kominotelakay.com
You can contact the Privacy Officer directly for any concern about how your personal information is handled, to exercise your rights described in Section 10, or to report a suspected privacy incident.
3. Scope of This Policy
This Policy covers:
- Our website at kominotelakay.com and any subdomain
- The Kominote Lakay mobile application for iOS and Android
- Any related email, notification, or messaging service we operate
Third-party websites we may link to (e.g., a business’s own website) are governed by their own policies, not this one.
4. Information We Collect
4.1 Information you provide directly
- Account credentials — name, email address, password (stored hashed, never in plain text)
- Profile information — display name, avatar, city, country, preferred language
- Business listing content — business name, address, phone, email, website, description, hours, photos, category, social links, and any other fields you fill in
- Reviews and ratings you submit for listed businesses
- Messages you send through direct messaging, group chat, forum threads, or in-app contact forms
- Bookmarks and saved listings
- Payment information if you subscribe to a premium listing or advertising plan (processed by our payment provider; we do not store card numbers on our servers)
- Support requests and correspondence you send to us
4.2 Information collected automatically
On the web:
- IP address, browser type and version, operating system
- Pages visited, links clicked, session duration
- Cookie identifiers (see Section 11)
In the mobile app:
- Device model, operating system version, app version
- Push notification token (issued by Apple or Google) used to deliver notifications
- Approximate location (city / country) derived from device GPS when you explicitly grant location permission, used only in the foreground of the app — we do NOT track your location in the background
- Crash reports and error logs (opt-in only — see Section 6)
We do not collect: precise GPS coordinates for tracking, background location, contacts, calendar, health, fitness, financial data outside subscription payments, biometric data, or advertising identifiers for cross-app tracking.
4.3 Information from third parties
- If you sign in via Apple, Google, or another OAuth provider, we receive the basic profile data those platforms share (email, name, avatar) subject to your consent on their side
- Payment providers send us transaction confirmations
- Business review information from Google Places may appear on listings that have a linked Google business profile — this is publicly available data pulled server-side, and no data about you is shared with Google to obtain it
5. How We Use Your Information
We use your personal information to:
- Create, authenticate, and manage your account
- Publish, edit, and manage your business listings
- Enable community features: messaging, groups, forum posts, reviews, bookmarks
- Deliver push notifications you have opted in to receive
- Show you nearby businesses when you grant location permission
- Process payments for premium subscriptions or advertising placements
- Respond to your inquiries and provide support
- Send transactional emails (account confirmations, listing approvals, billing receipts)
- Improve the platform and understand how our community uses it
- Comply with our legal obligations, including tax and audit requirements under Canadian law
- Detect, prevent, and respond to fraud, abuse, and security threats
We do not use your personal information for automated decision-making, profiling that produces legal effects, targeted advertising to you, or sale to data brokers.
6. Legal Basis for Processing (GDPR)
For users in the European Economic Area, the United Kingdom, or Switzerland, our legal basis for processing your personal data under the General Data Protection Regulation (GDPR) is:
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account | Contract — Art. 6(1)(b) |
| Publishing your business listing (public content you upload) | Contract — Art. 6(1)(b) |
| Delivering messages, forum posts, reviews | Contract — Art. 6(1)(b) |
| Location detection for nearby businesses | Consent — Art. 6(1)(a) |
| Push notifications | Consent — Art. 6(1)(a) |
| Analytics and crash reporting | Consent — Art. 6(1)(a) |
| Fraud prevention, security, legal compliance | Legitimate interest / Legal obligation — Art. 6(1)(f) and (c) |
| Payment processing | Contract — Art. 6(1)(b) |
You can withdraw any consent at any time in the app’s Account → Privacy screen or by contacting the Privacy Officer.
7. Mobile App Permissions
The mobile app requests only the following device permissions, each of which you can grant, deny, or revoke at any time in your device settings:
| Permission | When we ask | Why |
|---|---|---|
| Location (foreground only) | When you tap “Near me” or open the map | Show businesses close to you; determine your city for the home feed. Never used in the background. |
| Photo library | When you upload a listing photo, avatar, or chat image | Attach the image you choose. We do not scan or index your library. |
| Camera | When you take a new photo for a listing or chat | Capture the image you choose. Not used at any other time. |
| Notifications | On first launch (opt-in) | Alert you to new messages, replies, and listing activity. Can be disabled anytime. |
If you decline a permission, the corresponding feature is disabled but the rest of the app continues to work.
8. How We Share Your Information
We do not sell your personal information under any definition of “sale” used by GDPR, PIPEDA, Quebec Law 25, or CCPA/CPRA.
We share information only in the following limited circumstances:
8.1 Public listing information
When your business listing is approved and published, the information you submitted (business name, address, description, photos, hours, social links) becomes publicly visible in the app and on the web. You control what you include in your listing.
Reviews you post are also public, attributed to your display name.
8.2 Service providers
We work with the following third-party service providers to operate the platform. Each is contractually required to protect your information and use it only for the services they provide to us.
| Provider | Purpose | Data received | Region |
|---|---|---|---|
| Supabase Inc. | Authentication, database, file storage, real-time messaging, edge functions | All account data, profile, listings, messages, photos, bookmarks, reviews | United States (AWS) |
| Cloudflare, Inc. (R2 storage) | Chat and forum media hosting | Uploaded images and voice notes | United States |
| Apple Push Notification service | iOS push notification delivery | Device push token, notification title/body | United States |
| Firebase Cloud Messaging (Google) | Android push notification delivery | Device push token, notification title/body | United States |
| Expo (650 Industries, Inc.) | Push notification orchestration and app-update delivery | Push token, app version | United States |
| Google Places API | Business review sync (read-only, server-side) | Business identifier only — no user data is sent to Google | United States |
| Giphy, Inc. | Optional GIF picker in chat | GIF search queries you type into the picker | United States |
| OpenStreetMap / Nominatim | Reverse geocoding of coordinates to city/country | Approximate latitude/longitude, server-side only | Netherlands / distributed |
| Sentry (Functional Software, Inc.) — opt-in only | Crash reporting and error monitoring, when enabled | Crash stack traces, opaque user ID (no email, no message content) | United States |
| Payment processor (Stripe or equivalent) | Subscription and advertising payments | Card details, billing address (processed by them, never stored by us) | United States |
Supabase’s Data Processing Addendum, including Standard Contractual Clauses (SCCs) for GDPR-covered transfers, is available on request.
8.3 Legal requirements
We may disclose your information if compelled to do so by a valid legal request from Canadian authorities or a court of competent jurisdiction, or when necessary to protect our rights, users’ safety, or investigate fraud.
8.4 Business transfers
If we merge, are acquired, or sell substantially all our assets, personal information may be transferred to the successor entity, subject to the same protections as in this Policy.
9. Data Retention
We retain your information only as long as necessary to provide the service, meet legal obligations, or resolve disputes.
| Data category | Retention |
|---|---|
| Active account data (profile, listings, bookmarks, reviews) | For as long as your account is active |
| Direct messages, group messages | Retained until you or the other participant deletes them, or your account is deleted |
| Uploaded photos and media | Retained while linked to a listing / message; permanently deleted 90 days after account deletion |
| Payment records | 7 years (Canadian tax law) |
| Support correspondence | 3 years after resolution |
| Push notification tokens | Deleted immediately when you sign out or disable notifications |
| Crash and error logs (if analytics opted in) | 90 days |
| Access, deletion, and correction request logs | 3 years (compliance audit trail) |
When you delete your account, we begin permanent removal of your personal information within 7 days. Business listings you owned may be marked as unclaimed but remain in the directory unless you request their deletion. Publicly indexed content (e.g., listing pages already cached by search engines) may persist in third-party indexes for a time we cannot control.
10. Your Rights
Depending on where you live, you have some or all of the following rights over your personal information. All rights apply to all users regardless of location — we extend GDPR-level rights globally as a matter of policy.
- Access — Get a copy of the personal information we hold about you
- Portability — Receive your data in a machine-readable format (JSON export)
- Correction — Update inaccurate or incomplete information
- Deletion — Request permanent deletion of your account and personal data
- Restriction — Temporarily pause processing while a dispute is resolved
- Objection — Object to processing based on legitimate interests
- Withdraw consent — Revoke any consent you previously gave (e.g., turn off analytics or notifications)
- Complain to a regulator — File a complaint with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, your EU Data Protection Authority, or the California Attorney General as applicable
How to exercise these rights:
- In-app: Account → Privacy contains toggles for consent revocation and a Delete account button
- By email: privacy@kominotelakay.com
We respond to all requests within 30 days. We may ask you to verify your identity before acting on a request.
11. Cookies and Similar Technologies
Website: We use cookies to keep you signed in, remember your language and city preferences, and understand how visitors use the platform. You can control cookies through your browser settings; disabling them may sign you out or lose preferences.
We do not use cookies for third-party advertising or cross-site tracking.
Mobile app: The app does not use browser cookies. It uses secure device storage (Apple Keychain / Android Keystore) for your session token, and local caches for offline data. Uninstalling the app removes all of it.
12. International Data Transfers
Kominote is based in Canada, but several of the service providers listed in Section 8.2 are located in the United States. Where personal information about users in the European Economic Area, United Kingdom, or Switzerland is transferred outside of that region, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where available, supplementary safeguards to ensure adequate protection.
Where possible, personal data of Canadian users is processed by providers with Canadian regions or infrastructure. On request, we will provide a summary of the safeguards in place for any specific transfer.
13. Data Security
We take reasonable technical and organizational measures to protect your personal information from unauthorized access, loss, or disclosure, including:
- All network traffic encrypted in transit (TLS 1.2+)
- Passwords hashed using industry-standard algorithms (never stored in plain text)
- Session tokens stored in device secure storage (Keychain / Keystore)
- Row-level security on the database ensuring users can only read/write their own data
- Access controls limiting who on our team can view personal information
- Third-party service providers audited for equivalent controls
No system is completely secure. If we detect a breach that creates a real risk of significant harm to you, we will notify you and the relevant regulator without undue delay, in accordance with PIPEDA, Quebec Law 25, and GDPR requirements.
14. Children’s Privacy
Kominote Lakay is intended for users 13 years of age and older. We do not knowingly collect personal information from anyone under 13. If you are under 13, please do not create an account or submit any information.
If you believe a person under 13 has provided us with personal information, please contact privacy@kominotelakay.com and we will delete it promptly.
Users between 13 and the age of digital consent in their jurisdiction (16 in most of the EU) may require parental permission before creating an account under applicable local law.
15. Regional Notices
15.1 Quebec (Law 25 — An Act Respecting the Protection of Personal Information in the Private Sector)
- Our designated Privacy Officer is identified in Section 2
- Consent to collection and use of personal information is obtained separately for each purpose; you may withdraw consent at any time
- Personal information about Quebec residents that must be transferred outside Quebec is disclosed in Section 8 with the safeguards described in Section 12
- You may file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca)
15.2 European Economic Area, United Kingdom, Switzerland (GDPR / UK-GDPR / FADP)
- Our lawful bases are enumerated in Section 6
- You have the rights described in Section 10 including the right to lodge a complaint with your local Data Protection Authority
- We are not required to appoint an EU representative under Article 27 because our processing is not large-scale and does not target EEA residents specifically, but we monitor this obligation as we grow
15.3 California, USA (CCPA/CPRA)
- We do not “sell” or “share” personal information as those terms are defined under CCPA/CPRA
- California residents may request access, deletion, and correction of personal information under Section 10
- We do not knowingly collect Sensitive Personal Information as defined by CPRA (SSN, financial account credentials, precise geolocation, biometrics, health, etc.)
- California residents may designate an authorized agent to submit requests on their behalf
15.4 Other Canadian Provinces (PIPEDA)
Users outside Quebec are protected by the Personal Information Protection and Electronic Documents Act. You may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).
16. Changes to This Policy
We may update this Privacy Policy as we grow, add features, or as law changes. When we do:
- We update the Version and Effective Date at the top of this page
- For material changes, we notify registered users by email or through an in-app banner
- The mobile app requires you to re-accept the updated Policy on next launch if a material change has occurred
- The previous version remains accessible on request from privacy@kominotelakay.com
Continued use of the platform after a change means you accept the revised Policy.
17. Contact Us
For any question, concern, or request regarding this Privacy Policy or your personal information:
- Privacy Officer: Eddy Remy
- Email: privacy@kominotelakay.com
- Postal: Philippe-Remy Enterprise Corp., Clarence-Rockland, Ontario, Canada
We aim to acknowledge receipt within 3 business days and provide a substantive response within 30 days.