Your privacy at Dock & Loon

Last updated November 3 2026.

Dock & Loon is a cottage rental website at dockandloon.ca. Renters find cottages. Owners list them and deal with renters directly. This policy explains what information we collect, why, who sees it, how long we keep it and what you can ask us to do.

Dock & Loon is an operating name of Lifestyle Basics Enterprise Inc., 2026 Tenth Line Road, Ottawa, Ontario K4A 4X4. In this policy, “we” and “us” mean Dock & Loon.

We follow Canada’s private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada’s Anti-Spam Legislation (CASL) for email.

In short

We collect only what we need to run the site, list cottages and arrange stays.
We never sell your information.
Your exact cottage address, arrival instructions, permit files and messages are stored encrypted.
Renters see an owner’s exact address only after the owner confirms the booking.
Names shown on the site are first names only.
We do not store what you type in the search box or the cottage question box.
We do not use advertising or tracking cookies.
You can ask for a copy of your information, ask us to correct it, or ask us to delete it.

1. Who is responsible

The Privacy Officer, Dock & Loon, is responsible for this policy and for how we handle personal information.

Reach the Privacy Officer:

through the contact page at dockandloon.ca (choose the topic “Privacy or my personal information”), or
by mail: Privacy Officer, Dock & Loon, 2026 Tenth Line Road, Ottawa, Ontario K4A 4X4.

We do not handle privacy requests by phone.

2. What we collect and why

Everyone who visits

Pages you visit. Our host’s web servers record basic visit details, such as your internet address, the page and the time. This keeps the site running and secure. Our host keeps basic visit logs for a limited time for security.
Abuse protection and records. To stop spam and attacks, our forms and tools count how often a visitor uses them. For this we use a scrambled form of your internet address, never the address itself, and these counts clear themselves within an hour. We also keep the scrambled form with our activity and security records, with messages sent through our contact forms, and with your email consent, as evidence if there is a dispute or an attack. It is kept as long as the record it belongs to (see section 12).
Search. When you search for a cottage, the filters you choose (for example a region, a week or the number of guests) appear in the page address. When you type a search in your own words, we turn your words into filters in memory. We do not save your words. We keep the resulting filters for one day so the same search is faster next time.
“Check a cottage before you pay.” You can paste a listing link and choose a township or type a licence number. From the link we read only the website name; we never open the link. We do not store anything you type.
“Questions about this cottage.” We do not save your question. See section 4.

Owners

Your account: your first and last name, your email address and your password. WordPress stores your password scrambled; nobody can read it. We also record the version of the owner terms you accepted, and when.
Your listing: cottage name, lake and township, size, description, house rules, prices and photos. Your listing is public. It shows your first name only.
Your photos: before any photo is saved, we remove the hidden location (GPS), camera details and date that phones add. If a photo cannot be cleaned, we refuse the upload.
Your exact address and arrival instructions (for example a lockbox code or directions): stored encrypted. They never appear in the public listing or in search. See section 3.
Your permit: your township licence number, its expiry date and a proof file, or, where your township has no licence by-law, a declaration you sign by typing your name. The licence number and the proof file are stored encrypted. Your public listing shows the township, the expiry date and the licence number.
Calendar links: if you paste an Airbnb, Vrbo or other calendar link, we store it encrypted. We read only the booked dates from it. We never read guest names or notes in those calendars.
Your returning-guest list: the email addresses of families you add because they stayed at your cottage before and agreed to share their email with us. See section 5.
D&L Ledger (optional): if you use the free Ledger, we keep the properties, licence details, income and expense lines and reminders you enter. Licence numbers and notes are stored encrypted. Only you can see your Ledger. Ledger reminders appear inside the Ledger; we do not email or text them.
Price comparison (optional): if you choose to show it, the total you saw for a week on another booking site, and the date you entered it.
Owner website (optional): if you turn on a small website for your cottage, it shows the same public details as your listing, plus a form visitors can use to message you. You read those messages on your Dock & Loon dashboard.

Renters

Your account: you create an account on our “Create your account” page. We keep your first and last name, your email address and your password, so you can sign in, send messages, request a booking and leave a review. You confirm you are 18 or older and agree to our terms and this policy. WordPress stores your password scrambled; nobody can read it.
Email confirmation: we email you a link to confirm your email address. The link works for 48 hours. We record that you confirmed it. We need this for the returning-guest price.
Booking requests, when bookings are switched on: your name, email, phone number, the dates, the number of guests and pets, the extras you chose and any note to the owner. The owner of that cottage sees them so they can arrange your stay.
Price quotes: when you price a week while signed in, we keep the quote with your account so the price you saw is the price you pay.
Reviews: after a stay booked through Dock & Loon, you can write a review. Your review is public with your first name and the month of your stay. A staff member reads every review before it goes up. Nobody edits your words.
Testimonials an owner adds: an owner can publish short testimonials from past guests. They show the name the owner typed and the label “From the owner’s past guests, not checked by Dock & Loon”. The owner is responsible for having the guest’s permission. If you find your words or name on a listing without your agreement, ask us through the contact page and we will remove them.
Owner replies: an owner can reply once to a published review. The reply is public and is read by staff before it goes up.

Seasonal stays (28 to 120 nights): when you request a seasonal stay, we also ask for your permanent home address, because the seasonal stay agreement confirms the cottage will not be your permanent home. Your address is stored encrypted with the booking. We keep it as long as the other renter details on the booking (see section 12), and remove it if you ask us to erase your information.
Ontario guest register: for stays under 28 nights, Ontario law requires online accommodation platforms to keep a guest register (Accommodation Sector Registration of Guests Act, 2021, and O. Reg. 292/25). When you request a booking, we record the booker's name, billing address and phone number and, if a vehicle will be parked at the cottage and you know it at booking, its make, model, licence plate and the province or state of the plate. We store this record encrypted, only our staff can open it, and every view is logged. Cottage owners do not have access to this register. We disclose it only to police, and only in a human-trafficking case, with a court order or an urgent written demand, as that law allows. We keep it until the end of the sixth year after the end of the fiscal year in which it was recorded, then delete it automatically. You can ask for a copy at any time. Because the law requires us to keep it, an erase request does not remove it before that period ends; it is then deleted automatically.

People who write to us

Contact page and owner-website forms: your name, the email address you give for our reply, the topic and your message. Your email address and message are stored encrypted. If you write through an owner’s website, that owner sees your name, email address and message. Dock & Loon staff can also read them on our site. We do not forward them by email. We keep them for 24 months.

Cottages for sale by owner

Messages to a seller: if you use the form on a cottage-for-sale ad, we keep your name, your email address and your message, stored encrypted, so the owner selling the cottage can read them on their Dock & Loon page and reply to you directly. Dock & Loon does not answer these messages. We do not forward them by email. We delete them 12 months after they are sent, or sooner if you ask us to erase your information.
Ownership documents from sellers: an owner who posts a cottage-for-sale ad sends a document that shows they own the cottage. The file is stored encrypted and only our staff can open it. Each time a staff member opens it, we record who and when. We delete the file as soon as the check is done and keep only the date of the check.

Owners we contact about listing with us

We may write to cottage owners whose business contact details are published, to invite them to list. We use only the business contact details they published and the public facts about their rental. We do not write to an address published with a request not to receive unsolicited messages, and we write only about renting their cottage. Every such email says who we are, gives our mailing address and the contact page, and has a way to say no to future emails. If you say no, we stop.

3. Your exact address and arrival instructions

Renters see only the lake and township on a listing.
A renter sees the exact address only after the owner confirms their booking.
A renter sees the arrival instructions from 48 hours before check-in until the end of check-out day.
Our checking team can open the address and the permit file to review a listing. Each time a staff member opens one, we record who and when.

4. Messages, held messages and AI help

Messages between renters and owners

When you send a message through “Ask the owner”, or an owner replies, we store the message so both of you can read the conversation on Dock & Loon.

Stored encrypted. The text of every message is encrypted when we store it. Our activity records note that a message was sent, held or released, but never its text.
Kept 24 months. We delete messages 24 months after they are sent.
Your copy and your choice. If you ask for a copy of your information, it includes the messages you sent and the messages you received. If you ask us to erase your information, we delete your conversations as a renter and every message you wrote.
Not emailed. Messages stay on Dock & Loon. We do not send their text by email.

Held messages

Before a message reaches the other person, our system checks it with fixed rules for common rental-scam signs: requests to pay outside Dock & Loon (for example an e-Transfer, a wire, gift cards or crypto), links to other websites, phone numbers, email addresses and outside chat apps. If it finds one, the message is held and both people see a warning.

A Dock & Loon staff member may read a held message only for a scam review: to decide whether to release it to the other person or keep it on hold.
Every time a staff member opens a held message, and every decision, is written to our activity record.
A held message never changes or closes anyone’s account by itself.

AI drafts for owners

Owners can press “Write an AI draft” to get a suggested reply to a renter’s message.

Contact details removed first. Before the renter’s message goes to the AI helper, we remove phone numbers, email addresses and links. We do not send the renter’s name or the owner’s name.
Made in memory. The draft is made in memory and shown to the owner on the page. We do not store the draft. Nothing is sent to the renter until the owner reads it, edits it and presses Send reply. We note that the reply started from an AI draft.
The AI helper may also read the facts the owner already published on the listing, so the draft can answer from them.

AI listing writer for owners

Owners can answer short questions, or paste the text of their own listing from another site, to get a draft description. We remove links, email addresses and phone numbers from pasted text. The draft is saved to the owner’s listing only as a draft. Nothing goes public until the owner reads, edits and approves it.

The cottage question box

When you type a question in “Questions about this cottage”, we do not save your question. We remove phone numbers, email addresses and links before the AI helper reads it. The answer quotes only facts already shown on the listing.

Who provides the AI helper

Today the AI helper runs on our own systems with fixed rules only, and no message, question or listing text leaves Dock & Loon. Before we switch on an outside AI provider, we will name it here, say where it processes information, and update this policy.

5. Returning-guest list and the 3% price

Owners can offer a lower Dock & Loon service fee (3% instead of 6%) to families who stayed at their cottage before.

How you qualify as a renter. You must be signed in, with a confirmed email address. Then either you have a past Dock & Loon stay at that cottage, or the owner has your email address on their returning-guest list (and you use the owner’s returning-guest link).
Who an owner can add. Owners can add only families who stayed with them and agreed to share their email with us. Before adding a family, the owner must tick two boxes: “This family has stayed at my cottage before.” and “This family agreed that I can give Dock & Loon their email.”
What the owner’s list holds. Only the email address the owner adds. We store the address encrypted. We also keep a scrambled form of it, used only to match it to your account. Only that owner sees the list.
Limits. An owner can add at most 50 families to a cottage’s list in any 12 months.
Nothing is revealed. The site never tells anyone whether an email address is on a list.
How long. An entry stays until the owner removes it, the listing is deleted, or you ask us to erase your information. If you ask, we remove you from every owner’s list.

6. Payments and identity checks

Payments, when card payments are switched on

Card payments are handled by Stripe. Your card details go straight to Stripe. Dock & Loon never sees or stores your full card number. We keep the Stripe reference for each payment, the amounts and the booking it belongs to. The owner’s Stripe account receives the payment; Dock & Loon receives its service fee. Owners enter their bank details with Stripe; we never see them.

Bank debit for the balance, when it is switched on: if the owner offers it, you can pay the balance of a booking by Canadian bank debit (pre-authorized debit). Stripe collects your bank account details and your debit agreement on a Stripe page. Dock & Loon never sees your bank account. We keep only the Stripe reference, the amount and the booking it belongs to.

Owner identity check, when it is switched on

Owners prove who they are through Stripe Identity: a photo of a government ID and a selfie. Stripe handles the images. We never see or keep them. We keep only the Stripe reference, the result (passed or not) and the date.

Stripe’s own privacy policy applies to what you give Stripe. Stripe may process information outside Canada, including in the United States. See section 10.

D&L Checked: ownership document: for the D&L Checked mark, an owner sends a document that shows they own the cottage. The file is stored encrypted and only our staff can open it. Each time a staff member opens it, we record who and when. We delete the file as soon as the check is done and keep only the type of document and the date of the check.
D&L Checked: identity: the D&L Checked mark also needs the owner identity check through Stripe Identity described above. For the mark we keep only the Stripe reference, the result (passed or not) and the date.

Tax reporting

When bookings turn on, Canadian tax law may require us to report owners’ rental income to the Canada Revenue Agency. We do not collect tax numbers today. We will update this policy before we do.

7. Calendars

Calendar links (iCal). Owners can paste a calendar link from Airbnb, Vrbo or another site. We read only booked dates. We never read event titles, guest names or notes. Owners can also share a Dock & Loon calendar link; it shows only “Not available” dates.
Google Calendar and Outlook, when they are switched on. An owner can connect one calendar they own. We read only busy dates from it. We add each booking request and booking to that calendar with the renter’s first name only, never their email or phone. The access keys are stored encrypted. We also keep the name of the calendar you chose and a shortened label of the account, such as the first letter and the domain of its email address. When the owner disconnects, we delete the keys, ask Google or Microsoft to cancel our access and, if the owner chooses, remove our events. We keep the connection record, without keys, for 24 months. Google’s or Microsoft’s privacy policy applies to the owner’s calendar account.

8. Cookies and browser storage

Sign-in cookies. When you sign in, WordPress sets cookies that keep you signed in. They are needed for your account to work.
Saved cottages. When you press Save on a cottage, the list is kept in your own browser only. We never receive it. Clearing your browser data removes it.
No tracking. We do not use advertising cookies, analytics trackers or social-media pixels.

9. Who sees your information

Owners see the details of renters who message them, request a booking at their cottage, or write to them through their owner website.
Renters see an owner’s public listing and first name, and the exact address only after a confirmed booking.
Visitors see owners’ and renters’ first names only. Our site does not publish a list of account holders or author pages.
Our staff see what they need for their task. Permit files, permit numbers and exact addresses are open only to administrators and our checking team. Every view is recorded.
Service providers that work for us:
- Web Hosting Canada hosts the site and our backups on servers in Canada (Quebec and Ontario).
- Stripe processes payments and identity checks, when they are switched on.
- Google or Microsoft, only if an owner connects their calendar.
- An AI provider, only after we name it in section 4.
- Web Hosting Canada’s mail server sends account emails from Canada.

Our service providers may use your information only to do their work for us, and we require them by contract to protect it.

We share information with others only when the law requires it, for example a court order or a tax-reporting rule, or to protect people from fraud or harm.

We never sell your information.

10. Where your information is stored

Our website, its database and its backups are stored in Canada, on Web Hosting Canada servers in Quebec and Ontario.

Some service providers process information outside Canada, mainly in the United States: Stripe (payments and identity checks), Google or Microsoft (only if an owner connects a calendar) and, once named in section 4, our AI provider. While your information is in another country, the courts, law enforcement and national security authorities of that country may be able to access it under its laws. We stay responsible for information we give to service providers, and we use contracts to require them to protect it and use it only for the work they do for us.

11. How we protect it

Exact addresses, arrival instructions, permit numbers, permit files, calendar links and keys, contact messages, renter-owner messages, returning-guest emails and Ledger notes are stored encrypted.
Permit files are kept outside the public part of the site.
Only administrators and our checking team can open sensitive details. Each view is recorded.
Our activity records note who changed what and when. They never store the sensitive value itself.
Our host makes a backup of the site every day and keeps it for 14 days. Our own encrypted backups are kept for up to 12 months, then deleted.

No system is perfect. If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as soon as feasible. We will tell you what happened, what information was involved, what we have done and what you can do to protect yourself. We record every breach, even a minor one, and keep that record for 7 years.

12. How long we keep it

Information	How long
Your account	Until you ask us to close it
Closed accounts kept for records (no name, email or sign-in)	7 years after closing
Renter details on a booking	7 years after check-out (tax records), then the name, email, phone and notes are removed; amounts stay. If you ask us to erase your information, they are removed then.
Price quotes never booked	90 days after they expire
Calendar dates	24 months after the end date
Calendar connections, Google and Outlook	Keys deleted when you disconnect; the record without keys 24 months
Exact address, arrival instructions, calendar links	Until the listing is deleted
Permits and permit files	7 years after the listing is deleted
Identity-check result	7 years after the account is closed
Messages between renters and owners	24 months
Contact page and owner-website messages	24 months
Returning-guest list entries	Until the owner removes them, the listing is deleted, or you ask us to erase them
D&L Ledger	Until you delete it or close your account
Reviews	Until the review is taken down. Your name is removed if you ask us to erase your information.
Email consent records	While your consent is active, then 3 years after you withdraw (proof the law asks us to keep)
Activity and security records	7 years
Breach records	7 years
Our host’s daily backups	14 days, then replaced
Our own encrypted backups	Up to 12 months, then deleted

A daily job deletes or anonymizes information when its time is up. Information you ask us to delete can stay in a backup until that backup is replaced or deleted, at most 12 months.

13. Emails we send

Account emails (welcome, email confirmation, “we received your listing”, booking updates) are part of the service. You get them while you have an account.
News emails go only to people who tick the “Send me Dock & Loon news” box when they create an account. The box is never ticked for you. We keep the exact words you agreed to and the time.
Every news email names Dock & Loon, gives our mailing address and a link to our contact page, and has an unsubscribe link that works for at least 60 days after the email is sent. You can also unsubscribe through the contact page. You can also stop news email from your account (the News email page). We act on an unsubscribe within 10 business days, and unsubscribing changes nothing else about your account.

14. Your choices and rights

You can ask us to:

give you a copy of the personal information we hold about you,
correct information that is wrong,
delete your information and close your account,
withdraw your consent to news emails or to an optional feature.

Owners can change most listing and account details themselves on their dashboard.

How to ask. Write to us through the contact page at dockandloon.ca and choose the topic “Privacy or my personal information”, or write to the Privacy Officer at 2026 Tenth Line Road, Ottawa, Ontario K4A 4X4. Before we act, we confirm the request through the email address on your account or, if you have no account, the email address you used with us.

When. We answer within 30 days. If we need more time, up to 30 more days, we will tell you within the first 30 days, explain why, and remind you that you can complain to the Office of the Privacy Commissioner of Canada about the delay. Getting a copy of your information is free.

Closing your account. When we erase your information, we delete your account. If you own a listing, it is taken off the site. Your listings are unpublished, not deleted. If records must stay for tax or permit reasons, your account is emptied (no name, email or sign-in) instead of deleted. If a stay is still to come, we close the account after check-out. News email stops right away.

What we may have to keep. Some records must stay for a set time even if you ask us to delete them: booking and tax records, permit records, identity-check results, activity and security records, and proof of your email consent. If you wrote a review, we remove your name and the link to your account; the words stay published as “Guest” unless you ask us to take the review down. We tell you what we kept and why.

If withdrawing consent means a feature cannot work (for example messages need an account), we will tell you.

15. Age

Dock & Loon is for adults. You must be 18 or older to create an account or book a stay. Renters confirm this when they create an account.

16. Quebec

Dock & Loon serves Ontario cottages today. Before we list cottages in Quebec or offer the site to Quebec residents, we will update this policy for Quebec’s privacy law and publish it in French.

17. Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use information you already gave us, we tell account holders before it takes effect.

18. Questions and complaints

Write to our Privacy Officer first, through the contact page at dockandloon.ca or by mail at 2026 Tenth Line Road, Ottawa, Ontario K4A 4X4.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.