Privacy Policy

La Maison du Mile-End ("the Property," "we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile app (including the guest portal, the lobby kiosk and the staff app), make a reservation or stay at our establishment. By using our services, you consent to the collection and use of your information as described in this policy.

We collect information that you provide directly to us, including: • Identification and contact details (name, email address, phone number, mailing address) • Payment information (card details are entered directly into our payment processor, Stripe; we keep only a reference to the card and basic details such as its brand and last four digits) • Booking details (dates of stay, room preferences, special requests, add-ons and breakfast choices) • Identity verification at check-in: a photo of your government-issued ID and a selfie, captured and checked by Stripe Identity • Communications you send to us, including emails, chat messages, guest requests and reviews • Phone, in-app and kiosk calls with our front desk or our AI assistant, which may be recorded and transcribed • Photos taken in our apps, such as room condition photos, breakfast product photos and 3D scans of our rooms We also collect certain information automatically: on our website, your IP address, browser type and pages visited; in our app, the diagnostic information described under "Mobile Applications" below, which you can switch off.

We use the information we collect to: • Process and manage your reservations, check-in and check-out • Verify your identity at check-in, as required by law and to protect our guests and property • Communicate with you about your booking and stay, including through our AI assistant • Process payments and security deposits • Provide customer service and respond to inquiries • Keep our apps and lobby kiosk working: diagnose crashes and errors, and see which kiosk screens are used • Send you promotional communications (with your consent) • Comply with legal obligations • Improve our services and guest experience We do not use your information for third-party advertising, we do not sell it, and we do not track you across apps or websites owned by other companies.

The Maison Mile-End app for iPhone and iPad serves three groups of people: guests (the guest portal), guests at our lobby kiosk (an iPad at reception), and our staff. This section explains what the app handles for each and the choices you have. It matches the privacy details on our App Store page. Guests: • Signing in: your email address (we email you a one-time code) or Sign in with Apple, where you may share your name and email or use Apple's private relay address. • Your stay: reservation details, check-in forms and agreements, add-ons and breakfast choices, messages and requests to the front desk, and reviews. • Payments: card details are typed into Stripe's secure form and go directly to Stripe. • Identity check at check-in: a photo of your ID and a selfie, taken with your camera and checked by Stripe Identity. • Calls with the front desk or the AI assistant use your microphone (see "Calls and the AI assistant" below). Lobby kiosk: • The kiosk is a shared device owned by the Property. To find your booking it asks for your last name and your arrival date or booking reference, and sends a one-time code to the email address on file or through your booking platform's messages. It can capture your ID and selfie through Stripe Identity, take a card payment through Stripe, book a room, and place a call to the front desk or the AI assistant. It returns to its welcome screen when you finish or step away. • The kiosk reports its own condition to us (battery, app version, the screen it is on, network) and records which screens are used, so our staff can keep it working. Staff: • Your staff profile (name, role, email), your sign-in and two-step verification, and the operational data you work with — reservations, guest records, housekeeping, messages, payments, rates, reviews and breakfast inventory. • Photos you take of rooms and breakfast products, and 3D scans of our rooms (camera and LiDAR). • Speech you dictate to guide the AI during a call is converted to text on your device; only the text is sent. Calls and the AI assistant: • Calls between guests, the kiosk and the front desk, and calls answered by our AI assistant, are carried by LiveKit. Calls are audio-only. Calls may be recorded; recordings are kept in our private storage and only authorized staff can access them. • When you chat with our concierge, or call and the AI assistant answers, what you type or say — together with the booking details needed to answer you — is sent to an AI model provider to produce the reply: xAI (Grok) by default, with Anthropic (Claude) and OpenAI (GPT) used as alternates. Staff also use these providers to draft replies and summarize conversations. The app asks for your agreement before you first use the AI assistant, AI replies are identified as such, and you can ask for a person at any time. • The AI providers process this data on our behalf to produce the reply, under their commercial terms for business customers. How long we keep chat conversations, call recordings and transcripts is described under "Data Retention" below. Automatic diagnostics: • If the app crashes or hits an error, it sends a report to our own servers: what went wrong and where, the screens and actions just before it, the app version, device model, iOS version, network type and language. Reports never contain passwords, payment card data, door codes, message contents, email addresses, phone numbers, names or screenshots. They are linked to your account so we can help you, and are deleted after 90 days. • You can turn this off at any time with "Share diagnostics": on the guest Account screen, in the staff More menu, or at the bottom of the app's home page when you are not signed in. Crash information then stays on your device. • A bug report you choose to send (by shaking the device or from the menu) includes a screenshot or screen recording that you review first, and device details such as free storage. Closed bug reports are deleted 180 days after they are resolved. Permissions: • Camera: room and product photos, 3D room scans, and your ID and selfie at check-in. Microphone: calls. Speech recognition (staff): dictation to the AI during a call, on the device. Bluetooth (staff): a laser measure for room dimensions. Local network: call audio. Each is requested only when first needed and can be changed in iOS Settings. What the app does not do: • No advertising, no tracking, no advertising identifier, no third-party analytics or advertising software, and no access to your location or contacts. Deleting your account: • You can delete your account inside the app: guests from the Account screen (or from the screen shown when no reservation is linked yet), staff from the More menu. Deletion removes your login and profile and erases your name, email, phone number, notes and preferences from our guest records. Records we must keep for legal, tax or accounting reasons, such as invoices and payment records, are kept for the period the law requires. • If you signed in with Apple, deleting your account also revokes the app's access to your Apple ID with Apple. • You can also ask us to delete your account or your data at any time (see "Contact Us" below).

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Payment information is processed through secure, encrypted channels and we do not store complete credit card numbers on our systems. While we strive to protect your information, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

We do not sell, trade, or rent your personal information to third parties. We share information only with the service providers that help us operate, each acting on our behalf and only for the purpose described: • Supabase — database, sign-in, file storage (including call recordings and photos) and hosting of our app's back end • Vercel — hosting of our website and the servers our app talks to • Stripe — card payments and deposits; Stripe Identity for the ID and selfie check at check-in (Stripe keeps the ID images and selfie; we receive the result, such as the document type, issuing country, expiry and whether the selfie matched) • LiveKit — carrying and recording voice calls • xAI, Anthropic and OpenAI — AI models that power our concierge chat, the AI assistant on calls, and staff writing tools (see "Mobile Applications") • Resend — sending our emails, including one-time sign-in and check-in codes • hCaptcha (Intuition Machines) or Cloudflare Turnstile — checking that sign-ins, bookings and chats come from a person, not a bot • Apple — Sign in with Apple and push notifications • Our channel manager and booking platforms (such as Beds24, Airbnb and Booking.com) when your reservation comes through them We may also share information with legal authorities when required by law or to protect our rights, and with professional advisors (lawyers, accountants) as necessary. All service providers are required to keep your information confidential and secure.

Our website may use cookies and similar tracking technologies to enhance your browsing experience. Cookies are small files stored on your device that help us understand how you use our website. You can control cookie settings through your browser preferences. Disabling cookies may affect the functionality of our website.

Under applicable privacy laws, you have the right to: • Access the personal information we hold about you • Request correction of inaccurate information • Request deletion of your information (subject to legal requirements) — or delete your account yourself in our app • Withdraw consent for marketing communications • Turn off automatic diagnostics in our app • Lodge a complaint with the appropriate data protection authority, such as the Commission d'accès à l'information du Québec To exercise these rights, please contact us using the information provided below.

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. • Booking records are typically retained for a minimum of seven years for tax and legal purposes. • Chat conversations, call recordings and call transcripts are kept as part of our guest-service records for as long as they are needed to serve you and to handle any question or dispute about your stay; you can ask us to delete them. • Automatic error reports from our app are deleted after 90 days. • Bug reports you send are deleted 180 days after they are closed. • Push-notification registrations for a device that has not been used for 90 days are deleted. • The ID images and selfie from the identity check are held by Stripe under its own retention schedule; we keep only the verification result. • When you delete your account, your login and profile are deleted immediately and your contact details are erased from our guest records.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The updated policy will be posted on our website with a revised "Last updated" date. We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have any questions about this Privacy Policy or our privacy practices, please contact us: La Maison du Mile-End 204 Rue Bernard Montréal, Québec H2T 2K4 Canada Email: info@maisonmileend.ca Phone: 438-607-5504