Privacy Policy

This Privacy Notice for Obbema Labs (doing business as WelcomeMAT) ("we", "us", or "our"), describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services (the "Services"), including when you:

• Visit our website at https://getwelcomemat.ca, or any website of ours that links to this Privacy Notice;
• Use WelcomeMAT — a compliance platform for Ontario short-term rental hosts. WelcomeMAT tracks Municipal Accommodation Tax (MAT) obligations, surfaces municipal short-term rental bylaws and licensing deadlines, ingests booking data via iCal or Google Calendar, tracks expenses for CRA reporting, and generates MAT remittance reports. We aggregate publicly-available bylaw and MAT rate data from Ontario municipalities;
• Engage with us in other ways, including marketing, support requests, or events.

Questions or concerns? If you do not agree with our practices, please do not use the Services. Otherwise, contact us at [email protected].

Summary of Key Points

What personal information do we process? Account details (email, name), properties you add, bookings you enter or sync, expenses you log, and basic usage data.

Do we process sensitive personal information? No.

Do we collect information from third parties? Only data you authorize us to sync — such as bookings from your iCal feeds or Google Calendar.

How do we process your information? To provide, improve, and administer the Services; to send remittance reminders, bylaw alerts, and account notices; for security and fraud prevention; and to comply with law.

Do we sell your data? No. We do not sell personal information to anyone.

What are your rights? Under Canadian privacy law (PIPEDA) and Ontario law, you can access, correct, or delete your personal information. Email [email protected].

1. What Information Do We Collect?

Information you provide

• Account: email, name, password (hashed), contact preferences;
• Property details: addresses, license/registration numbers, photos, municipality;
• Booking records: guest stay dates, nightly rates, channel (Airbnb, VRBO, direct), guest counts. We do not require guest names or contact info to operate the Services;
• Expense records and supporting documents you upload for CRA reporting;
• Payment data is processed by Paddle, our merchant of record. We never see or store your card number. See Paddle's privacy notice.

Information collected automatically

IP address, browser and device characteristics, OS, language, referring URLs, and usage events — collected for security, debugging, and basic analytics. See our Cookie Notice for details.

Information from third parties (with your consent)

• Bookings from iCal feeds you connect (Airbnb, VRBO, Booking.com, etc.);
• Calendar events from Google Calendar when you authorize the integration;
• Email signin via Google OAuth, if you choose that option.

2. How Do We Process Your Information?

• Create and manage your account;
• Track MAT obligations, generate remittance reports, and send filing reminders;
• Alert you to changes in municipal short-term rental bylaws affecting your properties;
• Sync and reconcile bookings from connected channels;
• Process subscription payments through Paddle (our merchant of record);
• Respond to support requests;
• Detect, prevent, and address fraud and security incidents;
• Comply with legal obligations.

3. Legal Bases (PIPEDA)

We rely on your consent (account creation, optional integrations, marketing), performance of a contract (delivering the Services you subscribed to), legitimate interests (security, product improvement), and legal obligations (tax records, lawful requests).

4. When and With Whom Do We Share Information?

We share only with service providers that help us run the Services:

• Cloud hosting and database providers;
• Paddle (payments and merchant of record — handles billing, tax, and refunds);
• Email delivery providers (for reminders and transactional email);
• Google (only if you connect Google Calendar);
• Geocoding and mapping providers (to resolve property addresses to municipalities);
• AI providers for narrow product features (e.g., classifying bylaw updates). We do not send guest names or payment info to AI providers.

We may also disclose information to comply with law, enforce our terms, or in connection with a corporate transaction (merger, acquisition, asset sale).

We do not sell your personal information.

5. Cookies and Tracking

We use a small number of essential cookies for authentication and minimal first-party analytics. See our Cookie Notice.

6. AI-Based Features

WelcomeMAT uses AI to summarize municipal bylaw documents and classify regulatory updates. AI is never used to make automated decisions that legally affect you. You remain responsible for confirming compliance with your municipality.

7. How Long Do We Keep Your Information?

For as long as your account is active, plus a reasonable period to comply with tax, accounting, and legal obligations (typically seven years for CRA-related records). You can request deletion at any time, subject to those obligations.

8. How Do We Keep Your Information Safe?

We use encryption in transit (TLS), encryption at rest, scoped database access controls (Row Level Security), and standard operational safeguards. No system is 100% secure; we cannot guarantee that unauthorized parties will never defeat our safeguards.

9. Information From Minors

The Services are for users 18 and older. We do not knowingly collect data from minors.

10. Your Privacy Rights

Under PIPEDA and Ontario law, you have the right to access, correct, and request deletion of your personal information, and to withdraw consent. Email [email protected]. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada.

11. Do-Not-Track Signals

We do not currently respond to browser DNT signals because no consistent industry standard exists. We will update this policy if that changes.

12. Updates to This Notice

We may update this Notice from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated by email or in-app notice.

13. Contact Us

Obbema Labs (operating as WelcomeMAT)
271 Oak Bluffs Rd
Maberly, Ontario K0H 2B0, Canada
Email: [email protected]

14. Review, Update, or Delete Your Data

You can review and update most account data from your dashboard. To request a copy or deletion of your data, email [email protected].