Legal

Privacy policy

Last updated November 8, 2026

Sam's Fares runs Sam’s Fares. This policy explains what personal information we collect, why, and how you control it. It's written to meet Canada's PIPEDA, Québec's Act respecting the protection of personal information in the private sector (Law 25), and Canada's anti-spam law (CASL).

Person responsible

Our privacy officer is [privacy officer name], reachable at [contact email]. Contact them for any question, request or complaint about your information.

What we collect

When you sign up: your email address, home airport and deal preferences (destinations, trip type, stops, email frequency).
Proof of consent: the date and time you signed up, the IP address used, and the exact consent wording you agreed to. CASL requires us to keep this record.
If you buy Premium: your name and billing details are collected by Stripe. We receive a customer reference and payment status, never your full card number.
Email activity: our email provider may record deliveries, opens and clicks so we can fix delivery problems and measure which deals are useful.
If you comment on our Instagram posts asking for the link: we automatically reply with a private message containing our signup link. To avoid replying twice, we keep the comment’s ID, your Instagram account ID (not your name or messages) and the city you asked about.

We don't collect your travel bookings. When you click a deal you leave our site, and the booking site's own privacy policy applies.

Why we use it

To send the emails you agreed to: flight deals from your airport matching your preferences, travel tips and offers, news about Sam’s Fares’ products and services, and clearly labelled sponsored messages from our partners.
To run Premium: billing, renewal reminders, refunds and support.
To keep proof of your consent and honour unsubscribes.
To improve which deals we send, using aggregate (not individual) statistics.

Who processes it for us

We use a small number of service providers, bound by contract to use your information only to provide their service to us:

Email delivery: Resend (United States).
Payments: Stripe (United States and Canada).
Hosting: our server provider, which stores our database.
Social media: Meta Platforms (Instagram and Facebook), which delivers comments on our posts to us and sends our automatic replies.

Some of these providers store information outside Québec and Canada, including in the United States, where it may be accessible to authorities under local law. Before transferring information outside Québec we assess the protection it will receive.

How long we keep it

Subscriber information: while you're subscribed. After you unsubscribe we keep only your email and consent record, so we can prove consent and avoid emailing you again, for 3 years.
Billing records: as long as tax law requires (generally 6 years in Canada).
Instagram comment replies (comment ID, Instagram account ID, city): 12 months.

Your rights

You can ask to see the personal information we hold about you, correct it, get a copy in a commonly used format, or have it deleted (except what we must keep by law). You can withdraw consent any time by unsubscribing,. Email [contact email]; we answer within 30 days. If you're not satisfied, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Cookies

This site doesn't use advertising or tracking cookies. When you arrive from one of our links (for example from Instagram), we count the visit as a daily total per link; nothing that identifies you is stored or sent. If we add analytics, we'll update this policy and ask for consent where required.

Security and incidents

Access to our database is limited and protected. If a confidentiality incident creates a risk of serious injury, we'll notify you and the relevant privacy regulators as the law requires.

Changes

We'll post updates here with a new date and email you about significant changes.