Data Security & Privacy Protocol

This protocol describes the technical and organizational safeguards that 9355-8294 Québec Inc. applies to all data processed across its consumer brands, including UCWonder. It covers our booking platform, AI trip concierge, UC Passport, partner marketplace, and all supporting infrastructure. It complements our Privacy Policy and Terms of Service.

• In transit — all traffic between your browser and our servers is encrypted with TLS 1.2+ (HTTPS). Plain-HTTP access is not served.
• At rest — customer data is stored in MongoDB Atlas, which encrypts all data at rest using AES-256 with cloud-provider managed keys.
• Backups — database backups are encrypted with the same standard and retained on Atlas managed infrastructure.

• Google Sign-In (OAuth 2.0) — UC Passport sign-in is delegated to Google. We never see or store your Google password.
• Password accounts — passwords are hashed with the bcrypt algorithm and per-user salts; plaintext passwords are never stored or logged.
• Session tokens — authenticated sessions use signed JSON Web Tokens (JWT) with expiry. Role-based access separates guests, hosts, partners, and administrators.
• Least privilege — administrative interfaces live on non-guessable paths and require dedicated administrator credentials.

• All card payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor.
• Card numbers, CVCs, and full payment credentials never touch our servers — they are transmitted directly from your browser to Stripe.
• We retain only the minimum payment metadata (booking reference, amount, payment status) needed to service your reservation.

• We collect only the data needed to deliver the service: account details, booking details, trip preferences you share with the concierge, and confirmation numbers you choose to store in your UC Passport.
• AI planner conversations are used solely to build your itinerary and are not sold or shared with advertisers.
• Beta-access and partner-application submissions are retained only for recruitment and onboarding purposes.
• Data no longer required for legal, accounting, or dispute-resolution purposes is deleted or anonymized.

We share the minimum necessary data with vetted processors, each bound by their own security and compliance programs:

• Stripe — payment processing (PCI-DSS Level 1).
• MongoDB Atlas — encrypted database hosting (SOC 2 Type II, ISO 27001).
• Google — OAuth sign-in (ISO 27001).
• Resend — transactional email delivery.
• Anthropic — AI concierge language model; conversations are processed to generate itineraries, not for advertising.
• Travel & gift-card partners (travel booking partner networks, gift-card providers) — receive only the click-through context required to complete an affiliate referral. We do not transmit your account data to them.

In line with Québec Law 25, PIPEDA, and comparable international frameworks (including GDPR principles for visitors from the EU/EEA), you may:

• Request a copy of the personal information we hold about you.
• Ask us to correct inaccurate information.
• Request deletion of your account and associated personal data.
• Withdraw consent for non-essential communications at any time.

To exercise any of these rights, contact our privacy officer at support@ucwonder.ai. We respond within 30 days.

• Security events are logged and monitored across our infrastructure.
• In the event of a confidentiality incident involving personal information, we assess the risk of serious injury and notify the Commission d'accès à l'information du Québec and affected individuals as required by Law 25.
• We maintain a confidentiality-incident register as required by Québec law.

This protocol is reviewed at least annually and whenever we introduce a new processor or materially change how data flows through the platform. Material changes will be reflected on this page with an updated version number and effective date.