Privacy policy
Last updated November 2, 2026
This policy explains what personal information XLB Co. Travel ("we", "us") collects through this website and our booking system, why we collect it, who we share it with and the choices you have. It applies to our clients, the travellers on their bookings, and our staff.
1. Information we collect
When you sign in with Google
We use Google Sign-In so nobody needs a separate password. With your permission, Google shares your name, email address, profile photo and a Google account ID with us. We ask only for the basic openid, email and profile permissions. We cannot see your Google password, Gmail messages, contacts, files or calendar.
When you book or ask about travel
- Contact details: name, email, phone number and city.
- Traveller details for everyone on a booking: full name, date of birth, passport number, passport country and expiry date, and loyalty program numbers.
- Trip details and preferences, such as destinations, dates, seating, meals and accessibility needs, and notes from your conversations with your agent.
- Booking and payment records: what was booked, prices, invoices, payments and refunds, and the reference numbers from our suppliers and our payment provider.
We do not collect or store card numbers. Payments are made through invoices from our payment provider, Venn.
Automatically
Our servers record technical information such as IP address, browser type and the pages requested, to keep the service secure and fix problems. We use one cookie to keep you signed in. We do not use advertising or tracking cookies.
2. How we use information
- To sign you in and give you the right access (client, agent, finance or admin).
- To quote, book, change and cancel travel with airlines, hotels and other suppliers.
- To send invoices, receipts, reminders and travel documents.
- To contact you about your requests and bookings.
- To pay our agents their commissions and keep accurate financial records.
- To protect the service, prevent fraud and meet legal and tax obligations.
We do not sell personal information and we do not use it for advertising.
3. Google user data
We use information received from Google only to sign you in and to show your name and photo inside our system. We do not share it with anyone else, use it for advertising, or use it to train AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
4. Who we share information with
- Travel suppliers such as RateHawk, Expedia, airlines, hotels and tour operators: the traveller details they need to make and manage your booking.
- Venn, our payment provider: the details needed to issue invoices, take payments and make refunds.
- Brevo, our email provider: your name and email address, to send booking emails and reminders.
- Hostinger, our hosting provider: stores the website and database.
- Authorities, when the law requires it, for example border, customs or tax authorities.
Some of these companies, and the suppliers at your destination, process information outside Canada. When that happens, your information is subject to the laws of that country.
5. How we protect information
- Passport numbers are encrypted in our database and hidden on screen until an authorized person chooses to show them.
- Staff only see what their role needs. Agents see their own clients; only the assigned agent and admins can view passport numbers.
- All access to the site uses an encrypted (HTTPS) connection.
6. How long we keep information
We keep booking and payment records for as long as Canadian tax and accounting law requires, usually six years after the end of the tax year they relate to. We keep other client and traveller details while you remain a client and delete or anonymize them when they are no longer needed. You can ask us to delete your information sooner (see below).
7. Your choices and rights
You can ask us to:
- show you the personal information we hold about you;
- correct information that is wrong or out of date;
- delete your information or close your account, unless we must keep it by law;
- stop sending you optional emails.
Email xlbandco@gmail.com and we'll reply within 30 days. You can also remove our access to your Google account at any time from your Google Account settings.
8. Children
This site is for adults. A parent or guardian may give us the details of children travelling on their booking, and we use those details only for that booking.
9. Changes to this policy
If we change this policy we'll update the date at the top of this page. If the change is significant, we'll tell clients and staff by email.
10. Contact
XLB Co. Travel
Email: xlbandco@gmail.com
If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.