Privacy Policy (Canada)

We collect information that you provide directly (for example when you contact support or create an account) and data generated through your use of our services (such as device, approximate location, and interaction logs). We minimize and de-identify where reasonable and retain only what is needed.

• Provide, maintain, and improve our services
• Authenticate users and secure our platform
• Respond to inquiries and provide support
• Comply with legal obligations and prevent fraud
• With your consent, personalize content and measure performance

We use cookies and similar technologies for core functionality (strictly necessary), preferences, analytics, and limited marketing. Non-essential cookies are off by default in Canada. You can change your preferences anytime via “Manage cookies”.

We process personal information under PIPEDA’s principles of accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.

• Access and portability: request a copy of your personal information
• Correction: request corrections to inaccurate information
• Withdrawal of consent and opt-outs where applicable
• Complaint: contact us or your provincial/territorial privacy regulator

We retain personal information only as long as necessary to fulfill the identified purposes or as required by law. When information is no longer required, we securely delete or anonymize it.

We share information with service providers under strict contractual controls for hosting, error monitoring, analytics (consent-based), email delivery, and payments. We may disclose information to comply with law or protect rights, safety, and property.

Personal information may be transferred, stored, or processed outside of your province or Canada. We use safeguards such as contractual protections and technical measures. By using our services, you understand that your data may be processed in foreign jurisdictions where local authorities may access it under lawful requests.

• Encryption in transit by default
• Access controls and least privilege
• Backups and disaster recovery
• Vendor risk assessments
• Incident response with notification where required

Our services are not directed to children under the age of 13. If you believe a child provided us with personal information, please contact us and we will take appropriate steps to delete such information where required.

We may update this policy to reflect changes in our practices or legal requirements. We will post updates here and revise the “Last updated” date. For material changes, we may provide additional notice.