Privacy Policy
This policy explains what personal information [legal business name] ("we", "us") collects when you use Retail Arbitrage Canada, why, who we share it with, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
1. What we collect
| Information | Examples | Why we need it |
|---|---|---|
| Account details | Email address, name or business name, province, password (stored only as a one-way hash) | To create your account, sign you in and contact you about the Service |
| Your settings and records | Brand lists, pick rules, fees, watchlist, saved searches, dashboard layout, notes, resale prices and purchase records you enter, postal code (if you add one, used for local flyer prices) | To provide the features you use |
| Billing details | Subscription status and a Stripe customer ID. Card details go directly to Stripe; we never receive your full card number | To take payment and manage your subscription |
| Technical and security data | IP address, date and time of sign-ins and failed sign-in attempts, basic server logs | To keep accounts secure, prevent abuse and fix problems |
| Messages you send us | Support emails | To answer you |
We do not ask for, and you should not enter, sensitive information such as government ID numbers, bank account numbers, or marketplace passwords or API keys.
2. Cookies
We use one essential cookie that keeps you signed in. Your browser also stores some display preferences locally (for example recent searches). We do not use advertising cookies or sell data to advertisers. The public blog and sign-in pages do not set tracking cookies.
3. How we use your information
- To provide, maintain and secure the Service
- To process payments and manage trials and subscriptions
- To send service messages (billing, security, changes to terms)
- To send marketing emails, only if you have agreed, with an unsubscribe link in each one
- To understand in aggregate how the Service is used so we can improve it
- To meet legal obligations and enforce our Terms
We do not sell your personal information. We do not use your records to make purchases or sales on your behalf.
4. Who we share it with
- Service providers that help us run the Service, under contracts that limit what they can do with the data: our hosting provider (stores the database), Stripe (payments), and an email delivery provider if we send email.
- Authorities, when the law requires it or to protect rights, safety or property.
- A buyer or successor, if the business is sold or reorganized; the information stays subject to this policy.
Other customers cannot see your settings, notes, prices, buy list or purchase records.
5. Where it is stored
Our service providers may store or process information outside your province or outside Canada (for example in the United States). Information held in another country is subject to that country's laws, including lawful access by its authorities.
6. How long we keep it
- Account data and your records: for as long as your account exists.
- When you delete your account: your profile, settings, notes, buy list, purchase records and briefs are deleted from the live database right away, and from backups within 30 days.
- Billing and tax records: for as long as tax and accounting law requires (generally up to seven years).
- Security logs: up to 12 months.
7. Security
We protect your information with measures appropriate to its sensitivity, including encrypted connections (HTTPS), hashed passwords, limits on repeated sign-in attempts, separation of each customer's data, and restricted administrative access. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.
8. Your choices and rights
- See and correct your information in Settings, or ask us for a copy.
- Export your settings from Settings → "Download settings file".
- Delete your account and data from Settings → Account → Delete account.
- Withdraw consent to marketing email at any time by unsubscribing.
- Complain: contact us first so we can try to fix it. You also have the right to complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.
We respond to access and correction requests within 30 days.
10. Children
The Service is for adults running a business. It is not intended for anyone under 18 and we do not knowingly collect information from them.
11. Changes to this policy
If we make a material change we will tell you by email or in the Service before it takes effect. The date at the top shows when this policy was last updated.
12. Contact our privacy officer
[legal business name]
[business mailing address]
[support email]