Privacy Policy

1. Who We Are

The party responsible for your personal information:

2. Information We Collect

• Account data: email address (from Google), optional name, account role, timestamps. Sign-in with Google requests only basic profile information (email and name); sessions use NextAuth.js session cookies.
• Business listing data: business name, address, the city and province where the business is located, phone, website, email (shown publicly only after a successful bot-protection check), category, description, GPS coordinates, opening hours, photos, social links, services and amenities attributes, and, on Premium listings, owner-provided licensed & insured details and up to 3 special offers (each a short label with an external link). A booking link is stored when an owner adds one, or when one is available from public sources for an imported listing; booking links are only displayed publicly on Premium listings.
• Imported listing data: some listings are compiled from publicly available business information rather than data provided by the owner. This data comes from public Google Maps data collected with the Outscraper tool and may include business name, street address, city, province/state, postal code, country, phone number, website, email addresses, social media profile links, category, GPS coordinates, opening hours, public rating and review counts (including the per-star breakdown), photos and photo count, business attributes, price range, publicly available descriptions, Google place and owner identifiers, and the search query used to collect the data. Imported email addresses are used for operator outreach and are shown publicly only after a successful bot-protection check, the same as owner-provided addresses. Imported social links are kept for operator review and are shown on the public listing only after approval: a link whose handle matches the business name is approved automatically, and every other link is reviewed by the operator.
• Claim verification data: when you claim a listing, we record the claim, the Google account email you signed in with, and how it was verified (invitation email match or manual review by the operator). Google Business Profile OAuth tokens are not currently collected; if Google-assisted verification or sync becomes available, we will request those permissions only when you choose to connect an account, and store them only to verify ownership.
• Billing data: Stripe customer ID, subscription ID, subscription status (active / trialing / past due / canceled), and whether the subscription is set to cancel at the end of the current paid period. When you start a paid subscription, your name, email address, and billing address are shared with Stripe, and card details are entered directly with Stripe and never reach our servers.
• Admin records & activity: our admins keep internal notes and an activity history about listings and owners — for example imports, claim and listing decisions, subscription changes, and free-month grants. This information is visible only to admins and is never shown publicly.
• Free-month grant records: when an admin grants free Premium months, we record the number of months, the reason, the granting admin, and the grant and revoke timestamps.
• Directory ratings: registered users may leave one rating per business, displayed publicly with the reviewer’s display name and the date of the review. You can edit or delete your review from your dashboard at any time. The business owner may post one public reply to your review, and deleting your review also removes the owner’s reply.
• Favorites: signed-in users can save listings to a private favorites list. It is visible only to that user, and removing a favorite or deleting the account removes the stored entries.
• Contact form data: name, business or listing name (optional, required when reporting a problem with a business), phone number (optional), email, the topic you selected, and message contents.
• Marketing leads: if you opt in on the contact form, we store your email and name to send you occasional directory updates and offers.
• Photos: uploaded business images stored on Vercel Blob (up to 3 on Free, up to 10 on Premium).
• Video testimonials: if you submit a video testimonial from your dashboard, we collect the video (including your voice and image), a poster image, your written quote, your first name, and your business name. We use them to publish your testimonial as marketing on the Directory, with your explicit consent: accepted videos, quotes, first names, and business names are shown publicly on pages such as the for-business page and city pages. Videos are stored on Vercel Blob, and submissions made by external link are downloaded and processed by the operator. Testimonial videos, posters, and submissions are deleted when your account deletion completes, and you can ask us to remove a published testimonial at any time by emailing our Privacy Officer.
• Consent records: when you submit a listing or start a paid subscription, we log your agreement to the Terms (with date and version) and your marketing preference, plus the IP address of the request as proof of consent. This includes the acknowledgment you check at checkout before you are sent to Stripe: we record that acceptance in our database with the version of the Terms you accepted and the IP address of the request.
• Account deletion data: when you ask us to delete your account, we record the date you asked, what should happen to your listings, and when the deletion completes, so we can honor the 30-day change-of-mind window and keep an audit record.
• Error diagnostics: when something breaks, we record the error message and technical details — the page address, browser type, app version, the signed-in account if you were signed in, and a one-way hash of the IP address used only to prevent abuse — so we can diagnose and fix the problem. If you click “Report this problem”, the report is flagged for our team.
• Listing activity analytics: we record listing view and click events as business ID + event type + timestamp. For signed-out visitors these events stay anonymous — no user identifier and no IP address. When you are signed in, the event is also linked to your account so the operator can see how signed-in visitors use the directory; that link is removed when your account is deleted. IP addresses are never stored with these events.
• Aggregate site analytics: we use Vercel Web Analytics and Speed Insights to measure page views, referrers, coarse location and device type (derived from the request), and page performance timings. We also count anonymous interaction events — for example, that a promotion card was shown or clicked — labelled only with non-identifying details such as the placement and the copy variant. Visitors are identified by a request-derived hash that our analytics provider discards within 24 hours. These analytics use no cookies and no persistent identifiers, and any text you type into a search box is not sent to them.

Imported listings are compiled from publicly available sources and do not require access to the owner’s Google account. The Google Business Profile connection feature (prefill and sync) is built but not currently offered while we await Google API access. If it becomes available, we will only access Google Business Profile data after the owner explicitly connects their Google account and approves the sync, and we will update this policy first.

If that feature becomes active for premium listings, we would automatically refresh the imported opening hours, rating, and review count at least once a day while the listing remains on a premium plan and the owner keeps access connected, and owners could revoke access in their Google account. That automatic refresh is not active today.

3. How We Use It & Consent

We process personal information to:

• provide, maintain, and display the directory;
• authenticate logins (handled by Google);
• verify business listing ownership claims;
• publish video testimonials you submit, with your consent, as marketing for the Directory;
• manage subscriptions and billing;
• process account deletion requests and honor the 30-day recovery window;
• send transactional emails (approval/rejection, billing notices, subscription confirmations, renewal reminders, and a notice when a business owner replies to your review);
• respond to contact form inquiries;
• diagnose and fix technical errors and keep the service reliable;
• save and display your private favorites list;
• understand which pages and trades visitors use so we can improve the directory;
• to send occasional updates and offers, only if you asked for them.

By registering an account, submitting a listing, or contacting us, you consent to the collection and use of your personal information as described here.

4. Third-Party Service Providers

We share personal information only with the providers below, acting on our behalf:

• Stripe — payment processing and subscription billing (name, email, billing address, and card details handled by Stripe; we store the customer ID, subscription ID, and subscription status).
• Google — account authentication (sign-in with Google) and, when the Google Business Profile connection feature is active, OAuth verification of listing claims.
• Resend — transactional email delivery (recipient email, message content, including subscription confirmations, renewal reminders, review reply notifications, and error-report notifications sent to the operator).
• Vercel & Vercel Blob — application hosting, storage for listing photos and testimonial videos, and cookieless aggregate and event analytics (Vercel Web Analytics and Speed Insights).
• Cloudflare Turnstile — bot protection for public forms (contact, business submission, claims, and reviews) and the email reveal. Turnstile checks run without cookies and return only a pass/fail result; we never store the challenge data.
• Neon — cloud PostgreSQL database hosting.

Publicly available business listing data described in Section 2 is collected with Outscraper, a third-party data-collection tool acting as a public-data source.

5. Cookies

We use NextAuth.js session cookies, which are strictly necessary to keep registered users logged in. We do not use advertising, remarketing, or cross-site tracking cookies. Our analytics (Vercel Web Analytics and Speed Insights) are cookieless and use no persistent identifiers, so a cookie consent banner is not required. We would add one before introducing any cookie-based third-party service.

6. Security & Retention

• Security: HTTPS/TLS in transit, authentication handled by Google (we never see or store your Google password), least-privilege access for cloud providers.
• Retention: account data is kept while your account is active. You can delete your account yourself from the dashboard Account page. Deletion takes effect after a 30-day recovery window; until then you can cancel by signing in and choosing “Cancel deletion”. A Premium plan ends immediately when you request deletion. Monthly plans are not refunded for the unused part; yearly plans receive a prorated refund for the unused days, issued within 15 days. When deletion completes, your favorites and your testimonial videos, posters, and submissions are deleted, your account is anonymized, and your ratings stay on other businesses but are detached from your account and display as “Deleted account”. If you chose to delete your listings, they are removed from the directory and their photos are deleted; if you chose to keep them public, they stay visible as unclaimed businesses. Billing and tax records are kept as long as the law requires; consent records are unlinked from your account and kept anonymized for up to 3 years. Encrypted backup copies are rotated on the daily backup schedule and are never used to restore a deleted account.
• Admin records & import batches: internal notes, activity history, free-month grant records, and import batch records (uploaded file name plus parsed business records) are kept as operational and audit history in the database, which is covered by our encrypted backups.
• Consent records: after your account is deleted, anonymized consent records (your agreement to the Terms, with date and, where available, IP address, no longer linked to your account) are retained for up to 3 years as proof of consent, then deleted.
• Marketing lead records are kept until you unsubscribe or ask us to delete them.
• Error diagnostics are deleted automatically after 90 days and are visible only to the operator.
• Analytics: aggregate reports are retained by our analytics provider under its standard retention; the visitor hash used for counting expires within 24 hours. Listing activity linked to an account is kept while the account exists and is detached when the account is deleted.

7. Your Rights

Under Canadian privacy law (PIPEDA / BC PIPA), you may:

• Access: request a copy of the personal information we hold about you.
• Correct: request correction of inaccurate or incomplete information.
• Delete: delete your account from the dashboard Account page (with a 30-day change-of-mind window), or contact us if you cannot sign in.
• Withdraw consent: at any time, subject to legal or contractual limits.

To exercise any right, contact our Privacy Officer at hello@tradesregistry.ca.

8. Children’s Privacy

This website is not directed to individuals under 18. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy periodically. Updates are posted on this page with a revised “Last updated” date.

10. Contact the Privacy Officer

For privacy requests or questions about our data practices: