Privacy Policy

ShobShob Technologies Inc. (“ShobShob”, “we”, “us”) operates the ShobShob marketplace and is the organization responsible for the personal information described here. Our practices are designed to support our responsibilities under Canada’s PIPEDA and Alberta’s PIPA. We obtain consent where required and limit collection to information needed to run the marketplace.

What we collect

• Account: email and phone (phone is for order contact, not login).
• Sellers: business details, kitchen photos, and an exact address used privately for distance — only an approximate area is shown publicly.
• Sellers: a regulatory-responsibility attestation. Licence or permit numbers, documents, issuing-authority details, expiry dates, and related correspondence are collected only when a seller submits them voluntarily or ShobShob requests proof for a compliance review.
• Sellers: tax-reporting identity (legal name, date of birth, SIN or Business Number, tax residence) that Canadian law requires digital platforms to collect and report to the CRA. It is never shown publicly, is stored with restricted access, and is used only for tax reporting.
• On an unfinished seller application, selected non-sensitive draft details may be stored only in your browser on that device for up to seven days. The draft excludes your exact address, tax/legal identity, GST number, licence or permit numbers, and credential uploads; you can discard it from the onboarding page.
• Orders, payments (via Stripe — your card details go directly to Stripe and never touch our servers), reviews, and support messages.
• Messages, favourites, and custom-order requests. Photos attached to custom requests are private to the customer, the selected seller, and authorized administrators.
• Store follows you explicitly choose, including the consent version, consent time, and any later withdrawal. Saving a favourite, viewing a store, or ordering does not automatically follow that seller.
• Storefront analytics are aggregate daily page-load counts only. For this metric we do not store a viewer identity, IP address, device fingerprint, referrer, or precise location. Sellers see only aggregate follower counts and repeat-customer trends; repeat data is withheld until the privacy threshold is met.
• For delivery orders, the verified delivery address you provide. It is not visible to the seller until they accept the order.
• Your approximate location for discovery, if you choose to share it — stored in a signed, httpOnly browser cookie and used to show rounded approximate kilometres, sort nearby kitchens, and estimate delivery eligibility.
• Technical and security data: IP address and short-lived sign-in/security counters used to prevent abuse (kept for minutes, not archived), and error diagnostics configured to exclude personal identifiers.

Seller credentials & compliance reviews

We use voluntarily submitted or requested credential information to review the identified evidence, administer a credential-specific badge, conduct random, periodic, risk-based, complaint-triggered, or regulator-requested compliance reviews, investigate safety or fraud concerns, and meet legal obligations. Access to raw documents and numbers is restricted to the seller and authorized ShobShob personnel. We do not display raw documents or credential numbers publicly. Where lawful and reasonably necessary, we may compare evidence with an issuing authority or public registry, or provide it to a regulator or law-enforcement authority when required by law.

Raw credential evidence is retained only as long as reasonably needed for the review, badge administration, complaints, disputes, investigations, or legal obligations. A completed sale alone does not turn optional credential evidence into a six-year tax record. On account deletion, raw credential files and numbers are deleted unless an active bounded credential-scrutiny hold or documented legal hold temporarily requires retention. When raw evidence is no longer needed, it is scheduled for deletion. We may retain a restricted minimal audit record — such as credential type, review outcome, review and expiry dates, and resulting account action — where reasonably necessary to document the review and protect users.

Service providers & where data is processed

We use a small set of service providers to run ShobShob: Supabase (database and sign-in), Vercel (hosting), Stripe (payments), Resend (transactional email), Cloudflare (bot protection on sign-in forms), Upstash (short-lived security counters), Sentry (error monitoring, configured not to receive personal identifiers), and OpenStreetMap's Nominatim service (converting typed addresses into map coordinates). Some of these providers store or process information outside Canada, primarily in the United States; while there, it is subject to the laws of those jurisdictions. We use contractual and technical safeguards with all providers and share only what each one needs.

Consent & your rights

You consent to this processing when you create an account. You can use the account-page export for the records that are safe to release automatically, and delete your account, from your account page at any time. You may contact us for a reviewed access request covering other personal information we hold about you. Access remains subject to applicable legal exceptions, including protection of third-party personal information, privileged material, and confidential investigative or internal case information. Deletion removes private uploads and contact, profile, delivery destination, message, and preference data, then anonymizes the account. For a seller deletion, we may retain a minimal non-login account tombstone and the Seller Agreement acceptance needed to preserve the contract and audit record or respond to claims, for an applicable documented retention period. The tombstone cannot be used to sign in. Limited financial, GST, and seller tax records may be retained with restricted access for six years after the end of the related tax year. Credential evidence and audit records follow the purpose-based periods described above. A bounded credential-scrutiny hold temporarily preserves only the seller evidence under review; it does not retain unrelated private uploads. A separate documented legal hold may apply more broadly and extend an applicable period. When an applicable period expires, time-limited credential evidence and retained content are scheduled for deletion or irreversible de-identification. The minimum non-login contract/audit tombstone may remain where reasonably necessary to preserve that binding record or meet another legal duty.

Communications

Operational messages — order updates, payment notices, password resets, safety, and account notices — are part of the service. We send marketing or promotional messages only with your consent; those messages identify ShobShob and include an unsubscribe option, and you can withdraw consent at any time.

Following a seller is a separate, explicit choice for in-app store updates. You can unfollow immediately at any time. Seller updates in this release are in-app only; a follow does not enrol you in email or text marketing, and sellers never receive follower identities or contact details.

Location privacy

A seller’s exact coordinates and street address are stored privately and never sent to an unprivileged browser before an order is accepted. Discovery shows an approximate area and rounded approximate kilometres. The exact pickup address is revealed to the customer only after acceptance; for delivery, the customer’s exact destination is revealed to the seller only after acceptance.

Security

Data is encrypted in transit and at rest, database access is restricted row by row, and sign-in is protected by attempt limits and temporary account lockouts after repeated failures. We review this policy as the service evolves; changes are posted on this page with an updated "Last updated" date.

Privacy incidents

If a privacy breach occurs that poses a real risk of significant harm, we will notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay, and affected individuals where required by law.

Contact

For privacy questions or to exercise your rights, contact ShobShob Technologies Inc. at privacy@shobshob.com or by mail at 150 Evergreen Mount SW, Calgary, AB T2Y 0L8.