Data rights and portability

1Which rules apply to you

If you are in Quebec, Law 25 applies. Elsewhere in Canada, PIPEDA applies. If you are in the EEA or the UK, the GDPR applies. The rights below are stated at the highest level any of them requires, so you do not have to work out which one you fall under. Effective 9 August 2026.

2Your rights

Access

A copy of the personal information we hold about you, and the categories of person it has been communicated to.

Rectification

Correction of information that is inaccurate, incomplete or equivocal.

Portability

A copy in a structured, commonly used technological format, and where technically feasible, transmission to another organisation you name.

Withdrawal of consent

For anything we do on the basis of your consent, including analytics.

Deletion

Removal of your personal information where the law provides for it and no retention obligation applies.

Cessation of dissemination

That we stop disseminating information, or de-index a link, where dissemination causes serious injury to your reputation or privacy and the harm outweighs the public interest.

Human review

Of a decision based exclusively on automated processing, together with the reasons for it.

Objection and restriction

Where the GDPR applies, to processing based on our legitimate interests, and to restrict processing while a dispute is resolved.

3The self-service route

You do not need to write to anyone for the common cases. From settings you can download a portable JSON bundle of everything tied to your Account: profile, Companies, posts, messages, orders and the rest. A business identity exports separately from your personal Account, because they are separate identities. Most fields are editable in place, and you can close your Account yourself.

Account secrets are never included in an export: password hashes, session tokens and keys stay out, because an export file is a document you might forward to someone.

4Making a request to us

Write to [email protected]. Tell us which right you are exercising, and enough detail to find the information. You do not have to give a reason, except for a cessation-of-dissemination request, where the injury is part of what we have to assess.

5How we verify who you are

We verify that a request comes from the person it concerns, because handing personal information to the wrong person is itself a breach. Normally, making the request from the email address on the Account is enough. If it is not, we ask for the minimum additional proof needed, and we do not keep that proof longer than the verification requires.

6How long we take

Thirty days from receipt, which is the deadline under Law 25 and PIPEDA. Where the GDPR applies the period is one month, extendable by two further months for a complex request, and we tell you within the first month if we extend. Requests are free. We may charge only where the law allows it for a transcription, reproduction or transmission cost, and we tell you the amount before doing the work.

7When we can refuse, in whole or in part

• Where granting it would reveal personal information about another person, we redact rather than refuse outright.
• Where the information is subject to legal privilege, or disclosure would likely hinder an investigation to prevent or detect fraud.
• Where a retention obligation requires us to keep the information despite a deletion request.
• Where a request is manifestly unfounded or excessive, in particular because it is repetitive.

If we refuse, we tell you in writing, give the reason and the legal provision we rely on, and tell you how to contest it and by when.

8Deletion and what survives it

Closing your Account removes your personal information. Some records survive, and they are the ones the law or a legitimate defence requires: order, invoice and payout records for the statutory retention period, a record of a moderation action so it can still be explained and contested, and information we are ordered to preserve. These are kept to the minimum and are not used for anything else.

9If you are not satisfied

Escalate to our person in charge of personal information at [email protected]. After that you may complain to the Commission d'accès à l'information du Québec, to the Office of the Privacy Commissioner of Canada, or to your national supervisory authority in the EEA or the UK. You do not have to exhaust our process first.