Privacy Policy

1. Introduction

CaféMedia MTL ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information in compliance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and Canada's PIPEDA. It applies to all visitors and users of the CaféMedia MTL platform at https://cafemedia-mtl.com.

2. Information We Collect

We collect the following categories of personal information:

• Contact information: name, email address, company name, phone number, collected when you submit an inquiry, create an account, or sign up for our newsletter.
• Payment information: processed by Stripe. We store a Stripe customer ID and subscription status; we do not store raw credit card data.
• Usage data: pages visited, browser type, and general geographic region (city-level) collected via our analytics snippet. We do not collect individually identifiable browsing history beyond what is necessary for service improvement.
• Café data: publicly scraped information about café venues including name, address, neighborhood, and public social media handles. This data is publicly available and does not constitute personal information under Law 25 unless it identifies an individual.
• Placement photos: photos of the advertising placement submitted by Host cafés as weekly campaign proof. These are used to confirm the placement is live and to release Host payouts.

3. Purpose of Collection

We collect personal information for the following purposes:

• To process advertiser subscription enrollment and billing (Stripe)
• To send transactional emails: auto-replies to inquiries, subscription confirmations
• To manage Stripe Connect Express onboarding for café Host partners
• To generate anonymized aggregate analytics for platform improvement
• To respond to support requests and contact you about your account

4. Retention Policy

We retain personal information only as long as necessary to fulfill the purposes identified above. Specifically: account records are kept for 3 years after account closure or last activity; inquiry records are kept for 2 years; analytics data is anonymized after 12 months. You may request deletion of your data at any time (see Section 9).

5. Cross-Border Transfers

Your personal information may be transferred to, stored, and processed in servers located outside of Canada, including in the United States, for the purpose of serving our platform and processing payments via Stripe. When we transfer data internationally, we ensure that appropriate safeguards are in place, including standard contractual clauses and encryption in transit.

Stripe's data processing practices are available at stripe.com/privacy.

6. Information Sharing

We do not sell your personal information. We share information only with: (a) Stripe for payment processing and Host payouts; (b) Resend for transactional email delivery; (c) PostHog for privacy-conscious product analytics; (d) Supabase for database hosting; (e) legal authorities when required by law. We do not share advertiser contact data with café Hosts or vice versa without explicit consent.

7. Security

We implement appropriate technical and organizational security measures: SSL/TLS encryption in transit, password hashing using bcrypt, access controls on database tables, and regular security review. No method of internet transmission is 100% secure; we cannot guarantee absolute security but we take commercially reasonable steps.

8. Cookies and Analytics

We use PostHog for privacy-conscious product analytics (aggregate traffic, pages visited, and general region). PostHog may set a first-party cookie to count unique visitors. We also store a language preference in your browser. These do not contain sensitive personal information and are not used for cross-site tracking, and we do not use third-party advertising cookies.

9. Your Rights (Law 25 / PIPEDA)

Under Quebec's Law 25 and PIPEDA, you have the right to: access your personal information; correct inaccurate information; withdraw consent (subject to legal limits); request deletion of your data. To exercise any of these rights, contact our Privacy Officer at legal@cafemedia-mtl.com or by phone at (438) 815-9645. We respond to all requests within 30 days.

10. Privacy Officer

Our Privacy Officer responsible for overseeing compliance with this policy is:

Alex Dupont
Café Media Montreal (MTL), a wholly owned division of C2MCI Group Inc.
Email: legal@cafemedia-mtl.com
Phone: (438) 815-9645