Privacy Policy

Every statement here about what we collect, keep or share was checked against our code and our providers' settings, and we keep a record of each check.

1. Who we are

Canadian Locals is a directory of independent, Canadian-owned businesses at canadianlocals.ca. It is run by Josh Gonzales, at 358 Cranford Dr SE, Calgary, AB T3M 1N1 ("we", "us").

This policy covers:

• canadianlocals.ca and greatwhitenorthawards.ca, our awards site;
• the Canadian Locals scan app;
• Canadian Locals Business, the app for business owners;
• Canadian Locals Partner, the app for our city partners.

Questions about your information go to our privacy officer, Josh Gonzales, at hello@canadianlocals.ca.

City partners (section 7) are people who bring businesses in their city to Canadian Locals and share in the sale.

2. If you visit our site

Page counts. We count visits with Vercel Web Analytics. It uses no cookies. For each page view, it records:

• the page address;
• where you came from;
• your country and region;
• your device type, operating system and browser.

Vercel recognizes a visitor only for 24 hours, and the counts it gives us cannot be tied to you. Before a page address is sent, we remove anything secret from it, such as the link in an owner's email or a password reset link.

Cookies. We set cookies only when you sign in, to keep you signed in. We use no advertising or tracking cookies.

Fonts. A business page can use fonts that your browser loads from Google Fonts, so Google sees your browser's request for them.

Videos. A business page can hold one video from YouTube or Vimeo. Nothing loads from them until you press play. Then your browser's request goes to YouTube, which Google runs, or to Vimeo.

If you scan a business's QR code. The code opens linkqr.ca, which sends you on to the address the business chose. Before it does, we count the scan. For each scan we record the code, the day, whether the device was a phone, and the country. We do not keep your IP address, set no cookie, and keep no page you came from. The business sees the counts and nothing else.

Search. Directory search runs in your browser. We do not keep a record of what you searched for.

Contacting us. Our contact page and our "Email us" links give you an email address, and writing to it opens your own email app. We receive what you choose to send.

3. If you use the scan app

When you scan a product, the barcode is read on your phone. The camera image never leaves it. The barcode number, or the brand you type, is sent to our server, which looks it up in Open Food Facts, a public product database, and in our own brand ownership records. We do not store your lookups. A result is kept in memory for about a minute so repeated lookups are fast, and then it is gone.

4. If your business is in our directory

Where the information came from. We built many business pages from public sources:

• local business associations and chambers of commerce;
• published "best of" lists;
• the business's own website.

For each fact, we record where we found it.

What a page shows: the business's name, a short summary and description, website, public email and phone, street address, city, social links, category, and photos.

Checking and publishing. Every listing is reviewed before it appears. The pages published on September 7, 2026 were checked for facts we could verify (a name, a city, a category and a way to reach the business), not for who owns it. A business tells us about its own ownership, and our public copy claims only what was checked.

How we contact you. We may email you at an address your business published, to tell you about your page and ask if you would like it listed. If you do not answer, we may write once more. Once we have sent you the plan link, you have 30 days with nothing to pay, and we send a reminder and a last note before they end. Each email says who we are, gives our mailing address, and tells you how to stop further emails.

We keep a record of contact: the address we wrote to, where that address was published, when we wrote, and your reply.

Correcting or removing your page.

• A correction costs nothing. Write to hello@canadianlocals.ca and we fix it.
• To take your page down, reply no to our email. It leaves the directory the same day, and we do not email you again. You can also use "Remove my page" on the plan page our email links to; the page leaves the directory that day. A reply of "Stop" ends our emails and leaves your page as it is.
• After a page leaves the directory, we keep a short record: the business's name, the fact that it left, and that you asked not to be contacted. We keep that record for as long as we run the directory, so we never write to you again.

5. If you own a business page or a person page

Your account. When you tell us you would like your page listed, or when you pay for a plan, we create an account for the email address you used. We keep:

• your email address and a securely hashed password (we never see the password itself);
• your display name;
• when you last signed in.

Connecting you to the business. Before you can edit a page, we confirm you are connected to the business. That happens in one of two ways: you replied to our email from an address the business published, or you paid for the plan, and the account was created for the address you used. We keep what you sent us and when. We never ask for identity documents.

Your page. What you add to your page is public: text, photos, links, your address and contact details, and the look you choose. Photos are stored on our file storage and can be seen by anyone with the link.

Your person page. A person page shows your name, photo, headline, city and links. It becomes public only when you switch it on.

Posts, the writing assistant. If you use Posts, we keep:

• the writing samples, facts and notes you give it;
• the drafts it writes.

To write a draft, we send your business facts, your samples and your answers to xAI's Grok model through Vercel's AI service, which processes them in the United States. With every request we ask the provider not to use it for training. We ask for your consent before we store anything you give Posts, and nothing is sent for a draft without it. You can decline and keep using the rest of your page. When you delete a sample, it is permanently removed within 30 days.

Reminders. If you set a reminder in the owner app, it is a calendar reminder on your phone. We do not send them from our servers.

6. If you buy a plan

Stripe handles your payment. Stripe collects your card, name, email and billing address. Your card number never reaches us.

What we keep from a sale: your email address, the amount, the plan, your city, and Stripe's reference numbers for your customer record and subscription. A city partner may add a note on who bought, such as a first name.

Who can see your email: you, our team, and the city partner who brought your business to Canadian Locals, if one did.

How long we keep it. We remove your email address from the sale record, and the partner's note, 180 days after your plan ends; your account itself is kept as section 9 says. For a checkout you never finished, that is 180 days after you started it. We keep the financial record itself, without your email, because tax law requires it. The notice under Stripe's pay button says the same.

7. If you are a city partner

We keep your account, your city, your share of sales, and the sales and payouts in your statement.

Payouts go through Stripe. Stripe checks your identity and holds your banking details. We see only whether your Stripe account can receive payouts.

Your working notes. What you record about businesses you contact (a contact's name, email and phone, and your notes) is kept for your work. We remove the contact's name, email and phone 180 days after your last contact with them, or as soon as the business's owner takes over the page.

Your partner agreement sets out how you may use information about businesses and buyers.

8. Who we share information with

We do not sell personal information. We share it only with the companies that run parts of our service for us, and only what each needs:

We also share information when the law requires it.

9. How long we keep information

10. How we protect it

• Access is limited. Our database lets each person see only what their role allows. An owner sees their own business, and a partner sees their own city.
• Passwords are at least 12 characters, with upper and lower case letters, a number and a symbol. They are stored only as secure hashes.
• Keys to our systems are kept out of our code, in our providers' secret stores and an encrypted keychain.
• If a breach creates a real risk of significant harm to you, we tell you and the Office of the Privacy Commissioner of Canada, as the law requires.

11. Your choices and rights

You can ask us to:

• show you the personal information we hold about you;
• correct it;
• delete it, where we do not have to keep it by law;
• stop contacting you.

You can also withdraw consent you gave us, such as for Posts.

Write to our privacy officer at hello@canadianlocals.ca. We answer within 30 days. If you ask us to delete your account, we delete it, your pages and your photos within 30 days, and we keep only what tax law and the do-not-contact record require.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, you can complain to the Commission d'accès à l'information.

12. Children

Canadian Locals is a service for businesses and the people who run them. It is not meant for anyone under 18, and we do not knowingly collect information from children.

13. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change affects how we use information you have already given us, we tell you by email at least 30 days before it takes effect.