Privacy Policy

This Privacy Policy applies to:

• Visitors who browse InfoSylvita without an account.
• Business owners who claim or list their business on our platform.
• Users who create an account, subscribe to our newsletter, or submit a lead (inquiry) to a business.

Information you provide directly

• Account registration: full name, email address, preferred language.
• Business listings: business name, address, city, province, phone number, website, social media links, category, description, and photos.
• Lead / contact forms: your name, email, phone number, and message when you contact a business through our platform.
• Newsletter subscription: email address and preferred language.
• Suggest a business: any information you voluntarily submit about a business.

Information collected automatically

• Search events: search queries, city filters, category filters, and the number of results returned — used to improve the directory.
• Listing views: which business profiles are viewed, and from which city (derived from your IP address, which is then one-way hashed and discarded — your actual IP is never stored).
• Usage analytics: pages visited, session duration, and general device type, collected via Google Analytics 4 (anonymised).
• Cookies: session cookies for authentication, and analytics cookies placed by Google Analytics.

Payment information

Subscription payments are processed by Stripe. We never see or store your full credit card number — Stripe handles all payment data under their own PCI-DSS compliant systems. We retain only a Stripe customer ID and subscription status.

• To operate and improve the InfoSylvita directory and its search features.
• To display business listings publicly on the platform.
• To forward leads (inquiries) from users to the relevant business owner via email.
• To send business owners monthly performance reports about their listing (Premium and Featured tiers).
• To send subscribers our monthly newsletter (with your explicit opt-in consent).
• To send transactional emails: email verification, claim confirmations, subscription receipts.
• To generate anonymised platform analytics and trends (e.g. most-searched categories).
• To communicate important service updates, security notices, or policy changes.
• To prevent fraud and abuse of the platform.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We process personal information under the following bases:

• Consent: newsletter subscriptions, analytics cookies.
• Contract: account registration, business listing management, payment processing.
• Legitimate interests: fraud prevention, platform security, anonymised analytics to improve search results.
• Legal obligation: retaining transaction records as required by Canadian tax law.

We share personal information only where necessary:

• Supabase: our database and authentication provider, hosted in data centres compliant with Canadian and international privacy standards.
• Resend: our transactional email provider, used to deliver verification, claim confirmation, lead notification, newsletter, and report emails.
• Stripe: our payment processor for subscription billing.
• Google Analytics: anonymised usage statistics. IP addresses are anonymised before being sent to Google.
• Anthropic (Claude AI): used to generate newsletter content and business tips. No personal identifying information is included in AI prompts.
• Law enforcement: where required by law or valid legal process.

All third-party providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

• Account data: retained while your account is active. Deleted within 30 days of a verified account deletion request.
• Business listings: retained while active on the platform. Business owners may request removal at any time (see Section 8).
• Leads / inquiries: retained for 2 years to support business owner records, then deleted.
• Search event logs: retained for 13 months to support analytics, then deleted.
• Newsletter subscriber records: retained until unsubscribe is requested. Unsubscribed records are soft-deleted (email address retained only to honour the unsubscribe preference).
• Payment records: retained for 7 years as required by Canadian tax regulations.

We use the following cookies:

• Strictly necessary: Supabase session cookies that keep you logged in. These cannot be disabled without breaking core functionality.
• Analytics: Google Analytics cookies (GA4) that collect anonymised usage data. You may opt out via your browser settings or by using a browser extension such as the Google Analytics Opt-out Add-on.

We do not use advertising or tracking cookies.

Under PIPEDA and applicable provincial privacy laws, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information (subject to legal retention requirements).
• Withdraw consent for newsletter communications at any time via the unsubscribe link in any email.
• Request your business listing be updated or removed — see Section 9 below.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated.

To exercise any of these rights, contact us at hola@infosylvita.com. We will respond within 30 days.

• All data is transmitted over HTTPS / TLS encryption.
• Passwords are hashed using industry-standard algorithms — we never store plaintext passwords.
• IP addresses used to track listing views are one-way hashed using a secret salt before storage — the original IP cannot be recovered.
• Database access is restricted via row-level security (RLS) policies — users can only access their own data.
• Administrative access requires multi-factor authentication.
• We conduct regular security reviews of our platform and third-party services.

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA.

InfoSylvita is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will notify registered users by email. Continued use of InfoSylvita after the effective date constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or concerns, please contact our Privacy Officer:

You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.