Legal
Privacy policy
This policy explains what personal information we collect, why, and how you stay in control. It is written to meet Québec's Act respecting the protection of personal information in the private sector and the federal PIPEDA.
Effective October 7, 2026
01Person in charge of personal information
Person in charge of the protection of personal information: Patrick Ouellette, founder, Québec City, Canada. Email: privacy@chilicarlo.com.
02What we collect
Account: email, password (hashed, never readable), first name or pseudonym, role, language.
Profile: legal name and phone if you provide them, region, experience and project for buyers.
Seller listing: information about the business, some of it masked (legal name, address, exact figures).
Exchanges: messages, documents uploaded to the data room, signatures (typed name, date and time, IP address, browser used, version of the text signed).
Compliance: blocked attempts to share contact details (type, date), logged to enforce the no-circumvention rule.
Contact requests: your questionnaire answers, forwarded without your name to the seller of a spotted business.
Proximity: the first three characters of your postal code, if you provide them, to compute an approximate distance. We never display an address.
Payment: processed by Stripe. We receive your subscription status, never your card number.
Technical: connection logs and cookies essential to your session.
Sellers not yet registered: for spotted businesses, we receive from our sources the listing's public title and description and the email address published to reach the seller. We use it only to forward buyers' requests. Unsubscribing stops all future messages; we then keep only a hashed fingerprint of the address to honour that choice.
03Why we use it
To provide the service: create your account, show listings according to your plan, enable exchanges and signatures.
To protect users: enforce masking, prevent fraud and abuse.
To bill plans and send you account-related emails.
To improve the platform using aggregated statistics.
We do not sell your personal information and we do not use it for targeted advertising.
04Who has access
Other users see only what your plan and the stage of the match allow. Your legal name, contact details and your business's identifying information are revealed only after the mutual reveal.
Our providers, solely to run the service: Vercel (hosting, United States), Supabase (database, authentication and files, Canada, Montréal region), Stripe (payment) and Resend (email delivery, United States).
Authorities, where required by law.
05Transfers outside Québec
Some providers host or process information outside Québec, notably in the United States. Before entrusting them with information, we assess the privacy factors and we contractually require adequate protection.
06Automated decision
Before the reveal, messages, listings and requests are scanned automatically for contact details. A flagged submission is blocked without human review. You may ask which information led to the block and request review by a person at privacy@chilicarlo.com.
07Cookies
We only use cookies needed to keep you signed in and remember your language. We use no advertising cookies. If we ever add audience measurement tools, they will be off by default and subject to your consent.
08Retention
We keep your information while your account is active. After the account is closed, it is deleted or anonymized within 90 days, except information we are legally required to keep (for example, billing records) and signature records, kept as proof of agreements for the applicable limitation period.
09Security
Encrypted connections, hashed passwords, data access restricted by rules enforced in the database itself, documents stored in a private space. In the event of a confidentiality incident presenting a risk of serious injury, we will notify you and the Commission d'accès à l'information.
10Your rights
You may ask to access your information, have it corrected, withdraw your consent, receive a copy in a structured, commonly used technological format, have its dissemination stopped, or have any hyperlink attached to your name de-indexed. Write to privacy@chilicarlo.com. We reply within 30 days.
If you are not satisfied with our response, you may contact Québec's Commission d'accès à l'information.
11Minors
Chili Carlo is reserved for people 18 and older. We do not knowingly collect information about minors.
12Changes
We will post any change on this page with its effective date, and notify you of any significant change.