Northline Marketplace Inc.

Privacy Policy

This policy explains how Northline Marketplace Inc. ("Northline") collects, uses, discloses and protects personal information, and the choices you have. It is written to meet the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act, British Columbia's PIPA, and Québec's Law 25 where it applies, together with Canada's Anti-Spam Legislation (CASL).

The short version. We collect what we need to run a safe marketplace: who you are, how to reach you, where to deliver, and what happened in each transaction. We keep it in Canada. We never sell it. Businesses only see what they need to fulfil your order. You can see, correct, export or delete your data from settings.

1. What we collect

You give us: name, email, mobile number, delivery or service addresses, payment method (tokenised by our processor — we never store card numbers), profile photo if you add one, messages and reviews, dispute evidence, support conversations. Businesses additionally give us legal-entity details, owner government ID (for KYC, held by our payment processor), tax numbers, licences, permits, insurance, bank details and team-member details.

We generate: transaction history, reliability score inputs (completions, cancellations, punctuality check-ins, disputes), device and login records (IP address, device type, passkey identifiers, time), and for on-site providers, GPS check-in and check-out at the job address during the booking window only.

From others: identity and sanctions checks from our payment processor, provincial trade-registry and permit status for Businesses, delivery status from couriers, and the basic profile (name, email) if you sign in with Google or Apple.

We do not collect precise location from customers, do not read your contacts, and do not build advertising profiles.

2. Why we use it, and on what basis

We identify a purpose before collecting, and we collect only what a reasonable person would consider appropriate for it.

Running the marketplaceAccounts, bookings, orders, messaging, escrow, payouts, receipts. Basis: performing our contract with you.

Trust and safetyVerifying Businesses, reliability scores, dispute resolution, fraud and abuse prevention, GPS check-in records. Basis: legitimate operation of a safe marketplace, which you consent to by using it; some checks are required by law.

Legal obligationsTax collection and remittance as marketplace facilitator, anti-money-laundering record-keeping, responding to lawful requests.

Service messagesConfirmations, ETAs, receipts, security alerts, changes to terms. These are not marketing and cannot be switched off while you hold an account.

MarketingOnly with your express opt-in (CASL). Every message has a one-click unsubscribe that works within 10 days, usually instantly. We never share your contact details with Businesses for their marketing.

Improving the productAggregated, de-identified usage analytics. We do not use your messages, photos or documents to train machine-learning models.

We do not sell personal information and never have. We share it only as follows:

The other party to your transaction — see section 4.
Service providers under contract who process data on our instructions: payment processing and KYC (Stripe), cloud hosting in Canadian regions, SMS and email delivery, courier tracking, customer-support tooling, and error monitoring. Each is bound to use data only for our purposes and to protect it at least as well as we do. The current list is at northline.ca/subprocessors, and we give 30 days' notice before adding one.
Authorities when required by law, a court order, or to protect someone from imminent harm. We tell you when the law allows, and we publish an annual transparency count.
A successor if Northline is sold or merged, under this same policy, with notice to you.

4. What Businesses see, and what customers see

Before a booking is confirmed, a Business sees your first name, reliability score and the general area (neighbourhood) of the service. After confirmation, it sees the details needed to fulfil the job or delivery: full name, address, phone number (relayed through Northline where possible) and any notes you add. Kitchens see allergen and dietary notes. Businesses may use this only to fulfil the transaction, must not add you to marketing lists, and must delete it when no longer needed, as required by their own privacy obligations and our Business Terms.

You see a Business's public profile, verified badges, licence and permit status, reliability score and reviews, and, for on-site work, the name and photo of the person attending and their live ETA during the booking window.

5. Where your data lives

Personal information is stored and processed in Canada (cloud regions in Montréal and Toronto, with backups in Canada). A small number of service providers — for example, payment processing and email delivery — may access data from outside Canada to perform their service; where they do, data is subject to the laws of that jurisdiction, and we rely on contractual protections and encryption. We conduct a privacy impact assessment before any transfer outside Canada, as Québec's Law 25 requires.

6. How long we keep it

Account profile: while your account is open, then deleted within 30 days of closure.
Transaction and tax records: 7 years, as required by the Income Tax Act and Excise Tax Act, held in restricted archives.
Messages and dispute evidence: 2 years after the transaction, or until a dispute is closed plus 1 year, whichever is later.
GPS check-in records: 90 days, or until a related dispute is closed.
Login and security logs: 12 months.
KYC documents: held by our payment processor under its own legal retention schedule (5 years after the relationship ends under Canadian AML rules).
Reviews: remain public, attributed to your first name and initial, unless you delete them; you may also anonymise them on account closure.
Backups roll off within 35 days of deletion.

7. How we protect it

Encryption in transit (TLS 1.2+) and at rest; passkeys and mandatory second factors for Business accounts; role-based access so staff see only what their role requires; all access to personal information by Northline employees is logged and reviewed; segregated escrow accounts; annual third-party penetration testing; a SOC 2 Type II programme. Sensitive actions (bank changes, payouts, exports) re-prompt authentication and hold for 24 hours.

If a breach creates a real risk of significant harm, we notify you and the relevant Privacy Commissioner as soon as feasible, describing what happened, what data was involved and what you can do. We keep a record of every breach as the law requires.

8. Your rights and choices

From Settings → Privacy, or by writing to privacy@northline.ca, you can:

Access what we hold about you — we respond within 30 days, free of charge.
Correct anything inaccurate; if we disagree, we record your note alongside the data.
Export your profile, transactions, messages and reviews in a machine-readable format (JSON and CSV).
Delete your account and data, subject to the legal retention periods in section 6, which we will explain.
Withdraw consent to optional uses such as marketing at any time, without affecting your ability to use the marketplace.
Object to an automated decision and have a person review it (section 10).
Complain to us and to the Privacy Commissioner (section 13).

We verify your identity before acting on a request. We will never penalise you for exercising a right. Requests from authorised representatives require proof of authority.

9. Cookies and analytics

We use strictly necessary cookies for sign-in, security and your language choice; these need no consent. Analytics use a first-party, cookieless tool that aggregates page views and does not identify individuals or track you across other sites. We do not use advertising cookies, third-party ad pixels or fingerprinting. We honour Global Privacy Control signals.

10. Automated decisions

Three things on Northline are decided partly by software: reliability scores, fraud holds on payments or payouts, and search ranking. Each uses only the factors we publish (completions, cancellations, punctuality, disputes, verification status, distance and availability) and never protected characteristics. A fraud hold or a tier downgrade always tells you the principal reasons and how to ask a person to review it; the review is completed within 5 business days. Business verification decisions are always made by a person.

11. Children

Northline is for adults. We do not knowingly collect information from anyone under 18, and we delete it when we learn of it. Parents who believe a minor has created an account can write to privacy@northline.ca.

12. Changes to this policy

We give 30 days' notice by email and in-app of material changes, with a plain summary of what changed and why. Where a change would use existing data for a new purpose, we ask for your consent rather than assume it. Earlier versions are archived and available on request.

13. Contact and complaints

Privacy Officer, Northline Marketplace Inc. · 1200 – 8th Avenue SW, Calgary, Alberta T2P 1B5 · privacy@northline.ca · 1-800-555-0166. We acknowledge within 2 business days and respond within 30 days.

If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), or the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Cette politique est également disponible en français.