Privacy Policy

SUOOG™ is operated by the SUOOG team in Ontario, Canada. For the purposes of Canadian privacy law, SUOOG is the data controller of the personal information described in this policy. Our team can be reached at contact@suoog.ca, or by mail at our corporate mailing address:

CININTIRIKS INC. o/a SUOOG
375 University Ave, Suite 3334
Toronto, ON M5G 2J5, Canada

We collect only what we need to operate the Platform safely.

• Provide the service: create your account, publish your listings, run search, process payments, send transactional emails.
• Verify identity: confirm your email and phone number to reduce bot signups and protect other users.
• Moderate content: automatically screen listings before publication, remove prohibited content, respond to abuse reports.
• Buyer/seller connection: share a seller’s phone number with logged-in buyers who click Text Seller (which opens the buyer’s own messaging app with a pre-written note) or Reveal Phone Number. Both buttons use the same protected endpoint and require the buyer to have a verified phone number and an address on file (the same requirements as posting); we count successful reveals per logged-in account and rate-limit them to 30 reveals per hour — this protects sellers from bulk contact-info harvesting by automated scrapers.
• Improve the platform: use aggregated, non-identifying analytics to understand feature usage.
• Legal compliance and safety: comply with court orders, prevent fraud, enforce our Terms of Service, protect users.

Under PIPEDA we collect, use, and disclose your personal information based on your express consent at signup (when you tick the box agreeing to this Privacy Policy and our Terms of Service), and on implied consent for activities necessary to deliver a service you have requested (e.g., sending a payment-receipt email after you complete a Stripe payment). You may withdraw consent at any time, subject to legal or contractual restrictions — see Section 11.

We share personal information only with vetted service providers strictly to operate the platform. We do not sell your data to advertisers or data brokers.

• Amazon Web Services (AWS) — Canada (Central) region: hosts our application (Amplify), database (DynamoDB), file storage (S3), authentication (Cognito), email delivery (SES), SMS (SNS), and the API gateway. Your data resides primarily in Canada.
• Amazon Rekognition (automated image moderation) — United States: when you submit or edit a listing, your uploaded photos are transiently sent to Amazon Rekognition in the United States (AWS US East region) to be scanned in real time for prohibited content. The photos are analyzed and not stored by Rekognition. This step runs in the US because AWS does not offer the image-moderation service in the Canada region.
• Stripe, Inc.: processes credit-card payments made on this website. Stripe is PCI-DSS Level 1 certified. See Stripe’s Privacy Policy.
• Apple, Google and Microsoft (in-app purchases): if you buy inside the SUOOG app for iPhone, Android or Windows, the purchase is processed by that app store’s own in-app purchase system, not by Stripe, and the store is the merchant of record. Your payment details are handled entirely by the store under its own privacy policy and are never sent to us. We receive only a signed confirmation that the purchase happened, from which we keep the store’s transaction identifier, the purchase date and the platform — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if the store later refunds you. See Apple’s, Google’s and Microsoft’s privacy policies.
• Stripe Identity (optional account verification): if you choose to verify your identity for the blue checkmark, your government ID photo and selfie are uploaded and processed directly by Stripe Identity on Stripe’s own secure infrastructure. SUOOG never sees or stores your ID document or selfie image — we receive only a verified / not-verified result and an attempts counter, which we keep on your account so the same in-progress verification is never charged twice. The Stripe Identity check runs the same way on every platform, including inside the SUOOG apps. The associated verification fee is charged through Stripe on this website, or through the app store’s in-app purchase system in the apps; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded — automatically for a website purchase, or by a refund-request link we email you for an app purchase. Identity verification is entirely optional.
• Google (Gemini AI): processes anonymized listing text and search queries to power our semantic-search feature. Listings sent to Gemini do not include your email, phone, or address.
• Google Analytics 4: measures aggregate site traffic and usage (pages viewed, sessions, approximate region, device/browser) so we can improve the platform. IP addresses are anonymized, advertising features are off, and we do not share the data for ads. See Google’s Privacy Policy or the opt-out browser add-on.
• Google reCAPTCHA Enterprise (anti-bot): our sign-up, log-in, password-reset, contact, and listing-posting forms are protected by Google reCAPTCHA Enterprise. When you submit one of these forms, Google receives a reCAPTCHA token together with device and interaction signals (e.g., IP address, browser/device information, and how you interacted with the page) and returns a risk score that we use only to tell humans from bots. We do not send Google your name, email, phone number, or address. reCAPTCHA runs invisibly (no puzzle). Your use of it is subject to Google’s Privacy Policy and Terms of Service.
• Law enforcement and regulators: when required by a valid Canadian court order, production order, or applicable law.
• Successor entities: if SUOOG is involved in a merger, acquisition, or asset sale, personal information may transfer to the successor. We will notify you in advance.

Our primary infrastructure is in AWS Canada (Central). However, certain third-party services may process data outside Canada:

• Stripe: headquartered in the United States and Ireland.
• Apple, Google and Microsoft: in-app purchases made in the SUOOG apps are processed on those companies’ global infrastructure, primarily the United States.
• Google Gemini: processed on Google’s global infrastructure, primarily the United States.
• Google Analytics: aggregate usage data processed on Google’s global infrastructure, primarily the United States.
• Google reCAPTCHA Enterprise: anti-bot signals processed on Google’s global infrastructure, primarily the United States.

When personal information is transferred outside Canada it remains subject to comparable privacy protections through contractual safeguards and the laws of the receiving country.

SUOOG uses strictly necessary, functional, and analytics cookies (e.g., to keep you logged in, and Google Analytics to measure aggregate traffic). We do not serve third-party advertising, do not use social-media tracking pixels, and do not sell your cookie data. See our Cookies Policy for the full list and your opt-out options.

• AI-powered search: Google Gemini reads your search query and our anonymized listing index to return relevant results. No decision binding on you is taken by Gemini.
• Pre-publication moderation: before a listing goes live, its text (title, description, location) is automatically scanned for prohibited content and contact details, and its photos are automatically analyzed by Amazon Rekognition for prohibited or inappropriate visual content (including any text shown inside an image). Listings that fail these automated checks are rejected automatically.
• Fraud and bot detection: rate-limiting and signature-checking algorithms may temporarily block requests that look automated. Public forms (sign-up, log-in, password-reset, contact, and posting) are also scored by Google reCAPTCHA Enterprise; a low human-likelihood score can block a submission. reCAPTCHA runs invisibly and shows no puzzle. You can ask for a human review of any block (below).

You have the right to ask for a human review of any automated decision that materially affects you (for example, a listing rejection). Contact contact@suoog.ca.

• TLS 1.2+ for all data in transit between your browser and our servers.
• At-rest encryption (AWS-managed KMS keys) for DynamoDB, S3, and Secrets Manager.
• Cognito-hashed passwords with adaptive authentication and rate-limiting.
• Password-change security email — every successful password change (via Account Settings or the Forgot Password reset flow) triggers an automated email to the address on file confirming the change, so you find out immediately if someone else modifies your credentials. Notification sends are rate-limited per email to deter abuse.
• HMAC-signed moderation links to prevent token forgery.
• Stripe-signed webhooks with timestamp tolerance to prevent replay attacks.
• In-app purchase receipts are cryptographically verified against the app store’s own signing certificate before anything is granted, and each transaction can be redeemed only once.
• Principle of least privilege on all IAM roles and Lambda functions.

No system is perfectly secure. Use a strong, unique password and enable any additional authentication factors your email provider supports.

• Access the personal information we hold about you and obtain a copy.
• Correct inaccurate or incomplete information.
• Delete your account and all associated personal data at any time, directly and immediately, from Dashboard → Account Settings → Delete Account — or by emailing us (subject to legal and tax-record retention obligations, such as billing records kept for 7 years).
• Withdraw consent for non-essential uses of your data.
• Object to or restrict certain processing.
• Portability — receive your data in a structured, machine-readable format (JSON).
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, email contact@suoog.ca. We will respond within 30 calendar days.

SUOOG is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe a minor has created an account, contact us and we will delete the account and its data.

If we become aware of a security incident that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as required by PIPEDA's mandatory breach-reporting rules.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-platform notice at least 14 days before they take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

For privacy questions, complaints, or data-subject requests, contact our team at contact@suoog.ca. We will respond within 30 calendar days. You can also write to us at: CININTIRIKS INC. o/a SUOOG, 375 University Ave, Suite 3334, Toronto, ON M5G 2J5, Canada.