Privacy Policy

SUOOG™ is operated by CININTIRIKS INC., which does business as SUOOG and is based in Toronto, Ontario, Canada. For the purposes of Canadian privacy law, CININTIRIKS INC. is responsible for the personal information described in this policy. Our team can be reached at contact@suoog.ca, or by mail at our corporate mailing address:

CININTIRIKS INC. o/a SUOOG
375 University Ave, Unit 102 Suite 3334
Toronto, ON M5G 2J5, Canada

Person in charge of the protection of personal information. Our Privacy Officer is responsible for how SUOOG protects personal information, and is the person to contact about this policy, a request about your information, or a complaint. Write to the Privacy Officer at contact@suoog.ca (subject line “Privacy Officer”), or by mail to the address above, marked “Attention: Privacy Officer”.

We collect only what we need to operate the Platform safely.

• Provide the service: create your account, publish your listings, run search, process payments, send transactional emails.
• Verify identity: confirm your email and phone number to reduce bot signups and protect other users.
• Moderate content: automatically screen listings before publication, remove prohibited content, respond to abuse reports.
• Buyer/seller connection: share a seller’s phone number with logged-in buyers who click Text Seller (which opens the buyer’s own messaging app with a pre-written note) or Reveal Phone Number. Both buttons use the same protected endpoint and require the buyer to have a verified phone number and an address on file (the same requirements as posting); we count successful reveals per logged-in account and rate-limit them to 30 reveals per hour — this protects sellers from bulk contact-info harvesting by automated scrapers.
• Improve the platform (only with your consent): if you allow Analytics on the website, Google Analytics measures which pages and features are used, so we can improve them.
• Advertise SUOOG (only with your consent, from October 8, 2026): if you allow Advertising on the website, Google Ads measures whether SUOOG’s own ads on other websites lead people to SUOOG, and lets us show SUOOG ads to people who have visited our site. See section 8.
• Protect the service: use your IP address to limit how many searches can be made each hour, so that automated scraping cannot overload search.
• Legal compliance and safety: comply with court orders, prevent fraud, enforce our Terms of Service, protect users.

Under PIPEDA we collect, use, and disclose your personal information based on your express consent at signup (when you tick the box agreeing to this Privacy Policy and our Terms of Service), and on implied consent for activities necessary to deliver a service you have requested (e.g., sending a payment-receipt email after you complete a Stripe payment). You may withdraw consent at any time, subject to legal or contractual restrictions — see section 12.

Optional cookies are separate. On the website, analytics cookies (Google Analytics) and advertising cookies (Google Ads, from October 8, 2026) are used only if you turn them on in the cookie banner or in “Cookie settings”, and they are off until you do. Agreeing to this policy at sign-up does not turn them on, and refusing them does not limit anything you can do on SUOOG. You can change or withdraw your choice at any time from “Cookie settings” at the bottom of every page; withdrawing takes effect immediately and deletes the cookies those services set on suoog.ca. The SUOOG apps use no analytics or advertising cookies, so they do not ask.

We share personal information only with vetted service providers strictly to operate the platform. We do not sell your data to advertisers or data brokers.

• Amazon Web Services (AWS) — Canada (Central) region: hosts our application (Amplify), database (DynamoDB), file storage (S3), authentication (Cognito), email delivery (SES), SMS (SNS), and the API gateway. Your data resides primarily in Canada.
• Amazon Rekognition (automated image moderation) — United States: when you submit or edit a listing, or upload a shop logo, that image is sent to Amazon Rekognition in the United States (AWS US East region) to be scanned in real time for prohibited content. AWS states that it may keep images Rekognition processes as needed to provide and maintain the service and, unless an account opts out, to improve Amazon’s AI services; it does not use them to market to you. This step runs in the US because AWS does not offer the image-moderation service in the Canada region.
• Stripe, Inc.: processes credit-card payments made on this website. Stripe is PCI-DSS Level 1 certified. See Stripe’s Privacy Policy.
• Apple, Google and Microsoft (in-app purchases): if you buy inside the SUOOG app for iPhone, Android or Windows, the purchase is processed by that app store’s own in-app purchase system, not by Stripe, and the store is the merchant of record. Your payment details are handled entirely by the store under its own privacy policy and are never sent to us. We receive only a signed confirmation that the purchase happened, from which we keep the store’s transaction identifier, the purchase date and the platform — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if the store later refunds you. See Apple’s, Google’s and Microsoft’s privacy policies.
• Apple (in-app purchases): if you buy inside this app, the purchase is processed by the App Store’s own in-app purchase system and the App Store is the merchant of record. Your payment details are handled entirely by Apple under its own privacy policy and are never sent to us. We receive only a signed confirmation that the purchase happened, from which we keep the transaction identifier and the purchase date — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if Apple later refunds you. See Apple’s privacy policy.
• Microsoft (in-app purchases): if you buy inside this app, the purchase is processed by the Microsoft Store’s own in-app purchase system and the Microsoft Store is the merchant of record. Your payment details are handled entirely by Microsoft under its own privacy policy and are never sent to us. We receive only a signed confirmation that the purchase happened, from which we keep the transaction identifier and the purchase date — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if Microsoft later refunds you. See Microsoft’s privacy statement.
• Google (in-app purchases): if you buy inside this app, the purchase is processed by Google Play’s own billing system and Google Play is the merchant of record. Your payment details are handled entirely by Google under its own privacy policy and are never sent to us. We receive only a signed confirmation that the purchase happened, from which we keep the transaction identifier and the purchase date — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if Google later refunds you. See Google’s privacy policy.
• Stripe Identity (optional account verification): if you choose to verify your identity for the blue checkmark, your government ID photo and selfie are uploaded and processed directly by Stripe Identity on Stripe’s own secure infrastructure. They never pass through or are stored on SUOOG’s own servers: our database keeps only a verified / not-verified result and an attempts counter, so the same in-progress verification is never charged twice. Stripe keeps the images, and the details it reads from your ID (such as your name, date of birth and document number), for up to 7 years in SUOOG’s Stripe account, where only people SUOOG authorizes can view them; Stripe deletes the biometric face data it creates within one year. We open them only to investigate suspected fraud or to answer a request from you, and on request we will have them deleted. The Stripe Identity check runs the same way on every platform, including inside the SUOOG apps. The associated verification fee is charged through Stripe on this website, or through the app store’s in-app purchase system in the apps; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded — automatically for a website purchase, or by a refund-request link we email you for an app purchase.The Stripe Identity check runs the same way on every platform. In this app the associated verification fee is charged through the App Store’s in-app purchase system; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded by a refund-request link we email you.The Stripe Identity check runs the same way on every platform. In this app the associated verification fee is charged through the Microsoft Store’s in-app purchase system; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded by a refund-request link we email you.The Stripe Identity check runs the same way on every platform. In this app the associated verification fee is charged through Google Play’s billing system; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded by a refund-request link we email you. Identity verification is entirely optional.
• Google (Gemini AI): powers our semantic search. Google receives the words you search for, and the title, condition and description of each listing. It does not receive your name, email address, phone number, street address or IP address from us.
• Google Analytics 4 (only if you allow Analytics): on the website, measures site traffic and usage (pages viewed, sessions, approximate region, device/browser) so we can improve the platform. Google states that Google Analytics 4 does not log or store IP addresses. For visitors who allow Analytics but not Advertising, SUOOG switches off Google signals and ad personalisation. Google Analytics is never used inside the SUOOG apps. See Google’s Privacy Policy or the opt-out browser add-on.
• Google Ads (only if you allow Advertising, from October 8, 2026): on the website, measures whether SUOOG’s own ads on other websites lead people to SUOOG, and lets us show SUOOG ads to people who have visited suoog.ca. Never used inside the SUOOG apps. See section 8.
• Google reCAPTCHA Enterprise (anti-bot): our sign-up, log-in, password-reset, contact, and listing-posting forms are protected by Google reCAPTCHA Enterprise. When you submit one of these forms, Google receives a reCAPTCHA token together with device and interaction signals (e.g., IP address, browser/device information, and how you interacted with the page) and returns a risk score that we use only to tell humans from bots. We do not send Google your name, email, phone number, or address. reCAPTCHA runs invisibly (no puzzle). It is loaded in the main SUOOG app, which contains these forms, and on the Contact page — not on our information and legal pages. Your use of it is subject to Google’s Privacy Policy and Terms of Service.
• Google Fonts: our pages load the Open Sans typeface from Google’s font servers. As with any web server, Google receives your IP address, browser details and the address of the page. Google states that the Fonts API sets no cookies and that this information is not used to build profiles or for targeted advertising.
• jsDelivr (open-source code delivery): the main SUOOG app downloads Amazon’s sign-in library from the jsDelivr network. As with any web server, jsDelivr receives your IP address and browser details. It sets no cookies, and we send it nothing else.
• Forward Email and Google (Gmail) — email: email you send to contact@suoog.ca, and messages you send through our contact form, are delivered by Forward Email, our email-forwarding service, to our team’s mailbox, which is hosted by Google (Gmail). Contact-form messages are sent by Amazon SES and are not stored in SUOOG’s own database.
• Law enforcement and regulators: when required by a valid Canadian court order, production order, or applicable law.
• Successor entities: if SUOOG is involved in a merger, acquisition, or asset sale, personal information may transfer to the successor. We will notify you in advance.

What stays in Canada. SUOOG’s own infrastructure runs entirely in the AWS Canada (Central) region, in Montréal. Your account record, your listings and their text, your uploaded photos and your shop page are stored there. Our pages are delivered through Amazon CloudFront, which can serve cached copies of public pages from a location near the visitor.

What is processed outside Canada. Some specialist services we rely on are not offered inside Canada, or are operated by companies based elsewhere. These process data outside Canada, and therefore outside Québec — primarily in the United States:

• Stripe (payments): headquartered in the United States and Ireland. Card payments handled by Stripe are processed on Stripe’s infrastructure outside Canada.
• Stripe Identity (optional verification) — United States: if you choose to verify your identity, the government ID photo and selfie you submit are uploaded to and checked by Stripe Identity outside Canada, on Stripe’s own infrastructure, and Stripe keeps them in SUOOG’s Stripe account in the United States (section 5). They never reach SUOOG’s own servers; only a verified / not-verified result and an attempts counter are stored on your account in Canada.
• Amazon Rekognition (automated image moderation) — United States: the AWS Canada (Central) region does not offer the image-moderation service, so each photo is sent to Amazon Rekognition in the AWS US East region to be scanned. As described in section 5, AWS may keep the images it analyses; your photo itself continues to be stored by SUOOG in Canada.
• Apple, Google and Microsoft: in-app purchases made in the SUOOG apps are processed on those companies’ global infrastructure, primarily the United States.
• Apple: in-app purchases made in this app are processed on Apple’s global infrastructure, primarily the United States.
• Microsoft: in-app purchases made in this app are processed on Microsoft’s global infrastructure, primarily the United States.
• Google: in-app purchases made in this app are processed on Google’s global infrastructure, primarily the United States.
• Google Gemini: processed on Google’s global infrastructure, primarily the United States.
• Google Analytics (only if you allow it): usage data processed on Google’s global infrastructure, primarily the United States.
• Google Ads (only if you allow it, from October 8, 2026): advertising measurement data processed on Google’s global infrastructure, primarily the United States.
• Google reCAPTCHA Enterprise: anti-bot signals processed on Google’s global infrastructure, primarily the United States.
• Google Fonts: font requests served from Google’s global infrastructure.
• jsDelivr: the sign-in library is served from a global content-delivery network.
• Forward Email and Google (Gmail): email you send us, and contact-form messages, are forwarded by Forward Email and kept in our Gmail mailbox, outside Canada, primarily in the United States.

When personal information is processed outside Canada, the provider’s contractual terms protect it, but it is also subject to the laws of the country where it is processed, and may be accessible to that country’s courts, law-enforcement and national-security authorities.

Necessary storage keeps you signed in, remembers your cookie choice and protects our forms from bots (Google reCAPTCHA). It is always on, because SUOOG cannot work without it.

Analytics cookies (Google Analytics) and advertising cookies (Google Ads, available from October 8, 2026) are off unless you turn them on. On your first visit to the website we ask; “Reject all” is as easy as “Accept all”, and nothing optional loads until you choose. You can change your choice at any time from “Cookie settings” at the bottom of every page. We ask again after 12 months, and whenever we add a new kind of optional cookie or a new provider.

Inside the SUOOG apps, no analytics or advertising cookies are used at all.

We do not use social-media tracking pixels and we do not sell your cookie data. Our Cookies Policy lists every cookie by name and how long each one lasts.

This section takes effect on October 8, 2026. It describes a change we are announcing at least 14 days in advance, as section 16 promises. Until then, advertising cookies are not available on SUOOG, and the Advertising option in “Cookie settings” cannot be switched on.

SUOOG does not show ads on its own pages, and we do not sell your personal information. We do advertise SUOOG itself on other websites and apps, and from October 8, 2026 we may use advertising cookies to do that well — but only for website visitors who allow them.

What it does. If you allow Advertising, Google Ads places cookies on suoog.ca (such as _gcl_au) that let us:

• measure whether people who saw or clicked a SUOOG ad later visited or used SUOOG (conversion measurement);
• show SUOOG ads on other websites to people who have visited suoog.ca (remarketing); and
• let Google personalise which SUOOG ads you see, using information Google holds under its own privacy policy.

What Google receives. The addresses and titles of the pages you visit on suoog.ca, whether you arrived from an ad, a cookie identifier, your IP address and your browser details. We do not send Google your name, email address, phone number or street address.

Your choice. Advertising is off unless you turn it on, it is separate from Analytics, and refusing it changes nothing about how SUOOG works for you. You can withdraw at any time from “Cookie settings”; the Google Ads cookies on suoog.ca are then deleted. You can also control the ads Google shows you in Google’s My Ad Center. Advertising cookies are never used inside the SUOOG apps.

Other advertising platforms. Google Ads is the only advertising platform SUOOG uses. If we add another (for example Meta or TikTok), we will name it here and in our Cookies Policy before it is switched on, and ask for your consent again — a choice you made earlier is never carried over to a new platform.

• AI-powered search: Google Gemini reads your search query and our listing index to return relevant results. No decision binding on you is taken by Gemini.
• Pre-publication moderation: before a listing goes live, its text (title, description, location) is automatically scanned for prohibited content and contact details, and its photos are automatically analyzed by Amazon Rekognition for prohibited or inappropriate visual content (including any text shown inside an image). Listings that fail these automated checks are rejected automatically, and the reason is shown on the listing in your Dashboard. A shop logo you upload is checked the same way before it is saved, and is refused if it fails.
• Fraud and bot detection: rate-limiting and signature-checking algorithms may temporarily block requests that look automated. Public forms (sign-up, log-in, password-reset, contact, and posting) are also scored by Google reCAPTCHA Enterprise; a low human-likelihood score can block a submission. reCAPTCHA runs invisibly and shows no puzzle. You can ask for a human review of any block (below).

Some of these decisions are made entirely by automated processing, with no person involved — for example, a listing or shop logo refused by our automated checks, or a form submission blocked as automated. When that happens we tell you at the time. On request, we will also tell you:

• the personal information that was used to make the decision;
• the reasons, and the principal factors and parameters, that led to it; and
• your right to have that personal information corrected.

You may also submit your observations to a member of our team who is in a position to review the decision, and ask for a human review of any automated decision that materially affects you. To do any of this, email contact@suoog.ca.

• TLS 1.2+ for all data in transit between your browser and our servers.
• At-rest encryption (AWS-managed KMS keys) for DynamoDB, S3, and Secrets Manager.
• Cognito-hashed passwords with adaptive authentication and rate-limiting.
• Password-change security email — every successful password change (via Account Settings or the Forgot Password reset flow) triggers an automated email to the address on file confirming the change, so you find out immediately if someone else modifies your credentials. Notification sends are rate-limited per email to deter abuse.
• HMAC-signed moderation links to prevent token forgery.
• Stripe-signed webhooks with timestamp tolerance to prevent replay attacks.
• In-app purchase receipts are cryptographically verified against the app store’s own signing certificate before anything is granted, and each transaction can be redeemed only once.
• Principle of least privilege on all IAM roles and Lambda functions.

No system is perfectly secure. Use a strong, unique password and enable any additional authentication factors your email provider supports.

• Access the personal information we hold about you and obtain a copy.
• Correct inaccurate or incomplete information.
• Delete your account and all associated personal data at any time, directly and immediately, from Dashboard → Account Settings → Delete Account — or by emailing us (subject to legal and tax-record retention obligations, such as billing records kept for 7 years).
• Withdraw consent for non-essential uses of your data — including optional cookies, which you can switch off yourself at any time from “Cookie settings” at the bottom of every page.
• Object to or restrict certain processing.
• Portability — receive the information you gave us in a structured, commonly used format (JSON), or have it sent to a person or body authorized by law to collect it.
• Automated decisions — be told about, and ask for a review of, a decision made entirely by automated processing (section 9).
• Stop dissemination or de-index — under Québec law, you may ask us to stop publishing information about you, or to de-index a link attached to your name, if publishing it breaks the law or a court order, or if it causes serious injury to your reputation or privacy that clearly outweighs the public interest in knowing it or anyone’s freedom of expression. You can also delete your own listings, and switch off your Shop page, yourself at any time.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, if you live in Québec, with the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.

To exercise any of these rights, email our Privacy Officer at contact@suoog.ca. We will reply in writing within 30 days of receiving your request.

SUOOG is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe a minor has created an account, contact us and we will delete the account and its data.

If a confidentiality incident (a breach of security safeguards) involving your personal information presents a risk of serious injury or a real risk of significant harm to you, we will promptly notify you and the regulator concerned — the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada, as the law requires. We also take reasonable steps to reduce the risk of harm and prevent a recurrence, and we keep a register of every confidentiality incident, whether or not it had to be reported.

These are the practices SUOOG follows to protect personal information. They are approved by our Privacy Officer and are proportionate to the size of our business.

• Responsibility. Our Privacy Officer (section 17) is responsible for SUOOG’s compliance with privacy law: approving these practices, answering requests and complaints, handling confidentiality incidents and keeping their register, and reviewing this policy when the service changes.
• Who can access your information. Only the members of our team who need it to run SUOOG — to provide support, review listings and reports, handle billing, and keep the service working — can access personal information, and only for those purposes. Access to our systems follows the least-privilege principle described in section 11.
• Keeping and destroying information. We keep personal information only for the periods set out in section 10. When a period ends, or when you delete your account, the information is permanently deleted from our database and file storage; most of this happens automatically.
• New providers and transfers. Before a new service provider receives personal information, or personal information is sent outside Québec, we assess the privacy risks, and we name the provider in this policy.
• Complaints. Send a complaint about how we handle personal information to our Privacy Officer at contact@suoog.ca, or by mail to the address in section 1. We will acknowledge it, look into it, and reply in writing within 30 days. If you are not satisfied with our answer, you may complain to the Commission d’accès à l’information du Québec or to the Office of the Privacy Commissioner of Canada (section 12).

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-platform notice at least 14 days before they take effect. The "Last Updated" date at the top of this page reflects the most recent revision. The advertising change in section 8 is announced on this page and in the website’s cookie banner at least 14 days before it takes effect on October 8, 2026.

For privacy questions, complaints, or requests about your personal information, contact our Privacy Officer, the person in charge of the protection of personal information, at contact@suoog.ca. We will reply in writing within 30 days. You can also write to: Privacy Officer, CININTIRIKS INC. o/a SUOOG, 375 University Ave, Unit 102 Suite 3334, Toronto, ON M5G 2J5, Canada.