Privacy Policy

SUOOG™ is operated by CININTIRIKS INC., which does business as SUOOG and is based in Toronto, Ontario, Canada. For the purposes of Canadian privacy law, CININTIRIKS INC. is responsible for the personal information described in this policy. Our team can be reached at contact@suoog.ca, or by mail at our corporate mailing address:

SUOOG
375 University Ave, Unit 102 Suite 3334
Toronto, ON M5G 2J5, Canada

Person in charge of the protection of personal information. Our Privacy Officer is responsible for how SUOOG protects personal information, and is the person to contact about this policy, a request about your information, or a complaint. Write to the Privacy Officer at contact@suoog.ca (subject line “Privacy Officer”), or by mail to the address above, marked “Attention: Privacy Officer”.

We collect only what we need to operate the Platform safely.

• Provide the service: create your account, publish your listings, run search, process payments, send transactional emails.
• Verify identity: confirm your email and phone number to reduce bot sign-ups and protect other users.
• Moderate content: automatically screen listings before publication, remove prohibited content, respond to abuse reports.
• Buyer/seller connection: share a seller’s phone number with logged-in buyers who click Text Seller (which opens the buyer’s own messaging app with a pre-written note) or Reveal Phone Number, unless the seller has switched off Let buyers text or call me in Account Settings (it is on unless they turn it off). If, and only if, the seller has switched on Let buyers email me (it is off unless they turn it on), we also share the seller’s verified email address with logged-in buyers who click Email Seller, which shows the address and opens the buyer’s own email app with a pre-written note. The email itself is sent from the buyer’s own email account, so SUOOG never sees its content. We check the seller’s settings at the moment of every click, so switching either one off stops any further sharing straight away, and Account Settings does not let a seller switch both off. All three buttons use the same protected endpoint and require the buyer to have a verified phone number and an address on file (the same requirements as posting); we count successful reveals per logged-in account and rate-limit them to 30 reveals per hour, shared across the three buttons — this protects sellers from the bulk harvesting of their contact details by automated scrapers.
• Improve the platform (only with your consent): if you allow Analytics on the website, Google Analytics measures which pages and features are used, so we can improve them.
• Advertise SUOOG (only with your consent): if you allow Advertising on the website, Google Ads measures whether SUOOG’s own ads on other websites lead people to SUOOG, and lets us show SUOOG ads to people who have visited our site. See section 8.
• Protect the service: use your IP address to limit how many searches can be made, and how many contact-form messages can be sent, each hour, so that automated scraping cannot overload search and automated messages cannot flood our support inbox.
• Legal compliance and safety: comply with court orders, prevent fraud, enforce our Terms of Service, protect users.

Under PIPEDA we collect, use, and disclose your personal information based on your express consent at sign-up (when you tick the box agreeing to this Privacy Policy and our Terms of Service), and on implied consent for activities necessary to deliver a service you have requested (e.g., sending a payment-receipt email after you complete a Stripe payment). You may withdraw consent at any time, subject to legal or contractual restrictions — see section 12.

Optional cookies are separate. On the website, analytics cookies (Google Analytics) and advertising cookies (Google Ads) are used only if you turn them on in the cookie banner or in “Cookie settings”, and they are off until you do. Agreeing to this policy at sign-up does not turn them on, and refusing them does not limit anything you can do on SUOOG. You can change or withdraw your choice at any time from “Cookie settings” at the bottom of every page; withdrawing takes effect immediately and deletes the cookies those services set on suoog.ca. The SUOOG apps use no analytics or advertising cookies, so they do not ask.

Text messages are separate. We send text messages only to deliver one-time verification codes for your account, and only when you ask for one, such as when you tick the optional text-message box at sign-up, or later verify or change your phone number. Agreeing to this policy at sign-up does not sign you up for text messages. Message and data rates may apply; reply STOP to opt out, or HELP for help. We never share your phone number, or your consent to receive our text messages, with third parties or affiliates for their marketing.

You choose how buyers reach you. Your phone number is shared with buyers through Text Seller and Reveal Phone Number unless you switch off Let buyers text or call me in Account Settings. Your email address is shown to buyers only if you switch on Let buyers email me: it is off until you do, and agreeing to this policy at sign-up does not turn it on. You can change either one at any time in the same place, as long as one of them stays on (section 3). Your Shop page has its own choices in Dashboard → My Shop, and shows your email only if you tick Show my email there (section 2). What you tick under Payment Accepted (cash, e-Transfer) and Handover (pickup, delivery, shipping) in Account Settings is shown to everyone on your listings; nothing is shown until you tick one. SUOOG takes no part in the payment or the handover itself.

We share personal information only with vetted service providers strictly to operate the platform. We do not sell your data to advertisers or data brokers.

• Amazon Web Services (AWS) — Canada (Central) region: hosts our application (Amplify), database (DynamoDB), file storage (S3), authentication (Cognito), email delivery (SES), SMS (SNS), and the API gateway. Your data resides primarily in Canada.
• Amazon Rekognition (automated image moderation) — United States: when you submit or edit a listing, or upload a shop logo, that image is sent to Amazon Rekognition in the United States (AWS US East region) to be scanned in real time for prohibited content. AWS states that it may keep images Rekognition processes as needed to provide and maintain the service and, unless an account opts out, to improve Amazon’s AI services; it does not use them to market to you. This step runs in the US because AWS does not offer the image-moderation service in the Canada region.
• Stripe, Inc.: processes credit-card payments made on this website. Stripe is PCI-DSS Level 1 certified. See Stripe’s Privacy Policy.
• Apple, Google and Microsoft (in-app purchases): if you buy inside the SUOOG app for iPhone, Android or Windows, the purchase is processed by that app store’s own in-app purchase system, not by Stripe, and the store is the merchant of record. Your payment details are handled entirely by the store under its own privacy policy and are never sent to us. We receive only a confirmation that the purchase happened, from which we keep the store’s transaction identifier, the purchase date and the platform — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if the store later refunds you. See Apple’s, Google’s and Microsoft’s privacy policies.
• Apple (in-app purchases): if you buy inside this app, the purchase is processed by the App Store’s own in-app purchase system and the App Store is the merchant of record. Your payment details are handled entirely by Apple under its own privacy policy and are never sent to us. We receive only a signed confirmation that the purchase happened, from which we keep the transaction identifier and the purchase date — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if Apple later refunds you. See Apple’s privacy policy.
• Microsoft (in-app purchases): if you buy inside this app, the purchase is processed by the Microsoft Store’s own in-app purchase system and the Microsoft Store is the merchant of record. Your payment details are handled entirely by Microsoft under its own privacy policy and are never sent to us. We receive only a confirmation that the purchase happened, from which we keep the transaction identifier and the purchase date — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if Microsoft later refunds you. See Microsoft’s privacy statement.
• Google (in-app purchases): if you buy inside this app, the purchase is processed by Google Play’s own billing system and Google Play is the merchant of record. Your payment details are handled entirely by Google under its own privacy policy and are never sent to us. We receive only a confirmation that the purchase happened, from which we keep the transaction identifier and the purchase date — enough to grant what you bought, to detect a transaction being submitted twice, and to reverse the benefit if Google later refunds you. See Google’s privacy policy.
• Stripe Identity (optional account verification): if you choose to verify your identity for the blue checkmark, your government ID photo and selfie are uploaded and processed directly by Stripe Identity on Stripe’s own secure infrastructure. They never pass through or are stored on SUOOG’s own servers: our database keeps only a verified / not-verified result and an attempts counter, so the same in-progress verification is never charged twice. Stripe keeps the images, and the details it reads from your ID (such as your name, date of birth and document number), for up to 7 years in SUOOG’s Stripe account, where only people SUOOG authorizes can view them; Stripe deletes the biometric face data it creates within one year. We open them only to investigate suspected fraud or to answer a request from you, and on request we will have them deleted. The Stripe Identity check runs the same way on every platform, including inside the SUOOG apps. The associated verification fee is charged through Stripe on this website, or through the app store’s in-app purchase system in the apps; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded — automatically for a website purchase, or by a refund-request link we email you for an app purchase.The Stripe Identity check runs the same way on every platform. In this app the associated verification fee is charged through the App Store’s in-app purchase system; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded by a refund-request link we email you.The Stripe Identity check runs the same way on every platform. In this app the associated verification fee is charged through the Microsoft Store’s in-app purchase system; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded by a refund-request link we email you.The Stripe Identity check runs the same way on every platform. In this app the associated verification fee is charged through Google Play’s billing system; if Stripe Identity cannot approve the check after three (3) attempts the fee is refunded by a refund-request link we email you. Identity verification is entirely optional.
• Google (Gemini AI): powers our semantic search, and checks listing photos for contact details before a listing is published. Google receives the words you search for, the title, condition and description of each listing, and listing photos that show text. It does not receive the name, email address, phone number or street address on your account, or your IP address. We use Google’s paid service: under its terms, Google does not use this information to improve its products, and logs it for a limited period to detect and prevent misuse of its service.
• Google Analytics 4 (only if you allow Analytics): on the website, measures site traffic and usage (pages viewed, sessions, approximate region, device/browser) so we can improve the platform. Google states that Google Analytics 4 does not log or store IP addresses. For visitors who allow Analytics but not Advertising, SUOOG switches off Google signals and ad personalisation. Google Analytics is never used inside the SUOOG apps. See Google’s Privacy Policy or the opt-out browser add-on.
• Google Ads (only if you allow Advertising): on the website, measures whether SUOOG’s own ads on other websites lead people to SUOOG, and lets us show SUOOG ads to people who have visited suoog.ca. Never used inside the SUOOG apps. See section 8.
• Google reCAPTCHA Enterprise (anti-bot): our sign-up, log-in, password-reset, contact, and listing-posting forms are protected by Google reCAPTCHA Enterprise. When you submit one of these forms, Google receives a reCAPTCHA token together with device and interaction signals (e.g., IP address, browser/device information, and how you interacted with the page) and returns a risk score that we use only to tell humans from bots. We do not send Google your name, email, phone number, or address. reCAPTCHA runs invisibly (no puzzle). It is loaded in the main SUOOG app, which contains these forms, and on the Contact page — not on our information and legal pages. Your use of it is subject to Google’s Privacy Policy and Terms of Service.
• Google Fonts: our pages load the Open Sans typeface from Google’s font servers. As with any web server, Google receives your IP address, browser details and the address of the page. Google states that the Fonts API sets no cookies and that this information is not used to build profiles or for targeted advertising.
• jsDelivr (open-source code delivery): the main SUOOG app downloads Amazon’s sign-in library from the jsDelivr network. As with any web server, jsDelivr receives your IP address and browser details. It sets no cookies, and we send it nothing else.
• Forward Email and Google (Gmail) — email: email you send to contact@suoog.ca, and messages you send through our contact form, are delivered by Forward Email, our email-forwarding service, to our team’s mailbox, which is hosted by Google (Gmail). Contact-form messages are sent by Amazon SES and are not stored in SUOOG’s own database.
• Law enforcement and regulators: when required by a valid Canadian court order, production order, or applicable law.
• Successor entities: if SUOOG is involved in a merger, acquisition, or asset sale, personal information may transfer to the successor. We will notify you in advance.

What stays in Canada. SUOOG’s own infrastructure runs entirely in the AWS Canada (Central) region, in Montréal. Your account record, your listings and their text, your uploaded photos and your shop page are stored there. Our pages are delivered through Amazon CloudFront, which can serve cached copies of public pages from a location near the visitor.

What is processed outside Canada. Some specialist services we rely on are not offered inside Canada, or are operated by companies based elsewhere. These process data outside Canada, and therefore outside Québec — primarily in the United States:

• Stripe (payments): headquartered in the United States and Ireland. Card payments handled by Stripe are processed on Stripe’s infrastructure outside Canada.
• Stripe Identity (optional verification) — United States: if you choose to verify your identity, the government ID photo and selfie you submit are uploaded to and checked by Stripe Identity outside Canada, on Stripe’s own infrastructure, and Stripe keeps them in SUOOG’s Stripe account in the United States (section 5). They never reach SUOOG’s own servers; only a verified / not-verified result and an attempts counter are stored on your account in Canada.
• Amazon Rekognition (automated image moderation) — United States: the AWS Canada (Central) region does not offer the image-moderation service, so each photo is sent to Amazon Rekognition in the AWS US East region to be scanned. As described in section 5, AWS may keep the images it analyzes; your photo itself continues to be stored by SUOOG in Canada.
• Apple, Google and Microsoft: in-app purchases made in the SUOOG apps are processed on those companies’ global infrastructure, primarily the United States.
• Apple: in-app purchases made in this app are processed on Apple’s global infrastructure, primarily the United States.
• Microsoft: in-app purchases made in this app are processed on Microsoft’s global infrastructure, primarily the United States.
• Google: in-app purchases made in this app are processed on Google’s global infrastructure, primarily the United States.
• Google Gemini: search words, listing text and listing photos that show text, processed on Google’s global infrastructure, primarily the United States.
• Google Analytics (only if you allow it): usage data processed on Google’s global infrastructure, primarily the United States.
• Google Ads (only if you allow it): advertising measurement data processed on Google’s global infrastructure, primarily the United States.
• Google reCAPTCHA Enterprise: anti-bot signals processed on Google’s global infrastructure, primarily the United States.
• Google Fonts: font requests served from Google’s global infrastructure.
• jsDelivr: the sign-in library is served from a global content-delivery network.
• Forward Email and Google (Gmail): email you send us, and contact-form messages, are forwarded by Forward Email and kept in our Gmail mailbox, outside Canada, primarily in the United States.

When personal information is processed outside Canada, the provider’s contractual terms protect it, but it is also subject to the laws of the country where it is processed, and may be accessible to that country’s courts, law-enforcement and national-security authorities.

Necessary storage keeps you signed in, remembers your cookie choice and protects our forms from bots (Google reCAPTCHA). It is always on, because SUOOG cannot work without it.

Analytics cookies (Google Analytics) and advertising cookies (Google Ads) are off unless you turn them on. On your first visit to the website we ask; “Reject All” takes one click, as “Accept All” does, and nothing optional loads until you choose. You can change your choice at any time from “Cookie settings” at the bottom of every page. We ask again after 12 months, and whenever we add a new kind of optional cookie or a new provider.

Inside the SUOOG apps, no analytics or advertising cookies are used at all.

We do not use social-media tracking pixels and we do not sell your cookie data. Our Cookies Policy lists every cookie by name and how long each one lasts.

SUOOG does not show ads on its own pages, and we do not sell your personal information. We do advertise SUOOG itself on other websites and apps, and we use advertising cookies to do that well — but only for website visitors who allow them.

What it does. If you allow Advertising, Google Ads places cookies on suoog.ca (such as _gcl_au) that let us:

• measure whether people who saw or clicked a SUOOG ad later visited or used SUOOG (conversion measurement);
• show SUOOG ads on other websites to people who have visited suoog.ca (remarketing); and
• let Google personalise which SUOOG ads you see, using information Google holds under its own privacy policy.

What Google receives. The addresses and titles of the pages you visit on suoog.ca, whether you arrived from an ad, a cookie identifier, your IP address and your browser details. We do not send Google your name, email address, phone number or street address.

Your choice. Advertising is off unless you turn it on, it is separate from Analytics, and refusing it changes nothing about how SUOOG works for you. You can withdraw at any time from “Cookie settings”; the Google Ads cookies on suoog.ca are then deleted. You can also control the ads Google shows you in Google’s My Ad Center. Advertising cookies are never used inside the SUOOG apps.

Other advertising platforms. Google Ads is the only advertising platform SUOOG uses. If we add another (for example Meta or TikTok), we will name it here and in our Cookies Policy before it is switched on, and ask for your consent again — a choice you made earlier is never carried over to a new platform.

• AI-powered search: Google Gemini reads your search query and our listing index to return relevant results. No decision binding on you is taken by Gemini in search.
• Pre-publication moderation: before a listing goes live, its text (title, description, location) is automatically scanned for prohibited content and contact details, and its photos are automatically analyzed by Amazon Rekognition for prohibited or inappropriate visual content (including any text shown inside an image). Photos that show text are also checked by Google Gemini for contact details added by the seller. Listings that fail these automated checks are rejected automatically, and the reason is shown on the listing in your Dashboard. A shop logo you upload is checked by Amazon Rekognition before it is saved, and is refused if it fails.
• Fraud and bot detection: rate-limiting and signature-checking algorithms may temporarily block requests that look automated. Public forms (sign-up, log-in, password-reset, contact, and posting) are also scored by Google reCAPTCHA Enterprise; a low human-likelihood score can block a submission. reCAPTCHA runs invisibly and shows no puzzle. You can ask for a human review of any block (below).

Some of these decisions are made entirely by automated processing, with no person involved — for example, a listing or shop logo refused by our automated checks, or a form submission blocked as automated. When that happens we tell you at the time. On request, we will also tell you:

• the personal information that was used to make the decision;
• the reasons, and the principal factors and parameters, that led to it; and
• your right to have that personal information corrected.

You may also submit your observations to a member of our team who is in a position to review the decision, and ask for a human review of any automated decision that materially affects you. To do any of this, email contact@suoog.ca.

• TLS 1.2+ for all data in transit between your browser and our servers.
• At-rest encryption (AWS-managed KMS keys) for DynamoDB, S3, and Secrets Manager.
• Cognito-hashed passwords with adaptive authentication and rate-limiting.
• Password-change security email — every successful password change (via Account Settings or the Forgot Password reset flow) triggers an automated email to the address on file confirming the change, so you find out immediately if someone else modifies your credentials. Notification sends are rate-limited per email to deter abuse.
• HMAC-signed moderation links to prevent token forgery.
• Stripe-signed webhooks with timestamp tolerance to prevent replay attacks.
• Purchases made inside the SUOOG apps are checked as far as each store allows: Apple’s signed purchase record is verified against Apple’s certificates, Google Play purchases are confirmed directly with Google, and Microsoft Store purchases are tied to the signed-in account and recorded for reconciliation with Microsoft. No purchase is granted twice.Purchases made in this app are checked before anything is granted: Apple’s signed purchase record is verified against Apple’s certificates, and each transaction can be redeemed only once.Purchases made in this app are tied to your signed-in account, recorded for reconciliation with the Microsoft Store, and never granted twice for the same purchase.Purchases made in this app are confirmed directly with Google before anything is granted, and each transaction can be redeemed only once.
• Principle of least privilege on all IAM roles and Lambda functions.

No system is perfectly secure. Use a strong, unique password and enable any additional authentication factors your email provider supports.

• Access the personal information we hold about you and obtain a copy.
• Correct inaccurate or incomplete information.
• Delete your account and all associated personal data at any time, directly and immediately, from Dashboard → Account Settings → Delete Account — or by emailing us (subject to legal and tax-record retention obligations, such as billing records kept for 7 years).
• Withdraw consent for non-essential uses of your data — including optional cookies, which you can switch off yourself at any time from “Cookie settings” at the bottom of every page.
• Object to or restrict certain processing.
• Portability — receive the information you gave us in a structured, commonly used format (JSON), or have it sent to a person or body authorized by law to collect it.
• Automated decisions — be told about, and ask for a review of, a decision made entirely by automated processing (section 9).
• Stop dissemination or de-index — under Québec law, you may ask us to stop publishing information about you, or to de-index a link attached to your name, if publishing it breaks the law or a court order, or if it causes serious injury to your reputation or privacy that clearly outweighs the public interest in knowing it or anyone’s freedom of expression. You can also delete your own listings, and switch off your Shop page, yourself at any time.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, if you live in Québec, with the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.

To exercise any of these rights, email our Privacy Officer at contact@suoog.ca. We will reply in writing within 30 days of receiving your request.

SUOOG is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe a minor has created an account, contact us and we will delete the account and its data.

If a confidentiality incident (a breach of security safeguards) involving your personal information presents a risk of serious injury or a real risk of significant harm to you, we will promptly notify you and the regulator concerned — the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada, as the law requires. We also take reasonable steps to reduce the risk of harm and prevent a recurrence, and we keep a register of every confidentiality incident, whether or not it had to be reported.

These are the practices SUOOG follows to protect personal information. They are approved by our Privacy Officer and are proportionate to the size of our business.

• Responsibility. Our Privacy Officer (section 17) is responsible for SUOOG’s compliance with privacy law: approving these practices, answering requests and complaints, handling confidentiality incidents and keeping their register, and reviewing this policy when the service changes.
• Who can access your information. Only the members of our team who need it to run SUOOG — to provide support, review listings and reports, handle billing, and keep the service working — can access personal information, and only for those purposes. Access to our systems follows the least-privilege principle described in section 11.
• Keeping and destroying information. We keep personal information only for the periods set out in section 10. When a period ends, or when you delete your account, the information is permanently deleted from our database and file storage; most of this happens automatically.
• New providers and transfers. Before a new service provider receives personal information, or personal information is sent outside Québec, we assess the privacy risks, and we name the provider in this policy.
• Complaints. Send a complaint about how we handle personal information to our Privacy Officer at contact@suoog.ca, or by mail to the address in section 1. We will acknowledge it, look into it, and reply in writing within 30 days. If you are not satisfied with our answer, you may complain to the Commission d’accès à l’information du Québec or to the Office of the Privacy Commissioner of Canada (section 12).

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-platform notice at least 14 days before they take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

For privacy questions, complaints, or requests about your personal information, contact our Privacy Officer, the person in charge of the protection of personal information, at contact@suoog.ca. We will reply in writing within 30 days. You can also write to: Privacy Officer, SUOOG, 375 University Ave, Unit 102 Suite 3334, Toronto, ON M5G 2J5, Canada.