IGotYouBruhh Privacy Policy

Who we are and who to contact

IGotYouBruhh is based in Quebec, Canada. Contact us at customerSupport@igotyoubruhh.ca. We are working on a mailing address. The person in charge of the protection of personal information is our Privacy Officer (the founder). You can reach them at customerSupport@igotyoubruhh.ca for any question, request or complaint about your personal information.

Our role: your data vs. your business's data

We decide how your own account information is used, so we are responsible for it. Information a business puts into the platform about its own customers and staff (orders, schedules, time entries, pay lines, tasks) belongs to that business. For that information we act on the business's behalf and follow its instructions. The business is responsible for having the right to collect it, and requests about it should go to the business first. We will help the business answer them.

What we collect

What we hold depends on how you use IGotYouBruhh:

• Website visitors: pages viewed and campaign source (only with your consent, see Cookies), and anything you send us through a contact or booking form (name, email, phone, message, chosen time).
• Account holders: email, password (stored only as a secure hash by our authentication provider), name, username, optional photo, language, and your age band (16 to 17, or 18 and over; never your date of birth).
• Consent records: each time you accept our Terms or this policy, or turn marketing email or text messages on or off, we keep a record of what you agreed to, which version, when, and how (the sign-up form or Settings). At sign-up the record also includes the IP address your request came from, as evidence of your consent. Changes you make later in Settings are recorded with the time, version and source, but without an IP address.
• Business owners: business name, handle, contact email, phone and address, location names and addresses, products, prices, settings, subscription status. Card details are entered directly with Stripe; we never see or store your card number.
• Workers: your membership in a business and its permissions, and the work records the business keeps about you (shifts, availability, time clock punches, completed tasks, pay lines). Members of a business can see which locations their colleagues work at and their shifts, so that shifts can be swapped and open shifts covered. If you use the marketplace: the profile details you choose to add (skills, experience, general location, travel radius).
• Customers of a business: the name, items, notes and totals on an order the business takes and, for items that are delivered or performed at the buyer's place, the location the cashier types in at checkout (kept with the order). The business controls this information.
• Reviews: if you review a product or a business, your rating, your comment, the business's reply, and who wrote them. A report that a review breaks the rules is kept with it.
• Technical data: IP address and browser details in server logs, and error reports (see Error monitoring).

We do not collect your social insurance number, bank account numbers or health information, and we do not keep your date of birth (only an age band; see Age requirements).

Why we use it

We use personal information only to:

• create and secure your account and let you sign in;
• run the features you use: orders, stations, scheduling, time clock, marketplace, automations;
• bill your subscription and let businesses take payments;
• answer your messages and bookings;
• keep the service secure, fix errors and prevent abuse;
• with your consent only: measure our website's audience and advertising, and send you marketing email or text messages;
• meet our legal obligations (for example, keeping tax records).

We do not sell personal information and we do not use your business's data to advertise to you or anyone else.

Cookies and tracking

Essential cookies keep you signed in and remember your language; they are always on. Analytics and advertising tools (Google Tag Manager, Google Analytics 4, Google Ads and Meta measurement) and our campaign-source cookies are used on our public website only, and only if you accept them. You can change your choice at any time with the "Cookie settings" link in the footer. The web app you use after signing in does not load advertising tags.

• Cookie policy

What is public

Your marketplace profile (name, username, photo, skills, general location) is visible to others only while "Visible in marketplace" is on. A business's page is a public business listing and shows its name, description, contact email and phone, and the names and addresses of its active locations. Do not put personal contact details in a business listing if you don't want them public. Reviews are public: your rating and comment appear on the product or business page with your first name and last initial (for example, Jane D.), along with any reply from the business.

Job suggestions on the marketplace

The marketplace can use your activity, such as the jobs you view and save, to suggest jobs that fit you. This is off until you turn it on. You can turn "Use my activity" on or off at any time in Settings.

Who we share it with

We use service providers to host and run IGotYouBruhh: Supabase (database and sign-in), Vercel (web hosting), Sentry (error monitoring), Stripe (billing, and card payments for businesses), Square and Clover (optional card payments), Resend (email), and, with your consent, Google and Meta (analytics and ads). They may use the information only to provide their service to us, under written agreements. The members of a business you belong to see what their permissions allow. We may disclose information when the law requires it.

• Full list of service providers

Storage outside Quebec

Our database and most of our service providers are located in the United States, so your information is stored and processed there. We assess the privacy risks of doing so, and we rely on contracts and security measures to protect it. Information stored in another country may be accessible to that country's authorities under its laws.

AI and product research

When a business searches our shared product catalog and nothing is found, the search term (and barcode, if any) may be sent to Perplexity or OpenAI to help fill the catalog. We send only the product words, never your name, email, business or any customer information. No decision about you is made by automated means.

Error monitoring

When the web app hits an error, Sentry receives technical details and may record a short replay of the screen leading up to it. Text and form inputs are masked in that replay, so what you typed is not captured.

How long we keep it

We keep information only as long as we need it:

• Your account: while it is open. When you ask to delete it, you are signed out and your profile is hidden right away, but nothing is removed yet: we wait 30 days (sign in again in that time to cancel). After that we anonymize your personal details and delete your sign-in.
• Consent records (what you agreed to, when, and the sign-up IP address): while your account is open, then 3 years after you withdraw that consent or, if you never withdrew it, 3 years after your account is anonymized. They are then deleted.
• A business that leaves: 90 days for its owner to download its data from Settings, then it is deleted. Closing a business does not cancel its paid plan by itself: we ask the owner whether to also delete the Stripe account, and if the answer is no the plan keeps billing until the owner cancels it on the Billing page.
• A deactivated location: kept, hidden from the public business page, together with its history. We plan to anonymize it 6 years after deactivation; that cleanup is not automatic yet, and until it is, we apply it on request.
• Reviews: kept while the product or business is listed. If you delete your account, your review stays, including your comment, and your name shows as "Former customer". If a business closes, its reviews are hidden and kept for 6 years after the closure; that cleanup is not automatic yet, and until it is, we apply it on request. If a review contains personal information, email us and we will remove that information by hand.
• Orders, including a customer location typed at the register: kept with the order, so controlled by the business; the financial part 6 years.
• Work and pay records: controlled by the employer; by default kept 6 years.
• Invoices and tax records: 6 years, as tax law requires.
• Contact and booking requests: 2 years after our last exchange.
• Campaign-source cookies: 30 days.

We are putting these deletion schedules into automatic jobs. Until each one is live, we apply it on request: email us and we will act within 30 days. A few records sit outside the download and the automatic cleanup, for example sign-in logs held by our authentication provider (email and IP address), contact-form messages (cleared when a business closes), and email or notification recipients. We handle those on request too; email us and we will tell you what we hold.

Security and incidents

Data is encrypted in transit and at rest by our providers, each business's data is isolated from every other business's at the database level, and access by our team is limited. If an incident puts your information at risk of serious harm, we will notify you and the Commission d'accès à l'information du Québec and/or the Office of the Privacy Commissioner of Canada, and we keep a register of every incident.

• Security and incidents

Your rights

You can ask to access the personal information we hold about you, correct it, receive it in a structured, commonly used format, have it deleted, withdraw a consent you gave, or have a link to your information stopped from being published or indexed where it causes you harm. Signed in, you can download a copy yourself under Settings, Download your data (JSON or CSV, limited to one every 10 minutes and five a day; we keep a log of each download request for 1 year). For anything else, email customerSupport@igotyoubruhh.ca from your account's email address. We answer within 30 days, free of charge. If you are not satisfied, you may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

• How to make a request

Age requirements

You must be 18 or older to own a business account or subscribe, and 16 or older to join a business as a worker. IGotYouBruhh is not directed to children, and we do not knowingly collect information from anyone under 16. When you sign up we ask for your date of birth once, only to work out your age band (16 to 17, or 18 and over). We do not keep the date itself; we keep the band, and when it was recorded, and use it to apply these age rules. If you believe a child has given us information, email us and we will delete it. Businesses that sell age-restricted products to their own customers are responsible for checking those customers' age.

Marketing messages

We send marketing email or text messages only if you have agreed to receive them. At sign-up there are two separate boxes, one for email and one for text, and both start unticked. Marketing messages are being set up; until they are live, ticking a box only records your permission. Every message identifies us, includes our mailing address and has a simple way to unsubscribe (or reply STOP to a text). We process unsubscribes within 10 business days. Service messages about your account, security or billing are not marketing and are sent regardless.

Changes to this policy

When we change this policy in a way that matters, we update the date at the top and tell account holders by email or in the app before the change applies. If a change requires your consent, we will ask for it.