Privacy Policy

1. Introduction and Scope

1.1 PenderExchange ("PenderExchange," "we," "us," or "our") operates a community classifieds marketplace serving North Pender Island and South Pender Island, British Columbia, Canada, through the website located at penderexchange.ca (the "Platform").

1.2 We collect, use, and disclose personal information in accordance with the Personal Information Protection Act (British Columbia) ("PIPA") and, to the extent it applies to personal information handled in the course of interprovincial or international commercial activity, the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA").

1.3 This Privacy Policy describes the personal information we collect, the purposes for which we use it, the circumstances in which we disclose it, how long we retain it, how we safeguard it, and the rights available to you. It forms part of, and should be read together with, our Terms of Service, and capitalized terms not defined in this Privacy Policy have the meanings given to them in the Terms of Service. By using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

2. Information We Collect

Account Information

When you create an account, we collect:

• Name: your name and the display name shown on your profile and Listings;
• Email address: used for authentication, account recovery, and communications about the Platform;
• Phone number: only if you choose to provide one for contact purposes; and
• Google account information: if you elect to sign in with Google, the name, email address, and basic profile information that Google shares with us.

Listing Content

When you create a Listing, we collect and store:

• the title, description, price, and category of the Listing;
• any images you upload;
• for community events, the event date, time, venue, and organizer; and
• any contact details you choose to include, together with your choice as to whether a phone number is displayed publicly.

Verification Submissions

If you request resident verification, we collect your full name, your Pender Island address, and any additional information you elect to provide in support of the request. If you request a verified business account, we collect the information you submit in support of that request.

Payments and Advertising

When you purchase a Paid Service or submit display advertising, we collect:

• records relating to Paid Services, including payment status, Stripe transaction identifiers, and renewal and expiry dates; and
• display advertising submissions, including the business name, contact email address, website address, telephone number for the call button, and advertisement image.

Payment card details are entered directly with Stripe and are neither received nor stored by PenderExchange.

Reports, Inquiries, and Problem Reports

• reports you submit concerning Listings, and support inquiries you send to us;
• submissions made through the "Report a problem" form, together with the page address, screen size, browser information, site version, and error reference attached automatically, and, if you are not signed in, any email address you choose to provide; and
• records of each occasion on which a signed-in User reveals a seller's contact details, including the date, time, and IP address of the request.

Technical and Usage Information

• Listing view counts and advertising impression and click events;
• IP addresses used for rate limiting, abuse prevention, and contact-reveal audit records;
• technical request and security information processed by our hosting, authentication, bot-protection, payment, and moderation providers; and
• error diagnostics, which are collected with cookies, request headers, and form contents removed.

3. Purposes of Use

We use personal information for the following purposes:

• Operating the Platform: to provide, maintain, secure, and improve the Platform;
• Publishing Listings: to display your Listings so that other Users may find and view them;
• Facilitating contact: to enable buyers and sellers to contact one another using the details provided in Listings;
• Verification: to review resident verification and business account requests;
• Paid Services: to process, record, and administer payments for Paid Services and display advertising, and to provide advertisers with aggregate impression and click statistics;
• Moderation and safety: to review content for compliance with our Terms of Service and Acceptable Use Policy, to investigate reports, and to prevent fraud, spam, and abuse;
• Communications: to send you information concerning your account, including verification emails, security notices, and service updates;
• Support: to respond to your inquiries and to diagnose and correct problems with the Platform; and
• Legal compliance: to comply with applicable laws and to establish, exercise, or defend legal claims.

4. Automated Moderation

4.1 To protect the community, the text and images of Listings are analyzed by automated moderation services before or after publication. Uploaded images are reviewed by Sightengine, and Listing text and images are reviewed by OpenAI.

4.2 The results of automated moderation may cause a Listing to be held for review or declined. Listings held for review are assessed by a moderator. If you believe a moderation decision is incorrect, you may edit and resubmit the Listing or contact us.

5. Cookies and Browser Storage

5.1 PenderExchange uses only the cookies and browser storage that are necessary to provide a functional and secure Platform:

• Authentication cookies: session cookies that maintain your signed-in state. These are essential to the operation of the Platform and cannot be disabled while you use it.
• Session storage: used to avoid recording the same Listing view or advertisement impression more than once during a single browser session, and to complete password recovery.
• Local storage: used temporarily to complete a password recovery after you follow a reset link.

5.2 None of these values contains your Listing contact details. We do not use third-party advertising networks, tracking pixels, or analytics services that track you across other websites, and your browsing activity on the Platform is not shared with advertisers.

6. Disclosure of Personal Information

We disclose personal information only in the following circumstances:

• Public Listing information: the title, description, price, category, and images of a Listing, the seller's display name, and any phone number the seller has expressly chosen to make public are visible to visitors. Seller email addresses and private phone numbers are not included in public Listing data; they may be revealed to signed-in Users through the contact feature, and each such reveal is recorded for abuse prevention.
• Public member profiles: each member's display name, the month and year in which the member joined, the number of active Listings, and any verification badges are visible to visitors.
• Administration: authorized administrators and moderators may access personal information to the extent necessary for content moderation, enforcement of our Terms of Service, and the resolution of disputes and technical issues.
• Service providers: we engage third parties to operate the Platform, namely Vercel (hosting and deployment), Supabase (authentication, database, and file storage), Stripe (payment processing), Cloudflare Turnstile (protection against automated abuse), Sightengine and OpenAI (automated content moderation), Sentry (error diagnostics), Google (sign-in, if you choose it), and GitHub (tracking the correction of reported problems; reporter email addresses are not included). These providers process personal information only as necessary to provide their services to us.
• Legal requirements: we may disclose personal information where required by Canadian law, regulation, court order, or other legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of our Users or the public.
• Business transactions: personal information may be disclosed in connection with a reorganization, sale, or other transfer of the Platform, subject to the protections described in this Privacy Policy and applicable law.

We do not sell, rent, or trade personal information to any third party for marketing or any other purpose.

7. Processing Outside Canada

Certain of our service providers are located outside Canada, including in the United States, and may store or process personal information in those jurisdictions. Personal information held outside Canada is subject to the laws of the jurisdiction in which it is held and may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction.

8. Retention

• Account data: account information is retained for as long as your account remains active. Deleting your account removes your profile, Listings, verification submissions, and associated Listing media. Direct advertising contact identifiers are removed from paid records that must be retained for payment reconciliation.
• Listing data: active Listings are displayed for their stated duration. Expired Listings remain available to their owner for renewal until the owner deletes the account or an administrator permanently removes the Listing.
• Deleted Listings: a Listing that you delete is removed from public view immediately and remains in our administrative records until it is permanently removed or the associated account is deleted.
• Security, billing, and moderation records: payment records, contact-reveal logs, reports, abuse-prevention records, and moderation decisions may be retained for longer periods where required for fraud prevention, dispute resolution, accounting, legal compliance, or platform safety.

9. Your Rights

Subject to applicable law, including PIPA and, where applicable, PIPEDA, you have the following rights with respect to your personal information:

• Access: you may request access to the personal information we hold about you.
• Correction: you may request the correction of any inaccurate or incomplete personal information. Most information may also be updated directly through your account settings.
• Withdrawal of consent: you may withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions. Withdrawal of consent may limit your ability to use certain features of the Platform.
• Deletion: you may request the deletion of your personal information. Upon verifying your request, we will delete or anonymize information that is no longer required, subject to legal, accounting, fraud-prevention, dispute-resolution, and platform-safety retention requirements.
• Complaints: if you believe that we have not handled your personal information in accordance with applicable law, you may raise the matter with the appropriate privacy regulator.

To exercise any of these rights, please contact us at support@penderexchange.ca. We will respond to each legitimate request within the period required by applicable law.

10. Safeguards

We maintain reasonable security arrangements to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal, and destruction, including:

• Authentication: sign-in and session management are provided through Supabase.
• Encrypted connections: all data transmitted between your browser and our servers is protected by HTTPS (TLS) encryption.
• Access controls: access to personal information is restricted to authorized personnel according to the requirements of their role.

No method of transmission over the Internet or of electronic storage is completely secure. While we cannot guarantee absolute security, we are committed to maintaining and improving our security practices.

11. Children's Privacy

The Platform is not intended for use by individuals under eighteen (18) years of age, and we do not knowingly collect personal information from such individuals. If we become aware that we have collected personal information from a person under eighteen (18) years of age, we will take steps to delete that information promptly. If you believe that a minor has provided personal information to us, please contact us at support@penderexchange.ca.

12. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we do so, we will revise the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after an amendment takes effect constitutes your acceptance of the amended Privacy Policy.

13. Contact and Complaints

Questions, concerns, and requests regarding this Privacy Policy or our handling of personal information may be directed to:

PenderExchange
Attention: Privacy Officer
Email: support@penderexchange.ca

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia or, where PIPEDA applies to the matter, the Office of the Privacy Commissioner of Canada. The applicable law and regulator depend on the circumstances.

Office of the Information and Privacy Commissioner for British Columbia
Website: www.oipc.bc.ca
Phone: 250-387-5629

Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca

14. Independence

PenderExchange is independently operated and is not affiliated with Saltspring Exchange.