Privacy Policy

1. Introduction

PenderExchange ("we," "us," or "our") is a community classifieds marketplace serving North and South Pender Island, British Columbia, Canada. We are committed to protecting the privacy and personal information of our users in accordance with British Columbia's Personal Information Protection Act (PIPA). The federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply to personal information handled in interprovincial or international commercial activities.

This Privacy Policy explains what personal information we collect, how we use and protect it, and your rights regarding that information. By using PenderExchange, you agree to the practices described in this policy.

2. Information We Collect

Account Information

When you create an account, we collect:

• Name — your display name as shown on your profile and listings
• Email address — used for authentication, account recovery, and platform communications
• Phone number (optional) — if you choose to provide one for contact purposes

Listing Content

When you create a listing, we collect and store:

• Listing titles and descriptions
• Images you upload
• Pricing and category information
• Contact details you choose to include in your listing

Payments, Verification, and Abuse Reports

When you use paid or trust-related features, we may collect and store:

• Payment workflow records such as listing or advertising payment status, Stripe identifiers, and renewal or expiry dates
• Business or resident verification submissions that you choose to send for review
• Reports, moderation notes, support inquiries, and records of when a signed-in user reveals a seller's contact email

Security and Usage Data

We collect limited technical and activity information needed to operate and protect the platform, including:

• Listing view counts and advertising impression or click events
• IP addresses used for rate limiting, abuse prevention, and contact-reveal audit records
• Technical request and security information processed by our hosting, authentication, bot-protection, payment, and image-moderation providers

Cookies and Browser Storage

We use cookies and browser storage for essential platform functionality:

• Session cookies — to keep you signed in and manage your authentication state
• Session storage — to avoid counting the same listing or advertisement repeatedly during one browser session
• Local storage — temporarily used to complete a password-recovery flow after you follow a reset link

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Providing the service — operating and maintaining the PenderExchange marketplace
• Displaying listings — publishing your classifieds listings so other users can find and view them
• Facilitating connections — enabling buyers and sellers to contact each other through the information provided in listings
• Platform moderation — reviewing content to ensure compliance with our terms of use and community standards
• Account communications — sending you important information about your account, such as verification emails, security notices, and service updates

4. Cookies and Tracking

PenderExchange uses a minimal approach to cookies and tracking technologies. We only use what is necessary to provide a functional and secure experience.

• Authentication cookies — We use session cookies to manage your login state. These are essential for the platform to function and cannot be disabled while using the service.
• Security, moderation, and payment services — Cloudflare Turnstile may process technical information to help distinguish humans from automated abuse, Sightengine processes uploaded image content for moderation, and Stripe processes payment-related information when you purchase paid platform services.
• Browser storage — Session storage prevents repeated local view or impression events during one browser session. Local storage is used temporarily to complete password recovery. These values do not contain your listing contact details.
• No third-party advertising trackers — We do not use any third-party advertising networks, tracking pixels, or analytics services that track you across other websites. Your browsing activity on PenderExchange is not shared with advertisers.

5. Information Sharing

We share personal information only in the following limited circumstances:

• Public listing information — When you create a listing, listing content such as title, description, price, category, images, seller display name, and any phone number you explicitly choose to make public may be visible to visitors. Seller email addresses and private phone numbers are not shown in public listing data; contact details may be revealed to signed-in users through the contact feature and logged for abuse prevention.
• Platform administration — Authorized administrators may access user information as necessary for content moderation, enforcing our terms of use, and resolving disputes or technical issues.
• Legal requirements — We may disclose personal information if required to do so by Canadian law, regulation, court order, or other legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of our users or the public.
• Service providers — We use third-party providers to operate the site, including Vercel for hosting and deployment, Supabase for authentication/database/storage, Stripe for payments, Cloudflare Turnstile for bot protection, and Sightengine for uploaded-image moderation. These providers process information only as needed to provide their services to us.

We do not sell, rent, or trade your personal information to third parties for marketing or any other purpose.

6. Data Retention

• Account data — Your account information is retained while your account is active. Account deletion removes the profile, listings, verification submissions, and associated listing media. Direct advertising contact identifiers are removed from paid records that must remain for payment reconciliation.
• Listing data — Active listings are displayed on the platform for their listed duration. Expired listings remain available to their owner for renewal until the owner deletes the account or an administrator permanently removes the listing.
• Deleted listings — When you delete a listing, it is soft-deleted (removed from public view immediately). It remains in the administrative system until it is permanently removed or the account is deleted.
• Security, billing, and moderation records — Payment records, contact reveal logs, reports, abuse-prevention records, and moderation decisions may be retained for longer where needed for fraud prevention, dispute handling, accounting, legal compliance, or platform safety.

7. Your Privacy Rights

Subject to applicable law, including British Columbia's PIPA and, where applicable, PIPEDA, you may have the following rights regarding your personal information:

• Right to access — You may request access to the personal information we hold about you. We will respond within the period required by applicable law.
• Right to correction — You may request that we correct any inaccurate or incomplete personal information. You can also update most of your information directly through your account settings.
• Right to withdraw consent — You may withdraw your consent for us to collect, use, or disclose your personal information at any time, subject to legal or contractual obligations. Withdrawing consent may affect your ability to use certain features of the platform.
• Right to request deletion — You may request that we delete your personal information. After verifying the request, we will delete or anonymize information that is no longer required, subject to legal, accounting, fraud-prevention, dispute, and platform-safety retention needs.
• Right to file a complaint — If you believe that we have not handled your personal information in accordance with applicable law, you may raise the concern with the appropriate privacy regulator.

To exercise any of these rights, please contact us at support@penderexchange.ca. We will respond to legitimate requests within the period required by applicable law.

8. Data Security

We take reasonable measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Authentication — User authentication is managed through Supabase, a trusted platform that provides secure sign-in and session management.
• Encrypted connections — All data transmitted between your browser and our servers is protected using HTTPS (TLS/SSL) encryption.
• Access controls — Access to personal information is restricted to authorized administrators who require it for platform operations.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining and improving our security practices.

9. Children's Privacy

PenderExchange is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@penderexchange.ca.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of PenderExchange after any changes to this policy constitutes your acceptance of the updated terms.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at:

PenderExchange
Privacy contact: Privacy Officer
Email: support@penderexchange.ca

If you are not satisfied with our response to your privacy concern, you may contact the Office of the Information and Privacy Commissioner for British Columbia. If PIPEDA applies to the matter, you may instead need to contact the Office of the Privacy Commissioner of Canada. Which law and regulator applies depends on the circumstances.

Office of the Information and Privacy Commissioner for British Columbia
Website: www.oipc.bc.ca
Phone: 250-387-5629

Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca

12. Independence

PenderExchange is independently operated and is not affiliated with Saltspring Exchange.