Privacy Policy

Last updated: May 5, 2026

Note: This is a draft policy. Review with legal counsel before public launch.

1. Who we are

Shelfbee is a Canadian price comparison service, operated as a sole proprietorship registered in Ontario, Canada. This policy covers our website at shelfbee.ca and any related services. Questions about this policy can be sent to privacy@shelfbee.ca.

2. What we collect

We collect only what we need to make Shelfbee work for you, and we say so up front.

Without an account

  • Postal code — to find stores near you. We use the first three characters (FSA) for analytics; full postal codes go only to Google Maps for geocoding.
  • Search queries — what you type, plus a hashed version of your IP address (we never store raw IPs) and a hashed user-agent string. Used to improve which products we track.
  • Standard server logs — request paths and response codes, retained for 30 days for security and debugging.

With an account

  • Email address — for sign-in and account-related messages.
  • Watchlist + shopping list items — products you save.
  • Email-marketing consent — only if you explicitly opt in to price-drop alerts or our weekly digest. We log when, how, and from what IP you consented (CASL requirement).

3. How we use it

  • To serve search results ranked by real cost (price + distance + time).
  • To send you account-related emails (password resets, security alerts).
  • To send you marketing emails (price drops, weekly digest) only if you opted in. You can unsubscribe with one click in any of these messages.
  • To improve which products we track. The most-frequent zero-result queries become candidate canonicals for our weekly scrape.

4. Data residency

All Shelfbee user data is stored in Canada. Our database (Supabase) is hosted in the ca-central-1 region (Montreal). We do not replicate user data outside Canada. Some operational tools (error tracking, email delivery) may be hosted by US-based providers under standard GDPR/PIPEDA-compliant contracts; their access is limited to the data they need.

5. How long we keep it

  • Search queries: 90 days, then deleted automatically.
  • User actions (clicks, saves): 90 days.
  • Account data + watchlist: until you delete your account.
  • Marketing-consent logs: 3 years after your last consent change (CASL requirement).
  • Server logs: 30 days.

6. Your rights (PIPEDA, Quebec Law 25)

Canadian privacy law gives you several rights. We support all of them at no cost.

  • Right to access: request a copy of all data we hold about you. Send a request from your account page or to privacy@shelfbee.ca and we'll respond within 30 days.
  • Right to correction: if anything we hold is wrong, tell us and we'll fix it.
  • Right to deletion: close your account and we'll anonymize your records (we retain anonymized data for our published price-history dataset, but it can no longer be linked back to you).
  • Right to portability: download your saved data in a machine-readable format.
  • Right to withdraw consent: any time, for any reason.

Quebec residents under Law 25 also have the right to be informed when an automated decision is made about them. Shelfbee does not currently make any automated decisions affecting users.

7. Cookies and analytics

Shelfbee uses essential cookies to keep you signed in. We also ask for your consent before loading any third-party analytics. You can change your preference any time from the cookie banner footer link.

8. Children

Shelfbee is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe we have, contact us and we'll delete it.

9. Security

We use industry-standard encryption in transit (HTTPS) and at rest. Passwords are hashed via Supabase Auth. We will notify affected users within 72 hours of becoming aware of any breach involving personal data, in line with PIPEDA breach-reporting requirements.

10. Changes to this policy

We may update this policy occasionally. Material changes will be announced at the top of this page and, for users with marketing-email opt-in, sent by email at least 30 days before they take effect.

11. Contact

Privacy questions or requests: privacy@shelfbee.ca. You can also lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or with Quebec's Commission d'accès à l'information at cai.gouv.qc.ca.