Privacy policy

Who is responsible

[Legal company name], 80 Atlantic Avenue, Toronto, ON M6K 1X9, Canada, is responsible for the personal information described here. Our person in charge of the protection of personal information is [name, title]. Contact: hello@bestlocal.ca.

Visitors

Browsing BestLocal sets no tracking or advertising cookies. We count page views and clicks (calls, website visits) without cookies or IP addresses: we keep the page, the time, the device type and, if you came from an AI assistant or search engine, which one.

Searches are logged as cleaned text, without IP addresses, cookies or locations, to improve results. A postal code you search for is sent to Mapbox to find it, and isn't stored. “Use my location” is rounded to about 1 km and used only for that search.

To stop abuse, we count requests per visitor with an identifier made from your IP address that changes every day and can't be turned back into the address. These counts are deleted after a day.

Reviewers

To post a review, you give your name, your email and the review. We email you a code to confirm the address. Your first name and last initial are published with the review; your email is never published or shown to the business.

Each review is checked by automated rules and by an AI model (Anthropic's Claude), and sometimes by staff. We keep each decision and the reason. Unconfirmed drafts are deleted after a day. You can edit or delete a published review from the private link in your emails.

People who send inquiries

An inquiry (your name, email, phone if you give it, and your message) is sent to the business you chose, which may contact you. We keep it so the business can answer and so we can measure response times, and delete it after 18 months.

Business owners

For an owner account we keep your name, email and password (stored only as a secure hash by our login provider), the businesses you manage, and what you send us to qualify: registry details, licences, insurance documents, photos and articles. Documents are stored privately and seen only by staff.

Payments are handled by Stripe; we never see or store full card numbers. We keep a record of subscriptions and invoices as tax law requires.

Signed-in pages use essential cookies to keep you logged in. They aren't used for advertising.

Emails and CASL

We send transactional emails you need (codes, receipts, inquiry and review notices, reminders about your listing). We send commercial messages only with consent or where Canada's Anti-Spam Legislation (CASL) allows it, for example an invitation to a business whose address is published and relevant to its listing. Every commercial email identifies BestLocal, gives our mailing address, and has a working unsubscribe link that we honour within 10 business days.

Who processes information for us

We use these service providers, under contracts that limit them to providing their service: Supabase (database, login and file storage; Canada), Vercel (hosting; United States and elsewhere), Stripe (payments), Resend (email delivery), Mapbox (maps and address lookup), Cloudflare Turnstile (spam protection on forms), Anthropic (checking reviews and drafting articles that owners approve) and, when enabled, Sentry (error reports, with personal details removed).

Some of these providers process information outside Quebec and Canada, mainly in the United States, where it may be accessible to authorities under local law. We assess these transfers as Quebec's Law 25 requires.

We don't sell personal information, and we don't share it for advertising.

How long we keep it

Unconfirmed review drafts: 1 day. Abuse-prevention counts: 1 day. Inquiries: 18 months. Published reviews: while published, or until you delete them. Owner accounts and verification records: while the account is open, then as long as tax and legal obligations require (generally 6 years for billing records). Emails we've sent: a log of what was sent and when, kept for account history.

Your rights

You can ask to see the personal information we hold about you, correct it, or have it deleted, and you can withdraw consent to optional uses. In Quebec you can also ask for your information in a structured, commonly used format, and ask us to stop disseminating it. Write to hello@bestlocal.ca; we answer within 30 days.

If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Security and incidents

Access to personal information is limited to the staff and systems that need it, data is encrypted in transit, and every table in our database is protected by access rules. If an incident creates a risk of serious harm, we'll notify the people affected and the regulators, as the law requires.

Changes

We'll update the date at the top when this policy changes, and email account holders about important changes.