Privacy Policy

1. Who we are and what this covers

Reffo ("Reffo", "we", "us") operates a referral platform for tradespeople at reffo.ca (the "Platform"). This policy explains what personal information we collect, why we collect it, how we use and disclose it, and the choices you have.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

2. Information we collect

Account and business information you give us. Your name, email address, password (stored only as a secure hash), business name, contact person, phone number, website, business description, the trades you work in, and optional business details such as project types, typical project size, years in business, and team size.

Referral and project information. When you submit a referral, we collect the details of the job, including its description, budget, timeline, and address, together with the name, email address, phone number, and address of the customer the referral concerns.

Information about your use of the Platform. Sign-in sessions, including IP address and browser user-agent, and a log of the transactional emails we send you (recipient, subject, template, and delivery status).

We do not collect payment card details. Commissions are currently settled outside the Platform.

3. Referring someone else's customer

This obligation is yours, and it matters.

A referral necessarily contains personal information about a third party: your customer. Before you submit a customer's details to the Platform, you must have that customer's consent to share their information with Reffo and with the Trade Partner who receives the referral, for the purpose of being contacted about the work.

By submitting a referral you confirm you have obtained that consent. We use customer information only to route the referral, allow the receiving Trade Partner to make contact, and administer any resulting commission.

4. Why we use your information

We use personal information to:

• create and secure your account and authenticate you;
• match referrals to a suitable Trade Partner and deliver them on an exclusive, one-to-one basis;
• send transactional email about referrals, account status, and security (for example verification and password-reset messages);
• calculate, invoice, and verify commission, and keep the records needed to do so;
• protect the Platform against fraud, abuse, and automated attacks, including rate-limiting sign-in and sign-up attempts;
• meet our legal and regulatory obligations.

5. Consent

We collect, use, and disclose personal information with your consent, which you give when you create an account, submit a referral, or otherwise use the Platform. You may withdraw consent at any time, subject to legal and contractual restrictions and on reasonable notice, by contacting us at the address in Section 11. Withdrawing consent may mean we can no longer provide the Platform to you. Withdrawal does not affect commission already accrued or records we are required to keep.

6. Who we share it with

Other users. When a referral is sent, the receiving Trade Partner sees the job details and the customer's contact information. Your business name and contact details are visible to users you are connected with on the Platform.

Service providers. We use third parties to run the Platform, and they process personal information on our behalf under contract:

• Supabase (database hosting, Canadian region) stores Platform data.
• Vercel (application hosting) serves the Platform and processes request data.
• Resend (email delivery) sends our transactional email.

Some providers may store or process information outside Canada, including in the United States. While it is outside Canada, that information is subject to the laws of the country where it is held and may be accessible to courts and law-enforcement or national-security authorities there.

Legal and business transfers. We may disclose personal information where required by law, to establish or defend a legal claim, or in connection with a sale or reorganization of the business, in which case it remains protected by a policy no less protective than this one.

We do not sell personal information, and we do not sell or rent our user lists.

7. How long we keep it

We keep account and referral records for as long as your account is active and afterwards for as long as needed to administer commission, enforce our Terms (including the non-circumvention protected period), resolve disputes, and meet legal or tax record-keeping obligations. When information is no longer needed for these purposes, we delete or anonymize it.

8. How we protect it

We use safeguards appropriate to the sensitivity of the information, including encryption in transit, hashed passwords, access controls that limit data to the users and administrators who need it, and rate-limiting on authentication. No system is perfectly secure, and we cannot guarantee absolute security.

9. Your rights

You may ask us to access the personal information we hold about you, to correct it if it is inaccurate or incomplete, or to delete your account. You may also ask how we handle your information and challenge our compliance with this policy. We will respond within the time limits set by PIPEDA and Alberta's PIPA. We may need to verify your identity before acting on a request.

Much of your information can be viewed and corrected directly in your Platform profile.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the Platform or by email, and the "last updated" date above will change.

11. Contact us

To ask a question, make an access or correction request, or raise a privacy concern, contact us at support@reffo.ca.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.