Privacy policy
Last updated: [DATE]
This policy explains how koupe ([LEGAL ENTITY NAME], Montréal, Québec) collects, uses, discloses and protects personal information when you use the koupe website, admin app, booking pages and related services. It is written to comply with Canada's PIPEDA and Québec's Act respecting the protection of personal information in the private sector (Law 25).
1. Who we are and our roles
When a shop (barbershop, salon or similar business) uses koupe to manage its bookings, the shop is the organization accountable for its clients' personal information and koupe acts as its service provider. When you create a koupe account or visit koupe.ca, koupe is accountable for your information.
[TO BE REVIEWED BY COUNSEL] — confirm controller / service-provider characterisation and data-processing agreement terms with shops.
2. Privacy officer
The person in charge of the protection of personal information at koupe is [PRIVACY OFFICER NAME], [TITLE]. Contact: privacy@koupe.ca · [ADDRESS], Montréal, QC. [TO BE REVIEWED BY COUNSEL]
3. What we collect
Clients of shops: name, phone, email, preferred language, appointment history, notes entered by the shop, payment-method tokens (held by Stripe), and consent records.
Shop staff and owners: name, email, schedules, role, calendar OAuth tokens (if you connect Google or Microsoft), billing details (held by Stripe).
Technical: server logs with IP address and user agent for security, with personal information redacted. The booking page sets no tracking cookies.
4. Why we use it
To provide bookings, confirmations and reminders; to process deposits and payments; to sync calendars you connect; to issue receipts with applicable taxes; to provide support; to meet legal obligations; and, only with express consent, to send marketing messages.
We do not sell personal information and we do not operate a marketplace that profiles clients across shops.
5. Consent
Transactional messages (confirmations, reminders, receipts) are sent on the basis of the booking you requested. Marketing messages require express consent per channel; you can withdraw consent at any time by replying STOP / ARRET or using the unsubscribe link. We keep evidence of consent (what was shown, when, from where) as required by CASL and Law 25.
6. Service providers and transfers outside Québec
We use Stripe (payments), Twilio (SMS), an email provider, Hostinger (website and application hosting, on servers located in the United States) and, if you connect them, Google and Microsoft calendar services. Each is bound by a written agreement. Personal information is stored and processed outside Québec, including in the United States; a privacy impact assessment under section 17 of Law 25 has been conducted for these transfers and is available on request. [TO BE REVIEWED BY COUNSEL] — list current providers and regions.
7. Security
Encryption in transit and at rest, field-level encryption of client contact details, tenant isolation at the database level, role-based access, audit logs without personal information, and a confidentiality-incident register and response procedure.
8. Retention
Client records are kept until erasure is requested or after [3] years of inactivity; financial records for 7 years as required by tax law (anonymised after erasure); consent records at least 3 years after the relationship ends; audit logs 24 months. [TO BE REVIEWED BY COUNSEL]
9. Your rights
You may request access to, correction of, or portability of your personal information, and request erasure, by contacting the shop you booked with or privacy@koupe.ca. We respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
10. Changes
We will post changes here and, for material changes, notify shops by email. [TO BE REVIEWED BY COUNSEL]