Privacy Policy

UpChansa is a bilingual classifieds and auction marketplace operated in Quebec, Canada. We connect buyers and sellers for local, in-person transactions. UpChansa (“we,” “us,” or “UpChansa”) is the organization responsible for the personal information we collect under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Privacy Officer: support@upchansa.ca

We collect only what we need to operate the platform.

We use personal information to: operate and improve the platform; authenticate your account and keep it secure; process platform fees via Stripe; send you transactional notifications (bid outbid, offer received, sale confirmed, etc.); prevent fraud and abuse; comply with legal obligations; and — if you have consented — measure platform usage with analytics.

Consent. By creating an account and checking the “I agree” box at registration, you consent to the collection and use described above. You may withdraw consent at any time by deleting your account (see Section 6).

We never sell your personal information.

We do not sell or trade personal information. We share data only with the third-party service providers who help us operate UpChansa, and only to the extent necessary:

• Stripe — processes platform fees. Stripe is PCI-DSS certified and governed by its own privacy policy.
• Cloud storage provider — stores listing and profile images you upload.
• Hosting provider — runs the application servers and database.
• Transactional email provider — delivers transactional emails (verification, password reset, notifications).
• Caching provider — stores ephemeral data such as session tokens and rate-limit counters.

An up-to-date list of our service providers is available on request from our Privacy Officer.

Some of these providers may process data outside Quebec or Canada (for example, in the United States). Where this occurs, we ensure they are contractually bound to protect your information to a standard equivalent to Quebec and Canadian law.

Information you make public. Your display name, profile photo, city, and the content of your listings and auctions are visible to other platform users and, depending on your settings, to the general public. Public listings and profiles may be indexed by external search engines (such as Google) and appear in search results outside UpChansa. Choose carefully what you share.

We use four categories of cookies:

• Strictly necessary — authentication session cookies required to keep you logged in, security cookies, and a cookie remembering your language choice. These are always on; they are not optional.
• First-party attribution — these are not advertising cookies, but they are not strictly necessary either, so we describe them separately rather than hide them under the heading above. If you arrive through an invitation or a member’s shared link, we store a short referral code for 30 days so the person who referred you can be credited if you sign up. If you arrive from one of our own advertisements or posts, we store the campaign label from that link for 30 days so we can tell which campaigns bring real members. Both are set and read only by us, contain no personal information, are never shared with anyone, and are never used to build an advertising profile or to follow you across other websites. You can remove them at any time by clearing your browser cookies.
• Analytics — helps us understand which pages and listings are used, so we can improve them. We do not currently use any analytics cookies.
• Advertising & marketing — builds an audience profile so we can show UpChansa advertisements to you on other platforms, and measure whether those advertisements worked. We do not currently use any advertising cookies.

Advertising and profiling technologies are deactivated by default. We do not identify, locate, or profile you for advertising purposes unless you activate these functions yourself. None are currently in use, so there is nothing to activate. If we introduce them, you will be asked for your consent first and given a control to change your choice at any time.

We also use Vercel Web Analytics, which is cookieless and does not identify you, so it requires no consent.

We keep your personal information for as long as your account is active.

Requesting deletion. You may request account deletion in your account settings. A 30-day grace period applies — you can cancel the deletion during this window. After 30 days, your account is anonymized: your name, email, phone, bio, and profile photo are removed from your profile and from everything other members can see, your listings are unpublished, and your saved searches and favourites are deleted.

What we keep after that, and why. Anonymizing your profile does not erase every trace of the account. We retain a separate, restricted record containing the email address, name, phone number and sign-up IP address held at the moment of deletion. It is kept for two purposes only: to recognize when a closed account is re-opened on the same address (we flag it for a human to look at — it never blocks anyone), and to be able to respond to a lawful demand from law enforcement or a court. This record is not visible to other members, is never used to contact you, is never sold or shared for any other reason, and is accessible only to UpChansa administrators, with every access logged.

We keep it for at least five years from the date of deletion, after which it is reviewed and disposed of by hand — we do not delete it on an automatic timer, so disposal may happen some time after that five-year mark. When we dispose of it we normally erase the address, name, phone number and IP address while keeping only a one-way cryptographic fingerprint of the address, which cannot be read back or turned into an address and serves solely to keep flagging re-registrations. You can ask us at any time to dispose of this record sooner, and we will do so unless we are required to keep it — see “Your Rights” below for how to reach us.

Retention periods. As a general schedule:

• Account and profile data — kept while your account is active; anonymized after deletion (following the 30-day grace period).
• Post-deletion identity record — at least five years, then reviewed and disposed of manually (see above).
• Financial records and platform-fee transactions — retained for the periods required by applicable tax and accounting laws (typically 7 years).
• Messages — retained for the life of the conversation, as they also belong to the other participant’s records.
• Administrative audit logs — kept for as long as necessary for platform integrity and legal compliance, then deleted or anonymized.
• Technical and security logs — retained for up to 90 days.
• Messages you send us through the contact form — kept as support history; if you delete your account, your name and email address on them are erased.

Reviews you left for other users remain after account deletion, attributed to “Deleted user.”

Under Quebec’s Law 25 and Canada’s PIPEDA you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Erasure — request deletion of your account and personal data (subject to legal retention requirements above).
• Withdraw consent — stop us from using your information for a particular purpose, subject to legal or contractual obligations.
• Portability — under Law 25, receive your personal information in a structured, commonly used format.
• De-indexing — under Law 25, request that we cease disseminating your personal information, or de-index any hyperlink attached to your name, where dissemination causes you injury or contravenes the law.
• Complaint — lodge a complaint with a supervisory authority (Section 12).

To exercise any of these rights, use your account settings page or email our Privacy Officer at support@upchansa.ca. We will respond within 30 days.

Some of our service providers operate in the United States and other countries outside Quebec and Canada. When personal information is transferred outside Canada, we take steps to ensure it receives comparable protection, including through contractual safeguards. By using UpChansa, you acknowledge that your information may be processed outside your province or country of residence.

We apply technical and organizational measures to protect your personal information: passwords are stored as one-way hashes (bcrypt), access to production data is restricted to authorized personnel, all administrative actions are logged in an audit trail, and data is transmitted over encrypted connections (HTTPS/TLS).

No security system is perfectly secure. In the event of a breach that creates a serious risk of harm, we will notify affected users and the relevant regulatory authority as required by Law 25.

To protect the platform, some safeguards operate automatically: registration may be refused for disposable or duplicate email addresses; rate limits may temporarily restrict repeated actions; and automated risk indicators may flag a transaction or account for review. Enforcement decisions with significant consequences — such as suspending an account or revoking a reward — are made by a human, with automated signals serving only as input.

If a decision based exclusively on automated processing significantly affects you, you may request human review and submit observations by contacting our Privacy Officer at support@upchansa.ca.

UpChansa is intended for adults. You must be at least 18 years old (or the age of majority in your jurisdiction, whichever is higher) to create an account. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us at support@upchansa.ca and we will delete it promptly.

If you are not satisfied with how we have handled your personal information, you may first contact our Privacy Officer at support@upchansa.ca. If we are unable to resolve the matter, you may escalate to:

• Commission d’accès à l’information du Québec (CAI) — the Quebec privacy regulator responsible for enforcing Law 25. cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada (OPC) — the federal privacy regulator responsible for PIPEDA. priv.gc.ca

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. We will notify you of material changes via a platform notification or email before they take effect. Continued use of UpChansa after a change takes effect constitutes your acceptance.

Privacy Officer: support@upchansa.ca

See also: Terms of Service