Privacy policy

MyMarkt at mymarkt.ca runs a marketplace where buyers describe what they want and sellers list what they have, and AI search agents match the two. For privacy law purposes we are the organization accountable for the personal information in the app (the "data controller" under the GDPR). Questions or requests go to privacy@mymarkt.ca.

• Account information — your email address, password (stored only as a salted hash by our authentication provider), your display name, and, if you sign in with Google, the basic profile details Google returns.
• Phone number — collected for verification. We send a one-time code by SMS and store the number plus a hashed copy of the code. Verification exists to keep scammers off the platform.
• Listings — titles, descriptions, categories, condition, prices and photos you upload.
• Asks and hunts — the text of what you're looking for, plus the structured details our AI derives from it (item, category, brand, specs, budget) and the duration you choose.
• Messages and offers — the content of conversations with a matched counterparty, offer amounts, and their status.
• Approximate location — a coarse latitude and longitude, rounded to roughly a one-kilometre grid before it is stored, plus the city or neighbourhood name. We never store or display a street address or precise coordinates.
• Trust and safety records — ratings and comments after a completed deal, blocks, and reports you file about other users.
• Technical data — basic logs our hosting and database providers generate to keep the service running and secure.

We do not collect payment card details, government identification, or precise location history. Please don't put sensitive personal information (health details, financial account numbers, identity documents) into listings or messages.

• Matching — comparing your ask against active listings, and each new listing against active hunts, so both sides find each other. Approximate location is used to sort and label results by distance.
• Notifications — telling you when a match is found, when someone messages you or sends an offer, and when a hunt is about to expire. These arrive in the app and by email.
• Running your account — signing you in, showing your hunts, listings and deals, and displaying your rating and completed-deal count to people you may transact with.
• Trust and safety — phone verification, investigating reports, enforcing blocks, and removing listings or accounts that break our terms.
• Improving the service — aggregate, non-identifying analysis of how matching performs.

Under PIPEDA we rely on your consent, which you give when you create an account and can withdraw by deleting it. Under the GDPR our legal bases are: performance of a contract (the marketplace you signed up for), our legitimate interests (fraud prevention, safety, service improvement), and consent for optional things like device location.

Matching is done with the help of a third-party AI model. When you submit an ask, its text is sent to that model to be turned into structured search criteria. When we compare a candidate listing to a hunt, the listing text and the ask are sent together so the model can score how well they fit and explain the match in plain language. If you use "write it for me", your rough notes are sent to the model to draft a listing you then edit.

• Only ask text, listing text and derived criteria are sent — never your email, phone number, precise location, or private message contents.
• To limit both cost and exposure, we filter candidates cheaply by category and keyword first and score only a small shortlist with AI.
• Our AI provider processes this data on our instructions to return a result. It is not permitted to use it to train its models.
• A match score above 70 creates a match. Nothing about you is decided by AI beyond whether two listings are shown to each other — no pricing, eligibility, or account decisions are automated, and a human reviews any report before an account is banned.

• Your listings are public to signed-in users, along with your display name, rating, completed-deal count, and an approximate distance or neighbourhood.
• Your hunts appear in the public "Wanted" feed anonymized — the item and general area, never your name or contact details.
• Messages and offers are visible only to you and the one other person in that conversation, enforced by database-level access rules.
• Reports you file are visible to us, not to the person you reported.

We never sell your personal information, and we never rent, trade or share it for anyone else's advertising. We share data only with providers who run parts of the service for us, under contract and only for that purpose: our cloud hosting, database, authentication and file storage provider; our AI model provider (as described above); our SMS provider for verification codes; and our email provider for notifications. We will also disclose information where the law requires it, or where it is necessary to protect someone's safety or our legal rights.

Some of these providers operate outside Canada, including in the United States and the European Union. That means your information may be processed in another country and be subject to its laws and lawful access requests. For transfers out of the UK/EEA we rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

• Account and profile — for as long as your account is open.
• Listings — until you remove them or delete your account. Listings marked sold or removed stay hidden but are retained while the account exists.
• Hunts — until they expire or you cancel them, and are deleted with your account.
• Messages and offers — for the life of the conversation, so both sides keep their record of the deal; deleted with your account.
• Phone verification codes — expire after ten minutes and are stored only as a hash.
• Ratings — kept while both accounts exist, because they protect other users.
• Reports and safety records — retained after deletion where we need them to keep a banned user off the platform or to meet a legal obligation.

You can delete your account yourself at any time from Settings. Deletion removes your profile, your listings and their photos, your hunts, your messages, and your sign-in credentials. It cannot be undone. Some records are retained as described in section 7.

You also have the right to ask what personal information we hold about you and to get a copy, to have inaccurate information corrected, to withdraw consent, and to complain. If the GDPR applies to you, you additionally have rights to erasure, restriction, data portability, to object to processing based on legitimate interests, and to lodge a complaint with your local supervisory authority. In Canada you can complain to the Office of the Privacy Commissioner of Canada.

Email privacy@mymarkt.ca and we will respond within 30 days.

Access to your data is enforced at the database level, so one user cannot read another user's messages, offers or private records. Listing photos are held in private storage and served through short-lived signed links. Passwords are hashed, verification codes are hashed and rate-limited, and coordinates are coarsened before they are stored. No system is perfectly secure, so please use a strong, unique password.

MyMarkt is not for people under 18. We do not knowingly collect information from children; if we learn we have, we delete it.

If we change this policy we will update the date at the top, and for significant changes we will notify you in the app or by email before they take effect.