Privacy Policy

1. Who is responsible for your information

DealBot is operated by Technologies Dealbot inc., a company incorporated in Québec, Canada. The person in charge of the protection of personal information under Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) is Vincent Therrien. For any privacy question or request: [email protected].

2. What we collect

If you use DealBot without an account

• Your search queries and the location you provide for them (a city or region you type; we never access your device's GPS without asking).
• IP address and browser information (user agent), used solely for rate limiting and abuse prevention.

If you create an account

• Email address and a password (stored only as a cryptographic hash, which we cannot read).
• Search history and saved preferences (location, radius, language), so the features that depend on them work.
• Context you choose to share, like telling DealBot "I resell refurbished laptops" so it can tailor results.

If you use paid features (when available)

• Billing information is handled by a specialized payment processor. We never see or store full card numbers.
• Content you submit to Verify (URLs, item descriptions, or photos), processed to produce your verdict.

That's the full list. We don't collect contacts, precise geolocation, advertising identifiers, or anything from your device beyond what's described here.

3. Why we collect it

• To provide the Service: run your searches, remember your preferences, show your history, verify listings.
• To keep the Service usable: rate limiting, bot detection, and abuse prevention (this is what IP addresses are used for).
• To improve results: analyzing queries and result quality to make search and scoring better.
• To communicate with you: account emails (verification, important changes). No marketing emails without your consent.
• To bill you for paid plans, when they launch.

We don't use your personal information for any other purpose without telling you and, where required, obtaining your consent. We never sell personal information.

4. Cookies, local storage, and tracking

• We use browser storage for exactly two things: your theme preference (light/dark) and your session if you log in.
• We use no advertising cookies, no analytics trackers, and no third-party profiling of any kind. There is no cookie banner because there's nothing to consent to.
• Cloudflare Turnstile runs on some actions to tell humans from bots; it analyzes browser signals for that sole purpose, without tracking you across sites.

5. Who we share information with

Only service providers that DealBot needs to function, each receiving only what their role requires:

• Hosting and infrastructure providers: they store the data described above on our behalf.
• AI providers (such as Anthropic): your search query text is processed by AI models to understand what you're looking for. Queries sent for this purpose are not used by these providers to train their models under our agreements with them.
• OpenStreetMap Nominatim: when you type a location, your browser sends that location text (not your identity) to this geocoding service to convert it to coordinates.
• Cloudflare: bot protection, as described above.
• Email delivery provider: to send account emails to the address you gave us.
• Payment processor: for subscriptions, when they launch.

Beyond service providers, we disclose personal information only if the law requires it. The marketplaces we search never receive your identity; DealBot queries them itself.

6. Where your information is stored

Your information may be stored or processed outside Québec and outside Canada, in particular by infrastructure, AI, and bot-protection providers operating in the United States. Before communicating personal information outside Québec, we assess that it will receive adequate protection, including through contractual safeguards with these providers, in accordance with Law 25. By using DealBot you are informed that such cross-border processing occurs.

7. How long we keep it

• Account data and search history: kept while your account exists; deleted when you delete your account.
• Queries from users without an account: kept without any link to your identity beyond the technical data described above, and used in aggregate to improve the Service.
• Rate-limiting records (IP, user agent): kept only as long as needed for abuse prevention, then deleted.
• Verify submissions (URLs, descriptions, photos): used to produce your verdict; AI-inferred listings are not added to our listing database.

Once a retention purpose is fulfilled, information is destroyed or anonymized.

8. Your rights

Under Québec's Law 25 and applicable Canadian privacy law (PIPEDA), you have the right to:

• Access the personal information we hold about you;
• Rectify information that is inaccurate or incomplete;
• Delete: deleting your account removes your personal information; you can also ask us to cease dissemination of specific information;
• Withdraw consent to optional uses at any time;
• Portability: receive computerized personal information you provided to us in a structured, commonly used technological format.

To exercise any of these rights, email [email protected]. We respond within 30 days. If you're not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

9. Security and incident response

We protect personal information with measures proportionate to its sensitivity: encryption in transit (HTTPS everywhere), hashed passwords, access controls, and minimal data collection in the first place. The best-protected data is data we never collected.

If a confidentiality incident occurs that presents a risk of serious injury, we will notify the Commission d'accès à l'information and the affected persons, as Law 25 requires, and take reasonable measures to reduce the risk of harm.

10. Children

DealBot is not directed at children. We do not knowingly collect personal information from anyone under 14 without the consent of a parent or guardian, as required in Québec. If you believe a child has provided us personal information, contact us and we will delete it.

11. Automated processing and AI

DealBot uses automated systems, including AI models, to interpret your searches, filter and group listings, and compute deal scores. These systems evaluate listings and markets; they are not used to make decisions about you that produce legal or similarly significant effects. If that ever changes, we will inform you as Law 25 requires, and you will be able to ask how the decision was made and have it reviewed by a person.

12. Changes to this policy

If we change what we collect or how we use it, we'll update this page and revise the effective date above. For significant changes affecting account holders, we'll notify you by email before they take effect.

Une version française de cette politique peut être obtenue sur demande à [email protected].