Privacy Policy

MyCivvy (“MyCivvy”, “we”, “our”) operates a multi-city civic directory connecting residents with local events, businesses, nonprofits, and programs. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have under Canadian privacy law.

This policy applies to your use of mycivvy.ca and all city subdomains (e.g. leduc.mycivvy.ca).

We collect the following categories of personal information:

• Account information. When you create an account we collect your name (optional), email address, and a hashed password (or authentication provider identifier if you sign in with Google).
• Profile and organization details. If you create an organization profile we collect what you enter — business or nonprofit name, description, website, phone, email, address, business hours, social links, logo, and cover image.
• Listings. Content you submit (titles, descriptions, dates, locations, contact details, images) is stored and displayed on the public portal once approved by a city admin.
• Payment information. Featured-listing boost payments are processed by Stripe. We never see or store your card details — we receive only a payment confirmation token, the amount paid, and the listing being boosted.
• Usage information. Standard server logs (IP address, user agent, requested URL, response status) and aggregated analytics used to keep the service running and improve it.

We use personal information only for purposes that you would reasonably expect, including:

• Operating your account and providing access to dashboard features.
• Displaying approved listings and organization profiles on the public portal.
• Sending transactional emails about your listings (submission confirmation, approval, rejection feedback) and your organization (verification status).
• Processing featured-listing boost payments and recording boost duration.
• Detecting abuse, enforcing our Terms of Service, and meeting legal obligations.

We share personal information only in the following limited circumstances:

• Public display. Information you submit as part of a listing or organization profile is intentionally made public. This is the purpose of the directory.
• Service providers. We use Supabase (database and authentication, hosted in Canada), Cloudflare R2 (image storage), Vercel (application hosting), Resend (transactional email), and Stripe (payments). Each processes your data only as needed to provide their service to us.
• City administrators. City admins can see the email address you submitted a listing under so they can contact you about moderation decisions.
• Legal requirements. We may disclose information when required by Canadian law, court order, or to protect the rights and safety of MyCivvy, our users, or the public.

We do not sell your personal information.

We retain account, profile, and listing data for as long as your account is active. When you close your account we delete or anonymize personal data within 30 days, except where retention is required for legal, accounting, or fraud-prevention purposes (typically up to 7 years for payment records).

Server logs are retained for up to 90 days. Aggregated, non-identifying analytics may be retained indefinitely.

MyCivvy is operated under Canadian privacy law — the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, as it comes into force, the Consumer Privacy Protection Act (CPPA). You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Withdraw consent for processing (subject to legal and contractual restrictions).
• Request deletion of your account and associated personal information.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, email hello@mycivvy.ca from the address associated with your account.

MyCivvy uses a small number of cookies:

• Authentication cookies set by Supabase that keep you signed in.
• Functional cookies remembering UI preferences (e.g. last selected city) where applicable.

We do not use advertising cookies or third-party tracking pixels. You can clear cookies at any time in your browser settings — doing so will sign you out of MyCivvy.

MyCivvy is not directed to children under 13. If you believe a child has created an account, please contact us and we will remove it.

We may update this policy as MyCivvy evolves. Material changes will be announced by email to active accounts and through a notice on the homepage at least 30 days before they take effect.

Questions, requests, or concerns? Email hello@mycivvy.ca.