Privacy Policy

AfroVendors ("we," "us," or "our") operates afrovendors.ca, a marketplace connecting customers with African-owned businesses in Canada. We are based in Ontario, Canada. For privacy inquiries, contact us at hello@afrovendors.ca.

We collect the following categories of personal information:

• Vendor information: business name, email address, phone number, WhatsApp number, Instagram handle, website URL, business description, city, and any photos you upload to your listing.
• Account information: email address used to create a vendor account and sign in via magic link.
• Review information: your name, email address, star rating, and review text when you submit a review for a vendor.
• Inquiry data: when you click a vendor's contact button (call, WhatsApp, Instagram, email), we record the contact method and the time of the click. We do not record the content of any conversation that takes place off our platform.
• Technical data: standard web server logs including IP address, browser type, and pages visited. We do not use third-party analytics or advertising trackers.

• To operate the AfroVendors marketplace and display vendor listings publicly.
• To send vendors a monthly summary email showing how many customers contacted them through their listing. You can unsubscribe from these emails at any time using the link in each email.
• To send authentication emails (magic sign-in links) when you request access to your vendor dashboard.
• To moderate and approve vendor applications before they go live.
• To improve the platform based on aggregate, anonymised usage patterns.

We do not sell your personal information to third parties. We do not use your information for advertising purposes. We do not share your information with any party except as described in this policy.

We use the following third-party services to operate AfroVendors. Each acts as a data processor on our behalf:

• Supabase (supabase.com) — stores all platform data including vendor listings, reviews, and inquiry records in a PostgreSQL database hosted in the United States. Supabase is SOC 2 Type II certified.
• Vercel (vercel.com) — hosts the AfroVendors website and serves all web traffic. Vercel processes standard web request data including IP addresses.
• Resend (resend.com) — delivers transactional emails including magic sign-in links and monthly stats emails. Resend processes vendor email addresses for this purpose only.

We may disclose personal information if required by law, court order, or to protect the rights and safety of AfroVendors, our users, or the public.

• Vendor listings: retained while your listing is active. If you request deletion, we will remove your listing and associated personal information within 30 days.
• Reviews: retained indefinitely as part of the public trust record of the platform, unless you request removal and can demonstrate the review contains inaccurate personal information about you.
• Inquiry records: retained for 24 months for statistical purposes, then deleted.
• Authentication logs: magic link tokens expire within 1 hour. Session data is retained until you sign out.

As a Canadian resident, you have the following rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):

• Right of access: you can request a copy of the personal information we hold about you.
• Right of correction: you can request that inaccurate information be corrected. Vendors can update most information directly through their dashboard at afrovendors.ca/vendor/dashboard.
• Right to withdraw consent: you can withdraw consent to the processing of your personal information at any time by contacting us, subject to legal or contractual restrictions.
• Right to file a complaint: you can file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, email us at hello@afrovendors.ca with "Privacy Request" in the subject line. We will respond within 30 days.

AfroVendors is primarily a Canadian marketplace and does not actively target residents of the European Economic Area (EEA), United Kingdom, or Switzerland. However, if you are located in one of these regions and have interacted with our platform, you may have additional rights under the General Data Protection Regulation (GDPR) or equivalent legislation, including:

• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restriction of processing
• Right to lodge a complaint with your local supervisory authority

To exercise any of these rights, contact us at hello@afrovendors.ca. Our legal basis for processing personal data is legitimate interests (operating the marketplace) and consent (for marketing communications such as the monthly stats email).

We implement reasonable technical and organisational measures to protect your personal information, including encrypted database storage, Row Level Security policies that restrict data access, HTTPS-only connections, and time-limited authentication tokens. No method of electronic storage or transmission is 100% secure — if you become aware of any security concern, please contact us immediately at hello@afrovendors.ca.

AfroVendors is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify vendors of material changes by email. Continued use of AfroVendors after changes are posted constitutes acceptance of the updated policy. The "last updated" date at the top of this page reflects the most recent revision.