Popup Hub (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use our marketplace platform in Canada.
1. Information we collect
- Account data: name, email address, phone number (optional), role (shopper, vendor, or coordinator), and authentication identifiers managed through Supabase Auth. Organizer and vendor accounts complete an email one-time-code check before trust tools unlock. A verified phone number, when provided, may only be linked to one organizer/vendor-capable account.
- Profile media: user avatar images and vendor passport logos uploaded to your account.
- Vendor passport data: business name, category selections, product photos, bio, and optional contact or shop links you choose to publish.
- Event and application data: booth applications, attendance selections, payment status, and coordinator review notes necessary to operate markets.
- Usage and device data: log data, browser type, and approximate location derived from IP address or map interactions. We also store a hashed form of your IP address (not the raw address) when you sign in or submit an organizer endorsement, and retain those network signals for about 90 days to detect multi-account abuse on endorsements. Hashed network signals are used only for fraud and security purposes—not for marketing.
2. How we store and protect your data
Popup Hub uses Supabase, a secure cloud infrastructure provider, to store application data, authentication records, and uploaded media. Data in transit is protected with TLS encryption. Data at rest is stored within Supabase-managed databases and object storage using industry-standard access controls and encrypted storage parameters configured for production environments.
Profile images and vendor assets: user avatar images, corporate passport logos, and related media files are uploaded to Supabase Storage buckets with role-based access policies. Contact email addresses associated with your account are stored in our Supabase Postgres database and are not exposed publicly except where you explicitly choose to share them.
3. How we share information
We share personal information only as needed to operate the Platform:
- With event coordinators: when you submit a market application, coordinators for that event receive the vendor passport details required to review your submission—including your business name, categories, logo, product images, and the contact email on your account—so they can approve booths, communicate about logistics, and run the event.
- With payment processors: Square or other processors receive payment and payout information necessary to complete transactions you authorize.
- With service providers: email (for example, Resend), SMS (for example, Twilio), and analytics vendors that process data under contractual confidentiality obligations.
- For legal reasons: when required by law, court order, or to protect rights, safety, and security.
We do not sell your personal information.
4. Public visibility
Approved vendor listings on published market pages may display business names, logos, and product photos you uploaded. Shoppers do not receive your private email address unless you publish a contact link in your passport.
5. Your rights in Canada
Under Canadian privacy law, you may have the right to:
- Access, correct, or delete personal information we hold about you.
- Withdraw consent where processing is consent-based.
- Request portability of certain account data.
- Opt out of non-essential marketing communications.
- Challenge our compliance with applicable privacy legislation.
Popup Hub processes personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy statutes such as Alberta's Personal Information Protection Act (PIPA), British Columbia's PIPA, and Quebec's Act respecting the protection of personal information in the private sector (Law 25).
6. Data retention
We retain account and application records while your account is active and for a reasonable period afterward to comply with legal, tax, and dispute-resolution obligations. You can delete your account at any time from Profile → Account Security → Delete account in the app or at popuphub.ca. Deletion is permanent and removes your profile and associated personal data. Some records may be retained where required by law (for example, anonymized audit or payment records). Hashed IP network signals used for endorsement fraud detection are kept for about 90 days. Platform admin and operator accounts, or accounts with unresolved markets, wallet balances, or booth applications, must resolve those items in-app before deletion; if you need help, contact privacy@popuphub.app.
7. Children
Popup Hub is not directed to children under 13 (or 16 where applicable). We do not knowingly collect personal information from children.
8. Cross-border processing
Your information is primarily stored and processed in Canada. Some service providers (for example, payment, email, or SMS vendors) may process data outside Canada under contractual safeguards consistent with PIPEDA and applicable provincial requirements.
9. Changes to this policy
We will post updates on this page and revise the “Last updated” date. Material changes may also be communicated by email or in-app notice where appropriate.
10. Contact
Privacy requests: privacy@popuphub.app