Privacy Policy

Popup Hub (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use our marketplace platform in Canada.

1. Information we collect

• Account data: name, email address, phone number (optional), role (shopper, vendor, or coordinator), and authentication identifiers managed through Supabase Auth.
• Profile media: user avatar images and vendor passport logos uploaded to your account.
• Vendor passport data: business name, category selections, product photos, bio, and optional contact or shop links you choose to publish.
• Event and application data: booth applications, attendance selections, payment status, and coordinator review notes necessary to operate markets.
• Usage and device data: log data, browser type, and approximate location derived from IP address or map interactions.

2. How we store and protect your data

Popup Hub uses Supabase, a secure cloud infrastructure provider, to store application data, authentication records, and uploaded media. Data in transit is protected with TLS encryption. Data at rest is stored within Supabase-managed databases and object storage using industry-standard access controls and encrypted storage parameters configured for production environments.

Profile images and vendor assets: user avatar images, corporate passport logos, and related media files are uploaded to Supabase Storage buckets with role-based access policies. Contact email addresses associated with your account are stored in our Supabase Postgres database and are not exposed publicly except where you explicitly choose to share them.

3. How we share information

We share personal information only as needed to operate the Platform:

• With event coordinators: when you submit a market application, coordinators for that event receive the vendor passport details required to review your submission—including your business name, categories, logo, product images, and the contact email on your account—so they can approve booths, communicate about logistics, and run the event.
• With payment processors: Square or other processors receive payment and payout information necessary to complete transactions you authorize.
• With service providers: email (for example, Resend), SMS (for example, Twilio), and analytics vendors that process data under contractual confidentiality obligations.
• For legal reasons: when required by law, court order, or to protect rights, safety, and security.

We do not sell your personal information.

4. Public visibility

Approved vendor listings on published market pages may display business names, logos, and product photos you uploaded. Shoppers do not receive your private email address unless you publish a contact link in your passport.

5. Your rights in Canada

Under Canadian privacy law, you may have the right to:

• Access, correct, or delete personal information we hold about you.
• Withdraw consent where processing is consent-based.
• Request portability of certain account data.
• Opt out of non-essential marketing communications.
• Challenge our compliance with applicable privacy legislation.

Popup Hub processes personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy statutes such as Alberta's Personal Information Protection Act (PIPA), British Columbia's PIPA, and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

6. Data retention

We retain account and application records while your account is active and for a reasonable period afterward to comply with legal, tax, and dispute-resolution obligations. You may request account deletion by contacting us; some records may be retained where required by law.

7. Children

Popup Hub is not directed to children under 13 (or 16 where applicable). We do not knowingly collect personal information from children.

8. Cross-border processing

Your information is primarily stored and processed in Canada. Some service providers (for example, payment, email, or SMS vendors) may process data outside Canada under contractual safeguards consistent with PIPEDA and applicable provincial requirements.

9. Changes to this policy

We will post updates on this page and revise the “Last updated” date. Material changes may also be communicated by email or in-app notice where appropriate.

10. Contact

Privacy requests: privacy@popuphub.app