Privacy Policy

This policy explains how OppBee collects, uses, discloses and protects personal information of businesses' representatives, creators and customers. It is designed to align with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the federal PIPEDA.

OppBee has designated a Privacy Officer responsible for compliance; contact details are provided at the end of this document.

Account data: name, email, phone, language preference and credentials. Business data: legal name, registration and tax identifiers, addresses, and verification documents. Creator data: identity-verification information, payout details, social handles you choose to link, and performance history.

Customer data (people who claim offers): name, one contact detail, the Opp claimed, and redemption events. Technical data: device identifiers, IP address, approximate location and usage events used for security, attribution and fraud prevention.

We use personal information to operate the marketplace: verify identities, attribute results, calculate and pay rewards, prevent fraud, provide support, and meet legal obligations. We do not sell personal information.

Fraud-prevention processing, including device fingerprinting and risk scoring, is carried out as a legitimate necessity to protect all parties; automated decisions with significant effects are subject to human review on request.

Audience measurement: we keep a log of page views — including a device identifier, IP address, referring site and page visited — to understand how many people use the platform, which pages they arrive on and how they found us. These records are deleted after 90 days.

We share information only as needed: with the business a customer claims an offer from (limited to what is required to honour the offer); with payment and identity-verification providers under contract; with authorities where required by law; and in an eventual business transfer, under equivalent protections.

Creators never see customers' contact details; businesses never see creators' identity documents.

We retain personal information only as long as necessary for the purposes described or as required by law (for example, financial records). Verification documents are retained only as long as regulatory obligations require.

Safeguards include encryption in transit, access controls, audit logging of sensitive actions, and staff confidentiality obligations. In case of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information and affected persons as required by Law 25.

You may access, correct or ask us to delete your personal information, withdraw consent (subject to legal or contractual restraints), and request information about automated processing. Québec residents may also request cessation of dissemination (de-indexing) in accordance with Law 25.

To exercise any right, contact the Privacy Officer at support@oppbee.com (see section 9). We respond within 30 days.

We use a small set of cookies for authentication, language preference and security. Details, including how to manage them, are in the Cookie Policy.

OppBee is operated from Quebec, but the platform runs on infrastructure located in the United States. Your personal information is therefore communicated outside Quebec and outside Canada.

Hosting and application servers are provided by Vercel (Washington, D.C. region). The database, which holds account records, campaign and transaction history and — for creators who reach the payout threshold — an encrypted Social Insurance Number, is operated by Neon in the US East (Northern Virginia) region.

The following service providers also receive personal information and process it in the United States: Stripe (payment processing and, where used, identity verification), Twilio (phone-number verification by SMS), Resend and Amazon SES (transactional and inbound email), Apple and Google (sign-in, push notifications, wallet passes and place lookup) and Anthropic (the optional AI campaign assistant). Each receives only the information needed for its function.

Depending on what you do on the platform, the information that may leave Quebec includes your name, email address, phone number, IP address and device identifier, payment and payout details, support correspondence, and, for creators who provide one, a Social Insurance Number. Social Insurance Numbers are encrypted with AES-256-GCM before they are written to the database and are never sent to a browser or app.

Information stored in the United States may be subject to lawful access requests by US authorities, and the protections available there differ from those under Quebec and Canadian law. We rely on contractual commitments with each provider and on encryption in transit and at rest.

If you would like more detail about a specific transfer, contact the Privacy Officer using the details at the end of this policy.

Elie Mouannes is OppBee's Privacy Officer and is responsible for the protection of personal information. To ask a question, exercise any right described in section 6, or make a complaint about how your information has been handled, write to support@oppbee.com with “Privacy” in the subject line. We respond within 30 days, as required by law. If you are not satisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec, or with the Office of the Privacy Commissioner of Canada.