Privacy Policy

Last Updated: January 2, 2025

1. Introduction

At Onlure, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our platform. By using Onlure, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, password, username, role (Business/Creator/Consumer)
Profile Information: Avatar, bio, location, social media handles
Business Information: Business name, address, phone number, website (for Business users)
Creator Information: Portfolio media, follower counts, engagement metrics (for Creators)
Payment Information: Billing address, payment method (processed securely by Stripe)

2.2 Automatically Collected Information

Usage Data: Pages viewed, features used, time spent, clicks, navigation paths
Device Information: IP address, browser type, operating system, device identifiers
Location Data: Approximate location based on IP address; precise location when you redeem Drops (with permission)
Cookies and Tracking: Session cookies, analytics cookies, preference cookies

2.3 Social Media Integration

When you connect Instagram, TikTok, or other social accounts, we collect:

Public profile information (username, profile picture, follower count)
Engagement metrics (likes, comments, shares) for campaign tracking
Content you choose to share through our platform

3. How We Use Your Information

We use your information to:

Provide Services: Create and manage your account, process redemptions, track referrals, manage Coin balances
Match and Connect: Connect Businesses with Creators, recommend relevant Drops to Consumers
Process Payments: Handle coin purchases, premium subscriptions, creator payouts
Communicate: Send transactional emails (redemption confirmations, coin earnings), marketing emails (with consent), platform updates
Improve Platform: Analyze usage patterns, identify bugs, develop new features, conduct A/B testing
Prevent Fraud: Detect duplicate redemptions, fake accounts, abuse of coin system
Comply with Law: Respond to legal requests, enforce our terms, protect rights and safety

4. How We Share Your Information

4.1 Within the Platform

Business Users can see Creator profiles, engagement metrics, and redemption data for their Drops
Creators can see Drop details, redemption counts, and earnings data
Consumers can see Business information, Drop details, and leaderboards

4.2 With Third-Party Service Providers

Supabase: Database and authentication services
Stripe: Payment processing
Vercel: Hosting and content delivery
Resend: Email delivery
Firebase Cloud Messaging: Push notifications
Analytics Providers: Google Analytics, Sentry (error tracking)

4.3 Legal and Safety

We may disclose your information when required by law, to comply with legal processes, to protect our rights, or to prevent fraud and abuse.

4.4 Business Transfers

If Onlure is acquired or merged with another company, your information may be transferred to the new entity. We will notify you before your information becomes subject to a different privacy policy.

We do NOT sell your personal information to third parties.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to:

Essential Cookies: Keep you logged in, remember your preferences
Analytics Cookies: Understand how you use the platform
Marketing Cookies: Show relevant ads and track campaign performance (with consent)

You can control cookies through your browser settings. Note that disabling cookies may affect platform functionality.

6. Data Retention

We retain your information for as long as:

Your account is active
Needed to provide services (e.g., redemption history for accounting)
Required by law or for legitimate business purposes (e.g., fraud prevention)

After account deletion, we may retain anonymized data for analytics and aggregated statistics.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

Access: Request a copy of your personal data
Correction: Update inaccurate or incomplete information
Deletion: Request deletion of your account and data (subject to legal retention requirements)
Data Portability: Receive your data in a machine-readable format
Opt-Out: Unsubscribe from marketing emails, disable location tracking
Object to Processing: Object to certain uses of your data
Withdraw Consent: Revoke consent for data processing where consent was the legal basis

To exercise these rights, contact us at privacy@onlure.ca

8. Security

We implement security measures to protect your information, including:

Encryption in transit (HTTPS/TLS) and at rest
Secure authentication with password hashing
Row-level security policies in our database
Regular security audits and monitoring
Access controls limiting who can view your data

However, no system is completely secure. Please use a strong, unique password and enable two-factor authentication when available.

9. Children's Privacy

Onlure is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. International Data Transfers

Your information may be transferred to and processed in countries outside of Canada, including the United States (where our hosting provider Vercel operates). We ensure appropriate safeguards are in place, such as standard contractual clauses or Privacy Shield frameworks (where applicable).

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

Right to know what personal information we collect and how we use it
Right to delete your personal information (with exceptions)
Right to opt-out of the sale of personal information (we do not sell your data)
Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at privacy@onlure.ca

12. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under GDPR including:

Right to access, rectification, erasure, and data portability
Right to restrict or object to processing
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority

Our legal basis for processing your data includes: contract performance, legitimate interests, consent, and legal obligations.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or platform notification. The "Last Updated" date at the top will reflect when changes were made. Continued use of Onlure after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions, concerns, or requests regarding your privacy, please contact us:

Email: privacy@onlure.ca

Data Protection Officer: dpo@onlure.ca

Mailing Address: Toronto, Ontario, Canada

By using Onlure, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein.