Privacy Policy

Last updated: July 2026

1. Introduction

PalFactory ("PalFactory," "we," "our," or "us") operates a referral code cashback marketplace accessible at palfactory.com (the "Platform"). We are a Quebec-based company subject to the Act to modernize legislative provisions respecting the protection of personal information (commonly known as "Law 25").

This Privacy Policy applies to all users of the Platform and explains how we collect, use, disclose, and protect your personal information. By using the Platform, you acknowledge that you have read and understood this policy.

2. Privacy Officer (Responsable de la protection des renseignements personnels)

In accordance with Quebec's Law 25, PalFactory has designated a Privacy Officer ("RPRP") responsible for ensuring compliance with applicable privacy legislation and handling all inquiries regarding the protection of personal information.

Contact information:

Email: privacy@palfactory.com
The Privacy Officer may be contacted for any question, comment, or complaint relating to the protection of your personal information.

3. Personal Information We Collect

We collect the following categories of personal information:

Account Information: email address, username, display name, short biography (bio), and profile picture (avatar URL). These are collected when you register or update your profile.
Authentication Data: a hashed password (if signing up by email) or OAuth credentials (email, name, profile photo) when signing in via Google or Facebook. Authentication data is managed by Supabase Auth.
Phone Number: provided for identity verification via Supabase Auth. Phone numbers help establish trust within the marketplace.
Transaction Data: details of cashback transactions, including sponsor ID, recipient ID, amount, payment intent ID, and transaction status. This data is necessary to operate the cashback marketplace.
Payment Data: payment processing is handled by Stripe Connect. We do not store or have access to your full banking or credit card details. Locally, we store only the Stripe customer ID, payment method ID, card brand, and the last four digits of the card (last4) for saved payment methods. Banking information for cashback payouts is provided directly to Stripe by sponsors.
Usage Data: browsing behaviour, search queries, and interactions with the Platform.
Cookies and Similar Technologies: we use only essential authentication session cookies (managed by Supabase). No third-party analytics or advertising cookies are deployed. See Section 12 for more details.

4. Purposes for Collecting Personal Information

We collect and use your personal information for the following purposes:

To provide the cashback marketplace service: your account information and transaction data are necessary to operate the Platform, match sponsors with recipients, and facilitate cashback transactions.
To process payments via Stripe Connect: payment data is shared with Stripe to enable cashback payouts and collect the platform commission.
To verify user identity: phone numbers and authentication data help us maintain a secure and trustworthy environment, reduce fraud, and build confidence among users.
To communicate with you: we use your email address to send transactional notifications (cashback confirmations, payout updates), respond to support requests, and issue security alerts.
To detect and prevent fraud and abuse: usage data and transaction history allow us to monitor for suspicious activity, enforce our Terms of Service, and protect the integrity of the marketplace.
To compute and display reputation scores: your transaction history and platform activity contribute to your public reputation tier, which builds trust between sponsors and recipients.

We do not collect or use your personal information for any purpose other than those listed above without first obtaining your explicit consent.

5. How We Collect Your Information

Personal information is collected through the following means:

Registration and profile forms: when you create an account or update your profile directly on the Platform.
OAuth authentication: when you sign in using Google or Facebook, we receive the personal information you authorize through those providers.
Session cookies: essential cookies set by Supabase Auth to maintain your authenticated session.
Platform interactions: data generated by your use of the Platform, including transactions, searches, and navigation.

6. Consent

PalFactory obtains your consent before collecting, using, or disclosing your personal information. Our consent is:

Manifest: you take an affirmative action, such as checking a consent box, submitting a form, or authenticating through an OAuth provider.
Free: your consent is voluntary; you may choose not to provide certain personal information, though this may limit your ability to use the Platform.
Informed: this Privacy Policy explains what personal information we collect, why we collect it, and how it is used.
Specific: consent is obtained for each specific purpose described in Section 4.

You may withdraw your consent at any time by contacting our Privacy Officer at privacy@palfactory.com. Withdrawing consent may affect your ability to use certain features of the Platform. We do not collect or use your personal information beyond the purposes for which you have given consent.

7. Sharing of Personal Information

We do not sell, rent, or trade your personal information. We may share your information in the following situations:

7.1. With Other Users

The following information is publicly visible to other Platform users: username, display name, avatar, biography, and reputation tier. When you participate in a cashback transaction, limited details (such as transaction amount and the parties' usernames) are shared between the sponsor and the recipient to facilitate the transaction.

7.2. With Service Providers (Subcontractors)

We share certain personal information with trusted third-party service providers who assist us in operating the Platform:

Supabase Supabase (database hosting, authentication, file storage) — personal information is stored in Supabase's infrastructure. The data region is subject to confirmation (please contact our Privacy Officer for up-to-date details).
Stripe, Inc. Stripe, Inc. (payment processing via Stripe Connect) — located in the United States. Payment data, including banking details for payouts, is collected and processed directly by Stripe.
Cloudflare, Inc. Cloudflare, Inc. (application hosting and DNS) — global / edge network. The Platform is deployed on Cloudflare Workers; data in transit passes through Cloudflare's infrastructure.
Resend Resend (transactional email delivery) — located in the United States. Your email address is shared with Resend to deliver transactional notifications.
DeepSeek DeepSeek (AI-assisted support triage and content moderation) — located in the United States. Support ticket content and content submitted for moderation may be processed by DeepSeek to generate summaries, suggested replies, and moderation verdicts. No automated decision is made about you.

Each subcontractor is bound by contractual agreements that require them to protect your personal information in accordance with applicable privacy laws.

7.3. For Legal Reasons

We may disclose your personal information if required by law, regulation, court order, or a valid request from a public authority.

8. Transfers Outside Quebec

Some of your personal information may be transferred to and processed in jurisdictions outside Quebec, including the United States and other countries where our service providers operate:

Stripe (United States) — processes payment data and banking information.
Cloudflare (global network, including the United States) — hosts and delivers the Platform.
Resend (United States) — sends transactional emails on our behalf.
DeepSeek (United States) — processes support ticket content and moderated content to generate AI-assisted suggestions, summaries, and moderation verdicts.

Before transferring personal information outside Quebec, PalFactory conducts a privacy impact assessment ("EFVP" — Évaluation des facteurs relatifs à la vie privée) and enters into written agreements with each service provider to ensure that your personal information benefits from an adequate level of protection, in compliance with Law 25. You may contact our Privacy Officer at privacy@palfactory.com for more information about these transfers and the safeguards in place.

9. Retention and Destruction of Data

PalFactory retains your personal information only for as long as is necessary to fulfill the purposes for which it was collected, and in accordance with our legal obligations:

Active account data: retained for the entire duration of your account's active status.
Transaction data: retained for 7 years to comply with tax and accounting obligations under Quebec and Canadian law.
Cashback offers (expired): marked as expired but retained for historical record-keeping and reputation scoring.
Notifications: read notifications are automatically deleted 90 days after creation; unread notifications are retained for as long as your account remains active.
Support data: support tickets you open and their associated messages are retained for as long as your account remains active, then purged in accordance with our retention policy; internal support notes are never included in data exports.
Authentication data: deleted upon account deletion or upon your request.

Once the purposes for which your personal information was collected have been fulfilled, we destroy or anonymize it in a secure manner. You may request the deletion of your account and associated personal information at any time by contacting our Privacy Officer.

10. Security Measures

PalFactory implements and maintains reasonable and appropriate security measures to protect your personal information, including:

Row Level Security (RLS): enabled on all database tables, ensuring that users can only access data they are authorized to see in accordance with our access control policies.
Encryption in transit: all data transmitted between your browser and the Platform, and between our servers and third-party services, is encrypted using HTTPS (TLS).
Secure API key management: API keys and secrets are stored securely using Cloudflare's secrets management and environment variable encryption. The Supabase service role key is used exclusively server-side and is never exposed to the client.
Limited payment data storage: we do not store full credit card numbers or banking details on our systems. Payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor.
Password hashing: passwords are hashed and salted by Supabase Auth and are never stored in plain text.

While we strive to protect your personal information, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security, but we continually review and update our security practices.

11. Your Rights

Under Quebec's Law 25 and applicable privacy legislation, you have the following rights regarding your personal information:

11.1. Right of Access

You have the right to consult the personal information we hold about you and to obtain a copy of that information.

11.2. Right of Rectification

You may correct or update your personal information at any time through your profile settings. If the information you wish to correct is not editable through the Platform, contact us and we will update it promptly.

11.3. Right to Erasure / Right to Be Forgotten

You may request the deletion of your account and the personal information associated with it. We will delete or anonymize your data, subject to retention obligations imposed by law (e.g., transaction records retained for 7 years for tax purposes).

11.4. Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to have that information transferred to another organization where technically feasible.

11.5. Right to Withdraw Consent

You may withdraw your consent to the collection, use, or disclosure of your personal information at any time. Withdrawal of consent may limit your ability to use certain features of the Platform.

11.6. Right to Object

You may object to the processing of your personal information for certain purposes. We will evaluate your objection and respond within the timeframes prescribed by law.

How to Exercise Your Rights

To exercise any of these rights, please contact our Privacy Officer at privacy@palfactory.com. We will respond to your request within 30 days of receipt, in accordance with Law 25.

If you are a PalFactory member, you can also submit and track your request from the privacy request center. Non-members can continue to use the email address above.

If you are not satisfied with our response, you have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI). For more information, visit https://www.cai.gouv.qc.ca/.

12. Cookies and Tracking Technologies

PalFactory uses only strictly essential cookies to ensure the proper functioning and security of the Platform:

A session cookie set by Supabase Auth to maintain your authenticated session. This cookie is necessary for you to access your account and use the Platform's features.

We do not use:

Third-party analytics tools (no Google Analytics, Meta Pixel, or similar).
Third-party advertising or retargeting cookies.
Tracking cookies for behavioural profiling.

Because we only use essential authentication cookies, no prior consent is required under applicable law for their use. You may configure your browser to refuse cookies, but this will prevent you from logging in to the Platform.

13. Children's Privacy

The Platform is not intended for individuals under the age of 18 years. We do not knowingly collect personal information from minors.

In accordance with Quebec's Law 25, for minors under the age of 14 years, the consent of the person holding parental authority (parent or legal guardian) is required before any personal information may be collected.

If we discover that we have inadvertently collected personal information from a minor without proper consent, we will take immediate steps to delete that information and close the associated account. If you believe a minor has provided us with personal information, please contact our Privacy Officer at privacy@palfactory.com.

14. Confidentiality Incident Register

In accordance with Law 25, PalFactory maintains a Confidentiality Incident Register documenting all incidents involving the unauthorized access, use, disclosure, or loss of personal information under our control. This register includes the date, nature, circumstances, and corrective measures taken for each incident.

In the event of a confidentiality incident presenting a risk of serious harm to the individuals concerned, we will:

Notify the Commission d'accès à l'information du Québec (CAI) without delay.
Notify the affected individuals as soon as possible, providing details of the incident and recommended measures to mitigate the risk.

The Confidentiality Incident Register is retained for a period of 5 years, as required by law. You may contact our Privacy Officer for further information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the features of the Platform. When we make changes, we will update the "Last updated" date at the top of this page and, for material changes, notify you through the Platform or by email.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of the Platform after any changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or wish to exercise your rights, please contact us:

Privacy Officer (RPRP): privacy@palfactory.com
General Support: support@palfactory.com

You also have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI): https://www.cai.gouv.qc.ca/.