Trust & Data

1. Our privacy program

LocalSeek is a Canadian platform built around the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA): collection limited to what the platform needs, purpose-bound use, safeguards proportionate to sensitivity, and real access, correction, deletion, and portability rights for the people whose information we hold. This page summarizes how those principles are implemented in the product. It is a plain-language companion to — not a replacement for — our Privacy Policy and Terms of Service, which govern.

2. Where your data lives

Primary application data — accounts, catalogs, orders, bookings, customer records, and audit logs — is stored in Canada, in our database provider’s ca-central-1 (Montréal) region.

Like nearly every SaaS platform, we use a small number of specialized sub-processors (for example for push notifications, SMS delivery, and subscription billing) that may process limited data in the United States or other countries. The complete list and what each one receives is published in our Privacy Policy. We do not claim your data “never leaves Canada” — we tell you exactly what does, and why.

3. Who can see what

• Row-level security on every table. Access rules are enforced inside the database itself, not just in application code: a signed-in user’s queries can only return rows they are entitled to, and anonymous (signed-out) access to customer, financial, or CRM data is revoked at the database layer.
• Staff access is role-gated per store. Your team members see your store’s data only while they hold an active membership you control.
• Sensitive reads are individually recorded. Revealing a customer’s phone number, opening a customer’s full safety profile, and searching for a member match each write an audit entry before any data is shown — and if the audit entry cannot be written, the data is not shown. Identity-lookup paths are additionally rate-limited.
• You can see the record. The LocalSeek Biz app includes an audit-trail screen listing credit movements and sensitive-access events at your store, so accountability is visible to the business owner — not just to us.

4. Safety and health-adjacent information

Salons, swim schools, studios, and clinics sometimes need to record safety-critical facts about a customer — allergies, medications, patch-test results. LocalSeek stores these as structured, person-keyed records with elevated protection, not as free-text notes: the data is inaccessible to direct queries (server-side procedures only), day-to-day service screens surface only the minimum needed at service time (for example, allergen flags), and opening the full record is audit-logged per access. These records are erased at the end of the 30-day grace window after the customer deletes their account.

An honest note on PHIPA: LocalSeek is a business-management platform, not a health information custodian, and we do not claim PHIPA compliance. If your practice is subject to PHIPA or a regulatory college’s record-keeping rules, those obligations are yours — and the controls above (restricted access, per-access audit trails, structured storage, deletion on request) are designed to support you in meeting them. Talk to us before storing clinical records on LocalSeek.

5. Deletion, export, and retention

• Deletion: account deletion (consumer or merchant) permanently anonymizes personal information after a 30-day grace period, including guest names and phone numbers on reservations and bookings linked to the account, and safety records. Order and credit records are unlinked from the account after 90 days, and a merchant's business profile is anonymized after 7 years.
• Export: consumers and merchants can request a machine-readable export of their data by writing to support@localseek.app; completed exports are delivered via a private, time-limited download link.
• Retention: we keep data only as long as its purpose requires, on the published schedule in our Privacy Policy — including the financial-record retention Canadian tax law requires — and scheduled jobs purge expired records automatically.

6. Payments

LocalSeek never processes or stores your customers’ card details. In-person payment happens directly between your customer and your business; optional online prepayment runs on a payment processor account that you own and connect. Our subscription billing is handled by Stripe; card data goes to Stripe, not to us.

7. Questions

Compliance reviewers and privacy officers are welcome to write to support@localseek.app — we answer specific questions about data flows, sub-processors, and controls, and we would rather be asked twice than trusted blindly.