Privacy Policy

CaféWork is operated by Andre Boisvert, located at 114 Dobie, Mont-Royal, Quebec, H3P 1S4, Canada. For any questions regarding the protection of your personal data, please contact us at privacy@cafe-work.com.

We collect the following categories of data:

Data you provide directly: email address, password (hashed), first name, optional profile photo, and any content you submit (comments, café notes, reports).

Data collected automatically: IP address, browser type, operating system, pages visited, session duration, referral source. This data is collected via cookies and similar technologies.

Third-party data: if you sign in via Google OAuth, we receive your email address and name as they appear in your Google account, in accordance with the permissions you grant.

We use your personal data for the following purposes:

Service delivery: creating and managing your account, authentication, displaying personalized content (favourite cafés, search history).

Service improvement: analyzing usage to understand how users interact with CaféWork, identifying bugs and performance issues, developing new features.

Communications: sending transactional emails (registration confirmation, password reset), and if you have consented, our weekly newsletter.

Advertising: displaying relevant ads via Google AdSense, based on your browsing and preferences if you have consented to advertising cookies.

Legal obligations: retaining data required by law, responding to legitimate authority requests.

We process your personal data on the following legal bases:

Contract performance: processing is necessary to provide you with our services, including account management and access to platform features.

Consent: for analytics and advertising cookies, and for sending our newsletter. You may withdraw your consent at any time via our cookie manager or by unsubscribing from our communications.

Legitimate interests: to improve and secure our service, prevent abuse, and analyze general platform usage, to the extent these interests do not override your fundamental rights.

Legal obligation: where processing is required to comply with an applicable legal obligation.

CaféWork relies on trusted third-party providers who process data on our behalf or independently:

Supabase: database hosting and authentication. Your data is stored on secure servers. Privacy policy: supabase.com/privacy.

Google Analytics: audience and behaviour analysis. Data is aggregated and pseudonymized. You can opt out via our cookie banner. Privacy policy: policies.google.com/privacy.

Google AdSense: contextual ad display. Google may use cookies to personalize ads based on your browsing history. Privacy policy: policies.google.com/privacy.

Resend: transactional and marketing email delivery. Privacy policy: resend.com/legal/privacy-policy.

Fly.io: backend API hosting. Privacy policy: fly.io/legal/privacy-policy.

Cloudflare: frontend hosting and DDoS protection. Privacy policy: cloudflare.com/privacypolicy.

We retain your personal data for the following periods:

Account data: for as long as your account is active. Upon account deletion, we delete or anonymize your data within 30 days, unless a longer retention period is required by law.

Analytics data: aggregated data retained for 26 months in Google Analytics (default setting).

Server logs: retained for 90 days for security and debugging purposes.

Email data: if you unsubscribe from our newsletter, we retain your address on our suppression list to prevent accidental re-sending.

Upon expiry of these periods, data is deleted or irreversibly anonymized.

Depending on your location, you have certain rights regarding your personal data:

Right of access: obtain a copy of the personal data we hold about you.

Right to rectification: have inaccurate or incomplete data corrected.

Right to erasure: request deletion of your data in certain circumstances ("right to be forgotten").

Right to data portability: receive your data in a structured, machine-readable format.

Right to object: object to processing based on our legitimate interest or for direct marketing purposes.

Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.

Quebec residents: you also benefit from rights under Law 25 (Act to modernize legislative provisions respecting the protection of personal information).

To exercise your rights, please contact us at privacy@cafe-work.com. We will respond to your request within 30 days of receipt. Quebec residents may also file a complaint with the Commission d'accès à l'information (CAI) at www.cai.gouv.qc.ca.

Your data may be transferred to and processed in countries other than your country of residence. Our main providers (Supabase, Google, Cloudflare, Fly.io) are US-based companies subject to US law.

These transfers rely on appropriate safeguards, including standard contractual clauses approved by the European Commission and the EU-US Data Privacy Framework.

Under Quebec's Law 25, CaféWork ensures that any transfer of personal data outside Quebec is carried out with appropriate safeguards. CaféWork is primarily intended for Canadian users and does not designate a representative under Article 27 of the GDPR.

CaféWork is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can take steps to delete it.

We may update this privacy policy periodically to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any significant changes by posting the new policy on this page with a revised update date. For material changes, we may also send you an email notification. We encourage you to review this policy regularly.

This policy is governed by the laws of the Province of Quebec and the applicable federal laws of Canada, including Law 25 (Act to Modernize Legislative Provisions Respecting the Protection of Personal Information). Quebec residents may file a complaint with the Commission d'accès à l'information (CAI). European Union residents have the right to file a complaint with their local data protection authority.