Privacy Policy

1. Accountability & Privacy Officer

We are responsible for personal information under our control. Our designated Privacy Officer handles privacy questions, access and correction requests, consent withdrawals, deletion/anonymization requests where appropriate, and PIPEDA complaints.

• Email: privacy@africanmarketplace.ca
• Support: support@africanmarketplace.ca
• Mailing: Privacy Officer, African Caribbean MarketPlace Canada Inc., Hamilton, Ontario, Canada

We acknowledge privacy complaints in good faith, investigate, and respond. If you remain unsatisfied, you may contact the Office of the Privacy Commissioner of Canada.

2. Purposes of collection

We collect personal information to:

• Create and secure accounts, verify identity (KYC for businesses/drivers), and provide customer support
• Process orders, payments, deliveries, appointments, and returns
• Show nearby vendors and products when you consent to location services (IP and/or device GPS)
• Operate the Amara AI Concierge (marketplace users) and Vendor AI Assistant (business owners), which may use OpenAI as a third-party AI service provider to generate responses, with personal identifiers redacted where feasible before information is sent
• Send transactional messages (order, delivery, security) and, only with separate consent, marketing such as trending fashion updates
• Meet legal, tax, fraud-prevention, and dispute obligations

3. Consent

Account registration requires acceptance of our Terms of Service and a separate acknowledgement of this Privacy Policy (version recorded at acceptance). Marketing emails require a separate opt-in (off by default). Nearby-vendor location (IP and/or GPS) is used only after you accept location use in privacy settings or an equivalent device prompt; you may decline and still browse without near-me ranking.

AI Concierge and Vendor AI Assistant: before your AI conversation messages or relevant session/context information are transmitted to OpenAI (our third-party AI service provider), we present an in-app disclosure that identifies OpenAI, explains what may be shared, states that the information is used to process the AI request and generate a response, and asks for your affirmative permission. If you decline, the AI request is not sent to OpenAI; you can continue using other AfricanMarketplace features. This in-app consent is separate from accepting this Privacy Policy.

You may withdraw marketing, location, or AI-provider consent at any time in Privacy & data (or by declining when prompted again in the AI chat) or by contacting the Privacy Officer.

4. What we collect

• Identity and contact: name, email, password (hashed), optional phone on orders/forms
• Shop / business profile, license and KYC documents when you register as a business or driver
• Order, delivery, and payment metadata (addresses, status); card data is handled by Stripe
• Approximate location from IP and, if you allow, precise device coordinates for near-me discovery
• Concierge / Vendor AI chat messages and session context needed to provide the requested response (isolated per user or shop); personal identifiers are redacted where feasible before third-party AI processing
• Technical logs needed for security and reliability

5. Service providers (processors)

We use service providers that may process personal information on our behalf, including:

• Stripe — payments and subscriptions
• Email/SMTP providers — transactional and consented marketing mail
• OpenAI (and equivalents when configured) — service provider for the Amara AI Concierge and Vendor AI Assistant. Chat messages and relevant session/context may be processed to generate AI responses after in-app affirmative permission; personal identifiers are redacted where feasible before sending
• IP geolocation (for example ipapi.co) — approximate city/region when you consent to location
• OpenStreetMap Nominatim — reverse geocoding of device coordinates when you consent to GPS
• Cloud hosting / infrastructure providers for our application and databases

We do not sell your personal information. KYC images are used only to verify your Inclusive African Marketplace account and are not sold or shared for unrelated marketing.

6. Cross-border processing

Inclusive African Marketplace is operated for Canadian customers, with primary accountability in Ontario, Canada. Some processors (for example Stripe, certain AI providers, geolocation APIs, and cloud hosts) may store or process information in the United States or other countries. When personal information is transferred outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by foreign authorities. We use contractual and organizational measures appropriate to the sensitivity of the information and limit transfers to what is needed for the purposes described in this policy.

7. Use, disclosure, and retention

We use information only for the purposes described above (or a compatible purpose with notice). Typical retention:

• Account profile: while the account is active; anonymized on soft-close
• Orders / tax / settlements: generally up to 7 years (or longer if a legal hold applies)
• Marketing preferences: while opted in, and a short period after withdrawal for suppression
• Location for nearby discovery: session/cache while consented; not used when declined
• Concierge / Vendor AI transcripts: while the account or shop is active and for a limited support/security period afterward
• KYC media: while verification and account obligations require it, then deleted or anonymized
• Security logs: typically up to 12–24 months unless investigating an incident

Closed accounts are anonymized so login is disabled while preserving non-identifying transactional integrity where required by law.

8. Accuracy

You may correct your name and related profile fields in Privacy & data. Shop owners may also update shop profile fields in the shop dashboard. For email changes or other corrections, contact the Privacy Officer.

9. Safeguards

We use industry-standard measures including encrypted transport (HTTPS), hashed passwords (bcrypt), role-based access controls on APIs, and secret management in production. Sensitive KYC and payment flows use controlled upload and processor channels. Concierge tooling redacts common personal identifiers before third-party AI calls. No method of transmission or storage is 100% secure; we work to reduce risk continuously.

10. Your rights (PIPEDA)

• Access a copy of personal information we hold about your account (Privacy & data, or email the Privacy Officer)
• Request correction of inaccurate information
• Withdraw marketing consent, location consent, and AI-provider (OpenAI) consent for Concierge / Vendor AI
• Request deletion / account close (anonymization / deactivation where appropriate)
• Challenge our compliance by contacting privacy@africanmarketplace.ca; you may also contact the Office of the Privacy Commissioner of Canada

11. Openness

This policy is available at /privacy. Material changes will be posted on this page with an updated effective date and policy version. Significant changes may require renewed acceptance for new registrations.

12. Children

The marketplace is intended for adults. We do not knowingly collect personal information from children under 13.