Privacy Policy

1. Who We Are

Kipos ("we," "us," or "our") operates the website at kipos.ca and related services (collectively, the "Platform"). Kipos is a hyperlocal farm stand marketplace platform based in British Columbia, Canada, serving the Campbell River to Courtenay corridor, Quadra Island, and Comox Valley.

Privacy Officer Contact:
Email: privacy@kipos.ca
Mailing Address: Kipos, Campbell River, BC, Canada

2. Scope of This Policy

This Privacy Policy applies to all personal information collected, used, or disclosed by Kipos in the course of its commercial activities, in accordance with British Columbia's Personal Information Protection Act (PIPA, SBC 2003, c. 63) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

This Policy covers information collected through our website (kipos.ca), account registration, subscription management, and any communications between you and Kipos.

3. Personal Information We Collect

We collect only the personal information necessary to provide and improve our services.

3.1 Information You Provide Directly

Farm Stand Owners:

• Name or farm name, email address, and account password
• Farm stand location (address, latitude/longitude for map display)
• Farm stand details (hours of operation, description, categories of produce)
• Inventory information (items, prices, availability, photos)
• Accepted payment methods (e.g., "Interac e-Transfer, Cash")
• Subscription and billing information (processed by Helcim, our payment processor)

Consumers:

• Name, email address, and account password
• Keyword alert preferences (e.g., "strawberries," "eggs")
• Favorite farm stands
• Subscription and billing information (for alert subscribers, processed by Helcim)

3.2 Information Collected Automatically

• Device type, browser type, and operating system
• IP address and approximate geographic location (for finding nearby stands)
• Pages visited, time spent on pages, and referral sources
• Cookies and similar technologies (see Section 8)

3.3 Information We Do NOT Collect

• Credit card or bank account numbers (Helcim processes payments; we never see full card details)
• Interac e-Transfer details between farm owners and their customers
• Government-issued identification numbers
• Health information

4. How We Use Your Information

We use your personal information only for the following purposes:

5. Who We Share Your Information With

We do not sell, rent, or trade your personal information. We share information only as follows:

5.1 Public Information (by design)

When you create a farm stand listing on Kipos, the following information is displayed publicly: farm stand name, location (address and map pin), hours of operation, inventory items and prices, photos, and accepted payment methods. This is the core function of the Platform. You control what information appears on your listing.

5.2 Service Providers

• Amazon Web Services (AWS): Cloud hosting, data storage, and email delivery (servers in Canada and US)
• Helcim (Calgary, AB): Subscription payment processing

These providers access personal information only to perform services on our behalf and are contractually bound to protect it.

5.3 Legal Requirements

We may disclose personal information if required by law, regulation, or court order.

6. Data Storage and Security

Your data is stored on Amazon Web Services (AWS) infrastructure. We use the following security measures:

• Encryption in transit (TLS/SSL) for all data transmitted between your device and our servers
• Encryption at rest for database storage (AWS RDS encryption)
• Secure authentication via AWS Cognito with hashed passwords
• Access controls limiting data access to authorized systems and personnel
• Presigned URLs for image uploads with content-type validation
• Regular security reviews and monitoring

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We encourage you to use a strong, unique password for your Kipos account.

6.1 Data Location

Your data may be stored and processed in Canada and the United States (AWS data centers). When data is transferred outside of British Columbia, we ensure that equivalent protections are in place as required by PIPA.

7. Your Privacy Rights

Under BC PIPA, you have the following rights:

To exercise any of these rights, contact us at privacy@kipos.ca. We will respond within 30 days of receiving your request, as required by PIPA.

8. Cookies and Tracking

Kipos uses the following cookies and similar technologies:

• Essential cookies: Required for account authentication and security (session tokens). These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., preferred region). You can disable these in your browser settings.
• Analytics cookies: Help us understand how people use Kipos so we can improve it. You can opt out of analytics tracking through the cookie banner or your account settings.

Kipos does not use advertising cookies or sell data to advertising networks. We do not engage in cross-site tracking.

9. Email Communications and CASL Compliance

Kipos complies with Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23). We send the following types of emails:

9.1 Transactional Emails (no consent required under CASL)

• Account verification and password reset emails
• Subscription confirmation and billing receipts
• Service changes and security alerts

9.2 Commercial Electronic Messages (express consent required)

• Keyword alert notifications (e.g., "Strawberries are now available at Sunny Acres Farm")
• Weekly digest emails ("What's Fresh This Week")
• Platform news, feature announcements, and promotional offers

You provide express consent for these messages during account registration. Each commercial email includes: our name and contact information, a clear unsubscribe link that works within 10 business days, and identification of the message as coming from Kipos. You can manage your email preferences or unsubscribe at any time through your account dashboard or by clicking the unsubscribe link in any email.

10. Data Retention

• Active accounts: We retain your information for as long as your account is active.
• Closed accounts: We delete your personal information within 90 days of account closure, except where retention is required by law (e.g., financial records required by CRA).
• Consent records: We retain records of consent for a minimum of 3 years after consent is withdrawn, as recommended by CASL compliance guidelines.
• Server logs: Automatically deleted after 90 days.

11. Children's Privacy

Kipos is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 16, we will delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 30 days before the changes take effect. Your continued use of Kipos after changes are posted constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint:

• Email: privacy@kipos.ca
• Mail: Kipos, Privacy Officer, Campbell River, BC, Canada

If you are not satisfied with our response, you may contact the Office of the Information & Privacy Commissioner for British Columbia (OIPC):

• Website: www.oipc.bc.ca
• Phone: 250-387-5629 (Victoria) or 1-800-663-7867 (toll-free in BC)