Skip to content

Privacy Policy

Last updated: November 8, 2026

Overview

This Privacy Policy explains how BurgundyBlend Inc., operating the BurgundyBlend mobile apps, web app at app.burgundyblend.com and related services at burgundyblend.com ("BurgundyBlend," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information.

BurgundyBlend is based in Canada and handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws, and other laws that may apply in regions where the Platform is made available.

Effective date: June 30, 2026 · Last updated: November 8, 2026 · Contact: support@burgundyblend.com

1. Information We Collect

Account Information: name, email address, date of birth or age-verification status, account login method (Apple Sign-In, Google Sign-In, or email/password), and account type (customer or business).

Business Information: business name, address, service listings, prices, staff details, photos, availability, Stripe Connect payout status, and optional Instagram, TikTok, or Facebook handles supplied by a business.

Booking Information: services booked, appointment date and time, deposit amount, booking status, and cancellation status.

Location Information: approximate or precise location (if you allow location access), business location used for marketplace discovery and maps, and province, state, or region collected during business profile setup and marketplace operation.

Device and Technical Information: device ID or identifiers, Firebase Cloud Messaging (FCM) notification token, app version, device type and operating system, log data, diagnostics, crash data, and usage activity.

Payment-Related Information: web subscription plan, billing provider, subscription and invoice identifiers, billing status and periods, trial eligibility and usage, promotion details, currency and tax amounts, separate optional card-tip records, deposit transaction status, booking fee, refund status, payment processing costs and any processing amounts allocated to a business, the source of a booking (whether it came from BurgundyBlend discovery or a link shared by the business) and whether the customer had previously booked that business, Stripe customer identifiers, Stripe payout identifiers, Stripe payment method identifiers, and limited saved-card metadata such as card brand, last four digits, and expiry month/year. We do not store full credit card or debit card numbers or CVV codes. Payment card data is processed by Stripe.

Support and Bug Report Information: information you submit through support requests, bug reports, report-an-issue flows, or emails to us, together with related account, device, app, booking, and technical context needed to investigate the report.

Search and Marketplace Activity: when a search returns no results, we record the search term, category, and general area (for example, city) so we know which services are in demand where and can recruit businesses to meet that demand. These records are not linked to your account or device: they contain no identifiers. When a public business profile is opened, we record an aggregate view count and the time it was last viewed on that business's profile. We do not attach a viewer identity, account ID, or device identifier to that profile-view record. We share the aggregate count with that business, not a list of viewers.

Business Profile Views: when anyone opens a business storefront, we increase a view counter stored on that business's own record and update the time it was last viewed. This is a count only. We do not attach your identity, your account, or your device to a profile view, and a business cannot see who viewed it. Businesses on paid plans can see their own total, and we may include it in a summary email to that business.

Service Request Information: when you post a request, we collect what you ask for (title, description, categories), the dates you are free, any budget you set, your city and province or state, and up to five photographs and one video if you attach them. Your request shows professionals your first name and your city. It does not show your surname, your street address, your email address or your phone number, and a request containing a phone number, an email address or an apparent street address is refused rather than published. Your location is rounded to roughly one kilometre before it is stored, so a professional sees a neighbourhood rather than an address.

Request Attachments: photographs and video you attach to a request are stored so that they can be shown to professionals who can see that request. Treat them as visible to strangers you have not met: do not attach images containing your address, identity documents, or other people who have not agreed to appear. You can remove an attachment before posting, and use available editing or deletion controls for your requests. Account deletion is handled under section 9, including any lawful retention exceptions.

Quotes: a professional's reply to your request (their price, the time they offer, their message and a clip of their work) is visible to you and to that professional only. No professional can see another professional's quote.

Appointment Messages: messages exchanged between a customer and a business about a confirmed booking, including who sent each message and when. These are readable by the customer, the business owner and the professional assigned to that appointment, and by us where we need to investigate abuse, a support request, or a legal obligation. Messaging is scoped to one appointment: there is no general inbox, and you cannot message a business you have not booked.

1A. Business Imports, Exports and Team Profiles

A business may give us records from its previous system, including client names, email addresses, telephone numbers, notes, staff details, services and appointment records. These records can concern people who do not have a BurgundyBlend account. We process them to provide that business’s migration, client management and scheduling features. Imported client contacts are not public marketplace profiles and importing them does not create accounts or establish marketing consent. The importing business is responsible for its authority to provide the records and the notices required for its clients and staff.

Business owners can export supported records. Once downloaded, those files are outside BurgundyBlend’s access controls and must be protected by the business. Public employee storefronts may show a professional’s name, biography, work photos, services and bookable hours; account credentials and private staff contact records are not part of the public storefront. Access to private business records depends on the account’s role and permissions.

If a business imported your information, you can contact that business or support@burgundyblend.com about access, correction or deletion. We may need to verify your identity and coordinate with the business, subject to applicable law and records that must be retained.

1B. Private Finance Declarations and Reporting Records

Business owners may supply a legal seller name, legal form, country of establishment or residence, service description, declared treatment of listed prices, sales-tax registration or permit numbers, registration status and effective dates. We also keep declaration revisions, the account that made them, reviewed location-to-legal-business mappings, and payment comparison records showing relevant processor identifiers, amounts, currencies, dates and differences requiring review.

We use these records for the requested bookkeeping and reporting features, correcting errors, reconciling payments, support, fraud prevention and applicable accounting or legal obligations. New private finance declaration records are not part of a public storefront. Access is restricted to the business owner through authorised server routes and to authorised administration functions. Information you separately put in a public business profile remains subject to that profile's visibility.

Stripe may collect identity, bank and taxpayer information directly for its verification, payment and reporting processes under its own privacy terms. Our ordinary finance declaration form is not a place to provide a SIN, SSN, federal income-tax identifier, tax identity document or bank credentials. If additional information is legally required, the appropriate purpose and secure collection process must be identified rather than requesting it in a public field or ordinary support message.

We may disclose relevant seller and transaction information to tax authorities or other competent authorities where required or permitted by applicable law. This is separate from publishing a storefront or giving a business a transaction summary. A downloaded file is outside our access controls; protect it and share it only with an appropriate recipient. These features do not mean a tax return has already been filed.

1C. Intake Forms and Reminder Preferences

Where available, businesses create intake questions and customers submit answers for an appointment. Answers may include allergies, sensitivities or other health-related information you choose to provide. They are private appointment records available to the customer and authorised business users under the relevant permissions, and to authorised support or administration where necessary. They are not public storefront content. Provide only information relevant to the service; do not submit identity documents, payment credentials or unnecessary sensitive information.

Where SMS reminders are enabled, we process your verified telephone number, opt-in and opt-out status, verification attempts and message-delivery records. The SMS provider receives the number and message content. SMS is optional and separately consented to; disable it in preferences or reply STOP. We use minimum suppression information where necessary to respect opt-outs. Intake invitations are sent only when the feature is enabled and an eligible appointment has a form; the invitation email does not include your answers.

2. How We Use Information

We use personal information to create and manage accounts, verify customer and business eligibility and age requirements, review and approve business profiles, display business listings, enable bookings and payments, send booking confirmations, appointment reminders, account alerts, and service notifications, support customer and business interactions, match service requests to nearby professionals and deliver their quotes to you, carry messages between a customer and a business about a confirmed appointment, investigate bug reports and support requests, detect fraud and enforce our Terms, improve and maintain the Platform, and comply with legal and regulatory obligations.

2A. Advertising and Marketing Communications

We advertise BurgundyBlend on Facebook and Instagram to reach people in Canada and the United States. Meta processes activity on its own services to deliver ads and report campaign performance under its own Privacy Policy. You can manage ad preferences through Meta’s settings. Seeing or clicking an ad does not create a BurgundyBlend account or subscribe you to our promotional emails.

When you follow an ad to our website or app, the information we process there is described in this policy. Links may include campaign or referral parameters, and our hosting providers may receive ordinary request information such as your IP address and the requested URL. We do not currently embed a Meta Pixel or use Meta’s Conversions API on our marketing website. Before introducing advertising trackers, retargeting integrations or uploaded customer audiences, we will review the data involved, update this notice and provide any consent or opt-out controls required by applicable law. Private client imports, appointment messages and request attachments are not permission to use that information for advertising.

We require consent or another basis permitted by applicable law before sending promotional messages. Creating an account, accepting this policy, making a booking or having your details imported by a business does not by itself opt you into promotional messages. You may use the opt-out instructions in a promotional message or email support@burgundyblend.com to ask us to stop. We may retain the minimum contact and opt-out information needed to respect that request. Opting out of marketing does not stop necessary booking, payment, security or legal communications.

3. Push Notifications

Push notification delivery requires permission granted by you through your device settings. We may also send transactional emails, including booking confirmations, appointment reminders, account alerts, password reset emails, device approval emails, and support or bug-report messages. Rebooking suggestions and promotional offers are distinct from essential appointment reminders; where sent, their opt-out instructions apply as described in section 2A. You may withdraw push notification permission at any time through your device settings. Withdrawing notification permission will prevent BurgundyBlend from sending push notifications to your device but will not affect your account.

4. Firebase and Firestore Storage

BurgundyBlend uses Firebase services, including Firestore, to store and manage app data. Information stored in Firebase may include account information, business profiles, service listings, booking records, device tokens, notifications, and operational data.

Firebase data may be stored or processed on servers located in Canada, the United States, or other jurisdictions depending on Google/Firebase infrastructure and configuration. Where information is processed outside Canada, it may be subject to the laws of that jurisdiction.

5. Third-Party Services

Stripe: processes partial or full booking payments, optional card tips and web subscription billing, including invoices, discounts, payment-method management and applicable subscription tax calculation. It supports business identity and payout verification and manages transfers and payouts through Stripe Connect. Stripe also processes information for its own legal and regulatory purposes under its privacy terms.

Cloudflare Stream: used to store, process, and deliver video clips that businesses post to their profile and to The Chair feed. Cloudflare receives the video file itself and technical delivery data such as IP address and device type so playback can be adapted to your connection. Video is uploaded from the device straight to Cloudflare; it does not pass through our own servers. Cloudflare acts as our processor and is contractually restricted to providing the service to us.

Resend or other email delivery providers: used to send transactional emails such as booking confirmations, appointment reminders, support replies, account alerts, and bug-report notifications.

Google Maps Platform: provides maps, address suggestions and geocoding where configured. When you use address search, the text you type is sent to Google to return suggestions. If you request address lookup from your current location, the coordinates used for that lookup are sent to Google after you grant location permission. Google also receives technical request information such as your IP address. Selected address details and coordinates are used to populate the business profile and support discovery. A published business address and map position can be publicly visible, including a home address you choose to use. You can type an address manually and decline device location access. Google processes information under its Privacy Policy; Maps features are also subject to Google Maps/Google Earth Additional Terms of Service.

Apple Sign-In / Google Sign-In: used to authenticate users. These providers may supply basic account information based on user settings and consent.

Firebase Cloud Messaging: used to send push notifications, booking reminders, and account alerts.

Google reCAPTCHA: used to protect the Platform against abuse, spam, and fraud (for example, during sign-in and payout setup). Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

Crash reporting, diagnostics, hosting, and infrastructure providers: used to monitor, secure, troubleshoot, and operate the Platform.

Apple In-App Purchases: paid business subscriptions are billed through Apple. Apple manages subscription billing, renewals, cancellation, and refund requests under Apple's policies.

Google Play and Android: where you use BurgundyBlend through an Android application or Google Play, Google may process account, device, purchase, and diagnostic information under its own terms and privacy policy. BurgundyBlend receives and uses the information needed to provide the Platform, including account, booking, business, and support information described in this policy.

Twilio: where optional SMS is enabled, verifies opted-in telephone numbers and delivers transactional reminders, processing telephone numbers, verification and delivery information, message content and opt-out signals. Availability depends on service configuration.

Redis: we may use Redis as an infrastructure processor to cache short-lived operational data and improve reliability and response times. Redis is not used to sell personal information or for advertising.

These third-party services may process personal information under their own terms and privacy policies.

5A. Cookies and Local Storage

Our marketing website does not currently embed advertising cookies, social media pixels or third-party analytics trackers. Ads displayed on Facebook and Instagram are separate from tracking tools on our own site, as explained in section 2A. Essential third-party services may use cookies as described below.

The Platform stores a small amount of information in your own browser or device so that it works as expected. Some of this information, particularly authentication session data, is associated with your account and is used to keep you signed in. Local storage differs from cookies, which can be sent with web requests:

In the mobile app the equivalent information is stored in the app's own storage on your device and is removed when you delete the app.

You can clear this information at any time through your browser or device settings. Clearing it signs you out and restores any prompts you have dismissed.

Services that may set their own cookies. Some third parties described in section 5 may set cookies when they are active, including Stripe (payment processing and fraud prevention), Google reCAPTCHA (abuse prevention), and Google or Apple sign-in when you choose to use them. If we later enable product analytics, that provider may also set cookies. Where consent is required in your jurisdiction, we will ask for it before enabling any non-essential cookie, and we will update this policy before doing so.

6. When We Share Information

We may share personal information between customers and businesses as needed to complete bookings, with Stripe for payment processing and payouts, with Firebase/Google services for hosting and infrastructure, with Apple or Google for sign-in and subscription functions, with service providers who help us operate the Platform, where required by law or legal process, and to investigate fraud, safety issues, or policy violations.

We do not sell personal information to advertisers.

7. Your Rights Under Canadian Privacy Law

Subject to legal limits, you may have the right to request access to your personal information, request correction of inaccurate information, withdraw consent to certain uses, request deletion of your account and associated personal information, and file a privacy complaint with us or the applicable regulator, including the Office of the Privacy Commissioner of Canada or a provincial privacy commissioner such as Alberta’s Office of the Information and Privacy Commissioner.

To make a privacy request, contact us at support@burgundyblend.com. We may need to verify your identity before responding.

8. Your California Privacy Rights (CCPA / CPRA)

This section applies to residents of California and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"). Terms such as "personal information," "sell," "share," and "sensitive personal information" have the meanings given in that legislation.

Categories of personal information we collect

Depending on the features you use and the information you provide, the categories we collect include:

Sensitive personal information

We collect a limited amount of information that may be treated as sensitive: account log-in credentials (managed by Firebase Authentication), precise geolocation where you choose to enable it, date of birth or age-verification status used to confirm eligibility, and health-related answers you choose to submit in an intake form. We use this information only to provide and secure the Platform, verify eligibility, and prevent fraud. We do not use or disclose sensitive personal information for purposes that would require offering a "Limit the Use of My Sensitive Personal Information" right, and we do not use it to infer characteristics about you.

Sources, purposes, and disclosures

Sources: directly from you; automatically from your device as you use the Platform; from businesses that import or manage client, staff or appointment records; and from service providers such as Stripe, Apple, and Google (for example, payout status or sign-in confirmation).

Business and commercial purposes: operating the marketplace; creating and securing accounts; processing bookings, deposits, refunds, and payouts; sending transactional messages and reminders; matching service requests to nearby professionals and delivering quotes; carrying messages about a confirmed appointment; providing customer support; preventing fraud and abuse; meeting legal, tax, and accounting obligations; and improving the Platform.

Disclosures for a business purpose: we disclose personal information to service providers and contractors under written agreements limiting their use of it, including Stripe (payments and payouts), Google/Firebase (hosting, database, authentication, notifications, reCAPTCHA), Apple and Google (sign-in and subscription billing), and email delivery providers. We also share booking-related information between a customer and the business they book with, as necessary to complete the appointment.

We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

Your rights

How to exercise your rights

You can access and download a copy of your data, or delete your account, directly in the app. You may also submit a request by emailing support@burgundyblend.com with the subject line "California Privacy Request."

We will confirm receipt within 10 business days and respond within 45 days, and may extend once by a further 45 days where reasonably necessary, with notice to you. To protect your information, we must verify your identity, typically by confirming control of the email address on the account, and for sensitive requests by asking for additional information matching our records. An authorized agent may submit a request on your behalf with written permission and proof of authority; we may still ask you to verify your identity directly.

Shine the Light

California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

8A. Other U.S. State Privacy Rights

If you are a resident of another U.S. state with a comprehensive privacy law (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others as they take effect), you may have similar rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale of personal data, or certain profiling. As described above, we do not sell personal data, do not engage in targeted advertising, and do not carry out profiling that produces legal or similarly significant effects.

Some of these laws provide a right to appeal a decision about a privacy request. If we decline your request, you may appeal by replying to our response or writing to support@burgundyblend.com with the subject line "Privacy Appeal." We will respond within the period required by your state's law and, if we deny the appeal, tell you how to contact your state Attorney General.

8B. European Economic Area, United Kingdom, and Swiss Users (GDPR)

BurgundyBlend is operated from Canada and is intended for users in Canada and the United States. If you access the Platform from the European Economic Area, the United Kingdom, or Switzerland, the following applies to the extent the EU or UK General Data Protection Regulation governs our processing.

Controller. BurgundyBlend Inc., Calgary, Alberta, Canada, is the controller of personal data processed through the Platform. Contact: support@burgundyblend.com.

Legal bases. We process personal data to perform our contract with you (creating your account, processing bookings, deposits, and payouts); for our legitimate interests (securing the Platform, preventing fraud and abuse, improving our services, and communicating about your account); to comply with legal obligations (tax, accounting, and record-keeping); and with your consent where required (for example, push notifications and precise location). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Your rights. Subject to conditions and exceptions in applicable law, you may request access to your personal data; correction of inaccurate data; erasure; restriction of processing; portability of data you provided to us in a structured, commonly used, machine-readable format; and you may object to processing based on legitimate interests. You may also object at any time to processing for direct marketing.

International transfers. Personal data is processed and stored on infrastructure operated by our providers (including Google/Firebase and Stripe), which may be located in Canada, the United States, or other countries. Canada is recognized by the European Commission as providing an adequate level of protection for personal data transferred to recipients subject to PIPEDA. Where applicable law requires a transfer safeguard, an appropriate legal mechanism and any required supplementary measures must apply. Contact us for information about the safeguards relevant to your data; the location of a provider alone does not establish that a transfer is authorised.

Retention. We keep personal data only as long as necessary for the purposes described in this Privacy Policy, as set out in "How Long We Keep Information" below.

Complaints. You have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office (ICO) if you are in the United Kingdom. We would appreciate the opportunity to address your concerns first, so please contact us at support@burgundyblend.com.

9. Account and Data Deletion

Users may request account deletion through the app or by contacting support as explained on our account deletion page. Cancel subscriptions with the billing provider before deleting your account; deletion does not itself cancel billing. After deletion, we will delete or de-identify personal information associated with the account where possible, subject to information we must retain for legal, tax, payment, refund, chargeback, fraud prevention, security, dispute resolution, or business record purposes. For businesses, Stripe Connect accounts may only be deleted where allowed by Stripe and where there is no financial history requiring retention.

9A. Consent and Legal Basis

We collect, use, and disclose personal information with your consent, or as otherwise permitted or required by law. This policy explains our practices; it does not replace a separate consent choice where one is required. Essential processing needed to deliver a requested service is distinguished from optional uses such as promotional messages.

In some cases we rely on other lawful bases, including performing our contract with you (for example, processing a booking or deposit), our legitimate interests (for example, securing the Platform, preventing fraud and abuse, and improving our services), and compliance with legal, tax, accounting, and regulatory obligations.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide some or all of the Platform to you. Acceptance of the Terms and acknowledgement of this policy are separate from consent to optional marketing. Contact us if you want to change a consent choice.

9B. How Long We Keep Information

We keep personal information only as long as necessary for the purposes described in this Privacy Policy, or as required by law.

In general: account and profile information is kept while your account is active; booking, payment, refund, payout, invoice, finance-declaration and related audit records are retained for applicable tax, accounting, legal and dispute requirements. Canadian GST/HST records generally must be kept for six years after the end of the year to which they relate, and some records or legal holds require longer retention; this is not a promise of automatic deletion on a fixed anniversary; support, complaint, safety, and moderation records are kept as long as needed to handle the matter and to maintain a record of enforcement decisions; and security, fraud-prevention, and audit logs are kept for a limited period appropriate to their purpose.

When information is no longer needed, we delete it or de-identify it so it can no longer be associated with you.

10. Security

We use reasonable administrative, technical, and organizational safeguards to protect personal information. No app or internet transmission is completely secure. Users are responsible for protecting their login credentials and notifying us of suspected unauthorized account access.

10A. Data Breach Notification

We maintain safeguards designed to protect personal information, but no method of transmission or storage is completely secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the applicable privacy regulator (including the Office of the Privacy Commissioner of Canada) as required by law, and will keep records of breaches as required.

You are responsible for keeping your password confidential and for notifying us promptly at support@burgundyblend.com if you believe your account has been accessed without authorization.

10B. Automated Decision-Making and Profiling

We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement. We do use automated systems for fraud prevention, abuse detection, security scoring (including Google reCAPTCHA), and for ranking and sorting marketplace listings and search results. Automated rules may also use booking and cancellation history to adjust required deposits or withhold an opening badge, and subscription tier may affect marketplace placement. Business verification and approval decisions involve human review. Contact support if you believe a record or an automated outcome is incorrect.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where appropriate, we will notify users of material changes through the app, by email, or by other reasonable means. The "last updated" date at the top of this page indicates when it was last revised, and we will obtain fresh consent where required before using personal information for a materially different purpose. Continued use alone does not supply consent where the law requires a separate choice.

Contact

For privacy questions, requests, or complaints:
BurgundyBlend Inc.
Email: support@burgundyblend.com · @burgundyblend on Instagram