Privacy Policy

Overview

This Privacy Policy explains how BurgundyBlend Inc., operating the BurgundyBlend mobile app and related services at burgundyblend.com ("BurgundyBlend," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information.

BurgundyBlend is based in Canada and handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws, and other laws that may apply in regions where the Platform is made available.

Effective date: June 30, 2026 · Last updated: July 26, 2026 · Contact: support@burgundyblend.com

1. Information We Collect

Account Information: name, email address, date of birth or age-verification status, account login method (Apple Sign-In, Google Sign-In, or email/password), and account type (customer or business).

Business Information: business name, address, service listings, prices, staff details, photos, availability, Stripe Connect payout status, and optional Instagram, TikTok, or Facebook handles supplied by a business.

Booking Information: services booked, appointment date and time, deposit amount, booking status, and cancellation status.

Location Information: approximate or precise location (if you allow location access), business location used for marketplace discovery and maps, and province, state, or region collected during business profile setup and marketplace operation.

Device and Technical Information: device ID or identifiers, Firebase Cloud Messaging (FCM) notification token, app version, device type and operating system, log data, diagnostics, crash data, and usage activity.

Payment-Related Information: deposit transaction status, booking fee, refund status, payment processing costs and any processing amounts allocated to a business, the source of a booking (whether it came from BurgundyBlend discovery or a link shared by the business) and whether the customer had previously booked that business, Stripe customer identifiers, Stripe payout identifiers, Stripe payment method identifiers, and limited saved-card metadata such as card brand, last four digits, and expiry month/year. We do not store full credit card or debit card numbers or CVV codes. Payment card data is processed by Stripe.

Support and Bug Report Information: information you submit through support requests, bug reports, report-an-issue flows, or emails to us, together with related account, device, app, booking, and technical context needed to investigate the report.

Search and Marketplace Activity: when a search returns no results, we record the search term, category, and general area (for example, city) so we know which services are in demand where and can recruit businesses to meet that demand. These records are not linked to your account or device: they contain no identifiers. When a public business profile is opened, we record an aggregate view count and the time it was last viewed on that business's profile. We do not attach a viewer identity, account ID, or device identifier to that profile-view record. We share the aggregate count with that business, not a list of viewers.

Business Profile Views: when anyone opens a business storefront, we increase a view counter stored on that business's own record and update the time it was last viewed. This is a count only. We do not attach your identity, your account, or your device to a profile view, and a business cannot see who viewed it. Businesses on paid plans can see their own total, and we may include it in a summary email to that business.

2. How We Use Information

We use personal information to create and manage accounts, verify customer and business eligibility and age requirements, review and approve business profiles, display business listings, enable bookings and payments, send booking confirmations, appointment reminders, account alerts, and service notifications, support customer and business interactions, investigate bug reports and support requests, detect fraud and enforce our Terms, improve and maintain the Platform, and comply with legal and regulatory obligations.

3. Push Notifications

Push notification delivery requires permission granted by you through your device settings. We may also send transactional emails, including booking confirmations, appointment reminders, account alerts, password reset emails, device approval emails, and support or bug-report messages. You may withdraw push notification permission at any time through your device settings. Withdrawing notification permission will prevent BurgundyBlend from sending push notifications to your device but will not affect your account.

4. Firebase and Firestore Storage

BurgundyBlend uses Firebase services, including Firestore, to store and manage app data. Information stored in Firebase may include account information, business profiles, service listings, booking records, device tokens, notifications, and operational data.

Firebase data may be stored or processed on servers located in Canada, the United States, or other jurisdictions depending on Google/Firebase infrastructure and configuration. Where information is processed outside Canada, it may be subject to the laws of that jurisdiction.

5. Third-Party Services

Stripe: processes booking deposit payments and manages business payouts through Stripe Connect.

Cloudflare Stream: used to store, process, and deliver video clips that businesses post to their profile and to The Chair feed. Cloudflare receives the video file itself and technical delivery data such as IP address and device type so playback can be adapted to your connection. Video is uploaded from the device straight to Cloudflare; it does not pass through our own servers. Cloudflare acts as our processor and is contractually restricted to providing the service to us.

Resend or other email delivery providers: used to send transactional emails such as booking confirmations, appointment reminders, support replies, account alerts, and bug-report notifications.

Google Maps: displays business locations and supports location-based marketplace features.

Apple Sign-In / Google Sign-In: used to authenticate users. These providers may supply basic account information based on user settings and consent.

Firebase Cloud Messaging: used to send push notifications, booking reminders, and account alerts.

Google reCAPTCHA: used to protect the Platform against abuse, spam, and fraud (for example, during sign-in and payout setup). Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

Crash reporting, diagnostics, hosting, and infrastructure providers: used to monitor, secure, troubleshoot, and operate the Platform.

Apple In-App Purchases: paid business subscriptions are billed through Apple. Apple manages subscription billing, renewals, cancellation, and refund requests under Apple's policies.

Google Play and Android: where you use BurgundyBlend through an Android application or Google Play, Google may process account, device, purchase, and diagnostic information under its own terms and privacy policy. BurgundyBlend receives and uses the information needed to provide the Platform, including account, booking, business, and support information described in this policy.

Redis: we may use Redis as an infrastructure processor to cache short-lived operational data and improve reliability and response times. Redis is not used to sell personal information or for advertising.

These third-party services may process personal information under their own terms and privacy policies.

5A. Cookies and Local Storage

We do not use cookies for advertising, tracking, or building a profile of you across other websites. We do not run advertising networks, social media pixels, or third-party analytics trackers.

The Platform stores a small amount of information in your own browser or device so that it works as expected. This information stays on your device, is not a cookie sent to us with every request, and is not used to identify you:

• Staying signed in. Your authentication session is stored by Firebase Authentication so you are not asked to sign in on every page.
• Interface preferences. Whether you have dismissed a prompt, such as the invitation to install the app, so it is not shown to you repeatedly.
• Booking source. If you arrive through a link a business shared, we record that for the length of your browsing session, because it determines the fee that business pays us. It is cleared when you close the tab.
• Offline and performance data. Cached content so pages load quickly and continue to work on a poor connection.

In the mobile app the equivalent information is stored in the app's own storage on your device and is removed when you delete the app.

You can clear this information at any time through your browser or device settings. Clearing it signs you out and restores any prompts you have dismissed.

Services that may set their own cookies. Some third parties described in section 5 may set cookies when they are active, including Stripe (payment processing and fraud prevention), Google reCAPTCHA (abuse prevention), and Google or Apple sign-in when you choose to use them. If we later enable product analytics, that provider may also set cookies. Where consent is required in your jurisdiction, we will ask for it before enabling any non-essential cookie, and we will update this policy before doing so.

6. When We Share Information

We may share personal information between customers and businesses as needed to complete bookings, with Stripe for payment processing and payouts, with Firebase/Google services for hosting and infrastructure, with Apple or Google for sign-in and subscription functions, with service providers who help us operate the Platform, where required by law or legal process, and to investigate fraud, safety issues, or policy violations.

We do not sell personal information to advertisers.

7. Your Rights Under Canadian Privacy Law

Subject to legal limits, you may have the right to request access to your personal information, request correction of inaccurate information, withdraw consent to certain uses, request deletion of your account and associated personal information, and file a privacy complaint with us or the Office of the Privacy Commissioner of Canada.

To make a privacy request, contact us at support@burgundyblend.com. We may need to verify your identity before responding.

8. Your California Privacy Rights (CCPA / CPRA)

This section applies to residents of California and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"). Terms such as "personal information," "sell," "share," and "sensitive personal information" have the meanings given in that legislation.

Categories of personal information we collect

In the past 12 months we have collected the following statutory categories:

• Identifiers: name, email address, phone number (if provided), account and device identifiers, IP address.
• Customer records: account and profile details, and limited payment metadata such as card brand, last four digits, and expiry (we never store full card numbers or CVV codes).
• Commercial information: services booked, appointment history, deposits, refunds, payouts, and subscription tier.
• Internet or network activity: app and website usage, feature interactions, diagnostic and crash data.
• Geolocation data: approximate or precise location where you enable it, and business addresses you provide.
• Visual information: profile, business, service, and portfolio photos you upload.
• Professional information: for businesses: business name, category, services, staff details, and payout status.
• Inferences: limited preferences such as favorites and recently viewed businesses, used to personalize discovery.

Sensitive personal information

We collect a limited amount of information that may be treated as sensitive: account log-in credentials (managed by Firebase Authentication), precise geolocation where you choose to enable it, and date of birth or age-verification status used to confirm eligibility. We use this information only to provide and secure the Platform, verify eligibility, and prevent fraud. We do not use or disclose sensitive personal information for purposes that would require offering a "Limit the Use of My Sensitive Personal Information" right, and we do not use it to infer characteristics about you.

Sources, purposes, and disclosures

Sources: directly from you; automatically from your device as you use the Platform; and from service providers such as Stripe, Apple, and Google (for example, payout status or sign-in confirmation).

Business and commercial purposes: operating the marketplace; creating and securing accounts; processing bookings, deposits, refunds, and payouts; sending transactional messages and reminders; providing customer support; preventing fraud and abuse; meeting legal, tax, and accounting obligations; and improving the Platform.

Disclosures for a business purpose: we disclose personal information to service providers and contractors under written agreements limiting their use of it, including Stripe (payments and payouts), Google/Firebase (hosting, database, authentication, notifications, reCAPTCHA), Apple and Google (sign-in and subscription billing), and email delivery providers. We also share booking-related information between a customer and the business they book with, as necessary to complete the appointment.

We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

Your rights

• Right to know / access: the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Right to delete: request deletion of personal information we have collected, subject to legal exceptions (for example, records we must keep for tax, accounting, fraud-prevention, or dispute-resolution purposes).
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, there is nothing to opt out of; we also honor Global Privacy Control (GPC) signals where applicable.
• Right to limit the use and disclosure of sensitive personal information, where applicable.
• Right to non-discrimination: we will not deny you service, charge you a different price, or provide a different level of quality because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.

How to exercise your rights

You can access and download a copy of your data, or delete your account, directly in the app. You may also submit a request by emailing support@burgundyblend.com with the subject line "California Privacy Request."

We will confirm receipt within 10 business days and respond within 45 days, and may extend once by a further 45 days where reasonably necessary, with notice to you. To protect your information, we must verify your identity, typically by confirming control of the email address on the account, and for sensitive requests by asking for additional information matching our records. An authorized agent may submit a request on your behalf with written permission and proof of authority; we may still ask you to verify your identity directly.

Shine the Light

California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

8A. Other U.S. State Privacy Rights

If you are a resident of another U.S. state with a comprehensive privacy law (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others as they take effect), you may have similar rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale of personal data, or certain profiling. As described above, we do not sell personal data, do not engage in targeted advertising, and do not carry out profiling that produces legal or similarly significant effects.

Some of these laws provide a right to appeal a decision about a privacy request. If we decline your request, you may appeal by replying to our response or writing to support@burgundyblend.com with the subject line "Privacy Appeal." We will respond within the period required by your state's law and, if we deny the appeal, tell you how to contact your state Attorney General.

8B. European Economic Area, United Kingdom, and Swiss Users (GDPR)

BurgundyBlend is operated from Canada and is intended for users in Canada and the United States. If you access the Platform from the European Economic Area, the United Kingdom, or Switzerland, the following applies to the extent the EU or UK General Data Protection Regulation governs our processing.

Controller. BurgundyBlend Inc., Calgary, Alberta, Canada, is the controller of personal data processed through the Platform. Contact: support@burgundyblend.com.

Legal bases. We process personal data to perform our contract with you (creating your account, processing bookings, deposits, and payouts); for our legitimate interests (securing the Platform, preventing fraud and abuse, improving our services, and communicating about your account); to comply with legal obligations (tax, accounting, and record-keeping); and with your consent where required (for example, push notifications and precise location). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Your rights. Subject to conditions and exceptions in applicable law, you may request access to your personal data; correction of inaccurate data; erasure; restriction of processing; portability of data you provided to us in a structured, commonly used, machine-readable format; and you may object to processing based on legitimate interests. You may also object at any time to processing for direct marketing.

International transfers. Personal data is processed and stored on infrastructure operated by our providers (including Google/Firebase and Stripe), which may be located in Canada, the United States, or other countries. Canada is recognized by the European Commission as providing an adequate level of protection for personal data transferred to recipients subject to PIPEDA. Where an adequacy decision does not apply, transfers are made under appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with the technical and organizational measures described in this Privacy Policy.

Retention. We keep personal data only as long as necessary for the purposes described in this Privacy Policy, as set out in "How Long We Keep Information" below.

Complaints. You have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office (ICO) if you are in the United Kingdom. We would appreciate the opportunity to address your concerns first, so please contact us at support@burgundyblend.com.

9. Account and Data Deletion

Users may delete their accounts at any time through the app. After deletion, we will delete or de-identify personal information associated with the account where possible, subject to information we must retain for legal, tax, payment, refund, chargeback, fraud prevention, security, dispute resolution, or business record purposes. For businesses, Stripe Connect accounts may only be deleted where allowed by Stripe and where there is no financial history requiring retention.

9A. Consent and Legal Basis

We collect, use, and disclose personal information with your consent, or as otherwise permitted or required by law. By creating an account and using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

In some cases we rely on other lawful bases, including performing our contract with you (for example, processing a booking or deposit), our legitimate interests (for example, securing the Platform, preventing fraud and abuse, and improving our services), and compliance with legal, tax, accounting, and regulatory obligations.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide some or all of the Platform to you. We record when you accept our Terms and Privacy Policy, and the version accepted, as evidence of consent.

9B. How Long We Keep Information

We keep personal information only as long as necessary for the purposes described in this Privacy Policy, or as required by law.

In general: account and profile information is kept while your account is active; booking, deposit, refund, payout, and invoice records are kept for the period required by tax, accounting, and financial record-keeping obligations (commonly up to seven years in Canada); support, complaint, safety, and moderation records are kept as long as needed to handle the matter and to maintain a record of enforcement decisions; and security, fraud-prevention, and audit logs are kept for a limited period appropriate to their purpose.

When information is no longer needed, we delete it or de-identify it so it can no longer be associated with you.

9D. United Kingdom and EEA

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to our processing of your personal data. If you are in the European Economic Area, the EU GDPR applies. In both cases BurgundyBlend Inc. is the controller of the personal data described in this policy, and the rights set out in section 7 and section 9A apply to you, including the rights of access, rectification, erasure, restriction, portability, and objection.

Where your data goes. We are based in Canada and use processors located in Canada, the United States, and the European Union, including Google (Firebase), Stripe, Cloudflare, and our email provider. Where personal data is transferred out of the United Kingdom or the EEA, we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an applicable adequacy decision. Canada holds a partial adequacy decision from the European Commission for commercial organisations.

Complaints. If you are in the United Kingdom you may lodge a complaint with the Information Commissioner's Office at ico.org.uk. If you are in the EEA you may complain to your local supervisory authority. We would appreciate the chance to resolve your concern first at support@burgundyblend.com.

Video content. Clips posted by businesses are public. If you appear in a clip and want it removed, contact us at support@burgundyblend.com and we will act on it. You do not need an account to make that request.

9C. Children's Privacy

The Platform is intended for adults. Accounts are restricted to users who are at least 18 years old, or the age of majority in their jurisdiction. We do not knowingly collect personal information from children.

If a service is intended for a minor, it must be booked and supervised by a parent or legal guardian using that adult's own account. If we learn that we have collected personal information directly from a child, we will take reasonable steps to delete it. If you believe a child has provided us with personal information, contact us at support@burgundyblend.com.

10. Security

We use reasonable administrative, technical, and organizational safeguards to protect personal information. No app or internet transmission is completely secure. Users are responsible for protecting their login credentials and notifying us of suspected unauthorized account access.

10A. Data Breach Notification

We maintain safeguards designed to protect personal information, but no method of transmission or storage is completely secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the applicable privacy regulator (including the Office of the Privacy Commissioner of Canada) as required by law, and will keep records of breaches as required.

You are responsible for keeping your password confidential and for notifying us promptly at support@burgundyblend.com if you believe your account has been accessed without authorization.

10B. Automated Decision-Making and Profiling

We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement. We do use automated systems for fraud prevention, abuse detection, security scoring (including Google reCAPTCHA), and for ranking and sorting marketplace listings and search results. Business verification and approval decisions involve human review.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where appropriate, we will notify users of material changes through the app, by email, or by other reasonable means. The "last updated" date at the top of this page indicates when it was last revised, and continued use of the Platform after an update means you accept the revised Privacy Policy.

Contact

For privacy questions, requests, or complaints:
BurgundyBlend Inc.
Email: support@burgundyblend.com · @burgundyblend on Instagram