Legal
Privacy policy
What personal information Grizzlee collects, why, where it is stored, how long it is kept and how to exercise your rights.
1. Who this policy covers
Karl Rizk, sole proprietor, of Montréal, Québec, Canada, operates Grizzlee, software that businesses use to run referral, affiliate and loyalty programs. This policy calls those businesses merchants. Our terms of service call them the Customer. This policy explains how we handle personal information in two different roles.
When we decide how information is used
We are responsible for the information of the people who use the Grizzlee dashboard for a business, called team members, for the sign-in accounts partners create to use the partner portal, for visitors to grizzlee.ca and for people who write to us. Under the GDPR we are the controller of this information.
When we act for a merchant
Merchants store information in Grizzlee about their partners, their customers, their loyalty card holders, people who play their counter game and their scanner staff. We handle that information only on the merchant's instructions, under our data processing agreement. The merchant is responsible for it and its own privacy notice applies. Under the GDPR we are the merchant's processor. Under Canadian law the merchant remains accountable for information it transfers to us for processing. Under California law we are its service provider.
If you are a merchant's partner, customer or card holder, ask that merchant about your information first. This policy still tells you what Grizzlee does with it.
2. Information about team members
- Account details: your name, email address and password. Supabase stores the password for us. If you sign in with Google, we receive the name and email of your Google account. Grizzlee keeps a copy of your name and email and your dashboard language.
- Company details: the company name, currency, content languages and the support email the company sets for partner emails.
- Your role in the company, when you joined, and invitations, which store the invited email address and expire after 7 days.
- Acceptance of the terms: the version of the terms of service accepted when a company is created, the time and the account that accepted it.
- Billing details: the company name and the email of the person who subscribes, sent to Stripe. Stripe collects the payment card. We never see the full card number.
- Activity records: an activity history of changes to programs, rewards and payouts, and for loyalty, which team member gave each stamp or point.
- Messages you send us, such as support requests, and our replies.
Where it comes from
Most of this information comes from you. An invitation comes from the team member who invited you. Google supplies your name and email if you choose to sign in with Google. Stripe tells us whether a payment succeeded.
What you must provide
A name, an email address and a password, or a Google account, are needed to create a login. A company name and currency are needed to create a company, and payment details are needed to subscribe. Without them we cannot provide the Service. Everything else is optional.
3. Partner sign-in accounts
A partner who uses the partner portal signs in with a Grizzlee login. One login can belong to the programs of several merchants, so Grizzlee is responsible for the login itself: the name, email address, password, sign-in sessions and, for Google sign-in, the name and email of the Google account. We use it to let you sign in, keep your access secure and show you each program you belong to.
Your rewards, payouts, referral codes and the other information a merchant keeps about you in its program belong to that merchant, as the next section describes.
4. Information we process for merchants
What a merchant stores depends on the features it uses. Grizzlee can hold:
Partners
- Name, email address, the merchant's own ID for the partner, referral codes, labels and other fields the merchant adds, and language.
- The ID of the partner's Stripe connected account, when the merchant pays through Stripe. Grizzlee stores no bank account, tax number or postal address for partners.
- Rewards, payouts and their history, the customers linked to the partner, and a record of each email sent, with its type, status and recipient address but not its content.
The merchant's customers
- The merchant's customer ID, an optional display name, the email address on an order when the merchant or its store sends one, orders, amounts, refunds and which partner referred the customer.
- Records of referral link visits: the program, partner, channel and time.
- The ID Stripe gives the customer and the charge or invoice IDs, when the merchant connects Stripe.
- The complete order, charge, invoice and refund messages that the merchant's Stripe account or Shopify store sends, as the provider sends them. These can include names, contact details and addresses. Grizzlee stores them encrypted.
Identity signals for fraud checks
To catch partners who refer themselves or open repeat accounts, a merchant's server can send an email address, phone number, payment card fingerprint, device or app ID, or IP address with a partner or customer. Stripe charges and invoices also supply the billing email, phone and card fingerprint. Grizzlee never stores the original values of these signals. It stores a keyed hash of each one, made with a secret key for that merchant, and compares hashes within that merchant's records only.
Grizzlee may also record signals it sees itself, hashed the same way: the visitor's IP address and the device identifier from Grizzlee's SDK when someone follows a referral link, the partner's IP address when a partner joins a program or opens the partner portal, the card fingerprint of the Stripe charge that paid an invoice, and the browser IP address a Shopify order reports. Grizzlee does not store the original IP address, device identifier or card fingerprint on its servers.
A referral link visit keeps its hashes until an order or sign-up claims the referral. They then move to that customer's record. Hashes on visits that are never claimed have no expiry yet. IPv6 addresses are compared by network. An IP address stops counting 30 days after it was last seen, and a match on an IP address alone never blocks a reward.
Loyalty card holders and game players
- Name, email address or phone number, an optional birthday, language, and whether the holder agreed to receive marketing messages, with when and where they agreed.
- The card, its member code, balance, visits, rewards, prize plays and prizes won, and messages sent to the card.
- For the counter game, a hash of a random value stored in the player's browser, used to limit plays.
- For Apple Wallet, the device ID and push token Apple gives each device that saves the pass. For Google Wallet, when the pass was saved or removed.
Wallet passes show the store locations the merchant chooses, so the phone can show the card near the store. The phone decides this on its own. Grizzlee never receives a card holder's location.
Scanner staff
Merchant staff who use a loyalty scanner without a Grizzlee login are recorded by name, with a salted hash of their PIN, and each stamp or point they give is recorded.
5. Information collected automatically
To limit abuse, Grizzlee counts requests per minute to public pages and endpoints, such as card sign-up, wallet downloads, the counter game and scanner pairing. Each counter is stored under a SHA-256 hash of a label that includes the IP address. A hash of an IP address can sometimes be reversed, so we treat these counters as personal information.
Apart from these counters and the hashed fraud signals described above, Grizzlee does not store IP addresses or browser details.
The server keeps a technical log of errors for operating the Service. It is limited in size, and the oldest entries are overwritten.
7. Automated decisions
Grizzlee makes no decision about team members or partner logins based only on automated processing.
Merchants can turn on fraud and self-referral rules that act automatically. When a partner and a referred customer share an identity signal, or several referred customers share one, a rule can block the reward and any welcome offer without anyone reviewing it, hold the reward for the merchant to review, or only flag it. The main factors are which kinds of signal matched, such as a card or device, how many customers shared them and over what period, and whether the email address uses a disposable domain. Grizzlee records which rules fired and which kinds of signal matched.
The merchant chooses these rules and is responsible for the decision. If a decision affected you, ask the merchant what information and factors it was based on and ask a person there to review it. If you write to us, we will pass your request to the merchant.
8. How we use information
For the information we control, these are our purposes and, where the GDPR applies, the legal basis for each:
- To provide the Service, including sign-in, company accounts, team roles and the partner portal: the contract with you or your company.
- To bill for Grizzlee and keep financial records: the contract, and our legal obligations for tax and accounting records.
- To keep the Service secure and prevent fraud and abuse, including rate limits and security monitoring: our legitimate interest in a secure service that is not misused.
- To support customers and answer messages: the contract, or our legitimate interest in answering people who write to us.
- To send service and legal notices and tell owners about changes to the Service or these documents: the contract and our legal obligations.
- To meet legal obligations and to establish or defend legal claims: those obligations, and our legitimate interest in protecting our rights.
We use information we process for merchants only to provide the Service to that merchant, as the data processing agreement describes. The merchant chooses the legal basis for that information.
9. Consent
We collect only what these purposes need, and we do not use information for a new purpose without consent unless the law allows it. By creating an account you consent to the uses this policy describes for your information. You can withdraw consent by closing your account, which ends the Service for you, subject to the records the law requires us to keep.
We do not send marketing email to team members. If we start, we will ask for any consent the law requires and include a way to unsubscribe.
11. Where information is stored
Grizzlee's server and database run on Amazon Web Services in its Canada (Central) region. Sign-in accounts are stored by Supabase in Canada, in the Amazon Web Services Canada (Central) region in Montréal. Resend sends email from the United States, in the Amazon Web Services US East region in Virginia. Stripe, Apple and Google process the data they receive in the United States and other countries.
Information sent outside your province or country may be accessed by courts and authorities there under local law. Before we communicate personal information outside Quebec, we carry out the privacy impact assessment Quebec law requires, to check that it will be adequately protected, and we rely on written agreements with each provider.
The European Union, the United Kingdom and Switzerland recognise Canada as giving adequate protection for organisations subject to Canada's federal private sector privacy law. When we send information about people in those places on to a provider in a country without that recognition, we rely on standard contractual clauses or another safeguard their law recognises. You can ask for a copy at privacy@grizzlee.ca.
12. How long information is kept
Grizzlee keeps information while the account or company it belongs to exists, unless a section below says otherwise. Grizzlee does not yet delete records automatically after a set time.
When a merchant erases a person
Merchants can erase a partner, customer or card holder from the dashboard or the API, and card holders can delete their own card. Erasure removes or replaces the person's name, email address, phone number, birthday, display name, identity signal hashes, reasons written about them, the stored order messages linked to them, and the copies of these in pending webhooks and activity records. To keep the merchant's books correct, erasure keeps amounts, dates, statuses, the ledger, and the IDs that link records, such as the merchant's customer ID, the partner's external ID and Stripe account ID, and the Apple device ID of a deleted pass. A merchant's IDs can themselves identify a person if the merchant chose them that way.
When a company is deleted
The owner can delete a company. Deletion turns off its keys, connections, webhooks, pages and emails at once and removes its team members and invitations. A background task then erases every partner, customer and card holder as described above. Grizzlee keeps the company record and name, the terms acceptance record, the records the erasure keeps, the encrypted connection credentials, and order messages from Stripe or Shopify that never matched a customer. Team members keep their sign-in accounts. The data processing agreement explains how a merchant can have these kept items deleted.
Other records
- Sign-in accounts stay until you ask us to delete yours. Leaving or being removed from a company does not delete your account. Partner logins are deleted when the partner is erased and belongs to no other company.
- Identity signal hashes are kept until erasure or company deletion. Hashes on referral link visits that are never claimed, and request counters, are not yet deleted automatically.
- Billing records are kept as long as tax law requires.
- Records of confidentiality incidents are kept for at least 5 years.
- Database backups are kept for 14 days. A final snapshot is kept if the database itself is removed.
- Emails already sent stay in the recipient's mailbox, and Resend keeps delivery logs under its own retention.
To ask us to delete information we hold, write to privacy@grizzlee.ca. We will tell you what we can delete and what the law or a merchant's records require us to keep.
13. Security
Grizzlee encrypts connections with TLS and encrypts its database, backups and server disks at rest. Connection secrets, stored order messages and webhook secrets are also encrypted in the database with a separate key. API keys are stored only as hashes. Access within a company follows roles, and server administration has no public SSH access. The data processing agreement lists these measures in detail.
No system is perfectly secure. Keep your password private and tell us at privacy@grizzlee.ca if you suspect misuse.
14. Confidentiality incidents
If personal information is lost, accessed, used or disclosed without authorisation, we act promptly to reduce the risk of harm and to stop it happening again, and we record the incident in our register. Where an incident presents a risk of serious injury, or a real risk of significant harm, we notify the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada and the people affected, as the law requires. Where the GDPR applies to information we control, we notify the competent supervisory authority within 72 hours of becoming aware of a breach that is likely to put people at risk.
For information we process for a merchant, we notify the merchant under the data processing agreement so that it can meet its own duties.
15. Your rights
Depending on where you live, you may have the right to:
- access your information and learn how it was collected and used,
- correct information that is wrong or incomplete,
- have it deleted,
- receive information you gave us in a structured, commonly used technological format, or have it sent to another organisation,
- ask us to stop disseminating your information, or to de-index a link to it, where dissemination breaks the law or causes you serious injury,
- withdraw consent,
- object to or restrict some uses,
- learn about decisions made only by automated processing and ask a person to review them,
- not be treated differently for exercising these rights.
Team members and partners with a login can write to privacy@grizzlee.ca. We will confirm your identity and answer in writing within 30 days, or tell you if we need more time where the law allows it. Requests are free, unless the law allows a reasonable fee for copying or sending a large amount of information, which we will tell you about first. If we refuse a request, we will give the reason and tell you how to complain.
We keep information accurate and up to date for the purposes we use it. To correct your name or email address, write to the address above.
Partners, customers and card holders should contact the merchant about the information it keeps. If you write to us instead, we will pass your request to the merchant and help it respond. Card holders can delete their own card from the card page.
16. How we govern privacy
Our person in charge of the protection of personal information approves our privacy policies and practices. In summary, they:
- Set out who in our team may access personal information and why, and limit access to the people who need it.
- Set how long each kind of information is kept and how it is securely destroyed, as the retention section describes.
- Require a privacy impact assessment before we build or change a system that handles personal information, and before we communicate personal information outside Quebec.
- Require new features to use the most privacy-protective settings by default, without any action by the person concerned.
- Keep a register of confidentiality incidents and describe how we respond to them.
- Describe how we handle requests and complaints.
- Require privacy training for people with access.
17. Children
Grizzlee is a service for businesses and is not directed to children. We do not knowingly collect information from children under 14 for our own purposes. Merchants must not enroll children in their programs without the consent of a parent or guardian where the law requires it.
18. Person in charge of privacy and complaints
Karl Rizk, Founder, is the person in charge of the protection of personal information at Karl Rizk, sole proprietor. Contact: privacy@grizzlee.ca, or by mail at Montréal, Québec, Canada.
To make a complaint about how we handle personal information, write to the person in charge with the details. We will acknowledge it, investigate, answer in writing within 30 days and correct our practices if the complaint is justified.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or the data protection authority where you live or work.
19. Changes to this policy
We will post any change here with a new date and version. For a material change, we will email the owner of each company at least 30 days before it takes effect.