Privacy Policy

1. Introduction

KLEVERFIND (“Kleverfind,” “we,” “us,” or “our”) is a sole proprietorship registered in Ontario, Canada. We operate kleverfind.com, a discovery platform that connects consumers with beauty and grooming artists in Ottawa and Gatineau.

This Privacy Policy explains what personal information we collect, how we use and protect it, who we share it with, and what rights you have. It applies to all visitors, consumers, and artists who use the Kleverfind platform.

KLEVERFIND acts as the data controller for personal information collected through this platform, as that term is used under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law.

Questions or requests regarding this policy should be directed to: precieux@kleverfind.com

2. Information We Collect

2a. Information collected from Artists

When you register as an artist on Kleverfind, we collect the following information in order to create and operate your profile:

• Email address (used for authentication; passwords are stored in hashed form by our authentication provider Supabase and are never accessible to Kleverfind)
• Brand name and handle (your public profile identifier)
• City and neighbourhood
• Primary and secondary business category (e.g., barber, braider, nail tech)
• Professional bio
• Contact information you choose to display publicly: Instagram handle, WhatsApp number, email address, booking URL
• Portfolio photos and associated metadata (style tags, audience tags, upload dates, media type)
• Subscription status and billing period
• Payment information: we use Stripe for payment processing. Kleverfind never sees, receives, or stores your card number or full payment credentials. Stripe collects and processes payment information directly under their own privacy policy. We retain only your Stripe customer ID and subscription status.

2b. Information collected from Consumers

Consumers do not need an account to browse Kleverfind. We do not collect names, email addresses, or directly identifying account information from consumers. However, we do collect analytics data as described below, which under Canadian privacy law may be considered personal information when combined with other identifiers. We collect the following analytics data automatically when you use the platform:

• A visitor ID: a randomly generated UUID stored in your browser's localStorage under the key kf_visitor_id. This is a first-party identifier we generate — it is not linked to any external identity system.
• A session ID: a randomly generated UUID stored under the key kf_session_id. Sessions rotate automatically after 30 minutes of inactivity.
• Your browser's user agent string
• Pages viewed, artist profiles viewed, and portfolio photos opened
• Contact button clicks (which contact method was used, e.g., Instagram, WhatsApp, Email, Booking)

3. How We Use Your Information

We use the information we collect for the following purposes:

• Operating the platform: Creating and displaying artist profiles, enabling search and discovery, and routing consumers to artist contact channels.
• Processing payments: Managing artist subscriptions, free trial periods, billing, and Stripe Checkout sessions.
• Sending transactional emails: Account confirmation, profile approval or rejection notifications, billing receipts, and weekly performance summaries to artists.
• Internal analytics and product improvement: Understanding how the platform is used, which features are most valuable, and where the experience can be improved. This analytics data is used internally and is not shared with or sold to third parties.
• Training internal machine-learning models: We may use content uploaded to the platform (including portfolio photos and associated tags) to train or improve internal models used for photo tagging, search relevance, and discovery. See the Content License section of our Terms of Service for details. You may opt out of having your uploaded content used for machine-learning model training at any time by emailing precieux@kleverfind.com. Opting out will not affect any other aspects of your use of the platform.
• Legal compliance: Retaining financial records as required by Canadian tax law, and responding to lawful requests from regulatory or law enforcement authorities.

4. What We Do Not Do With Your Data

We do not sell your personal information to any third party. We do not use your data to serve third-party advertising. We do not operate Google Analytics, Facebook Pixel, or any external advertising tracking technology. All analytics on Kleverfind are first-party, operated and stored by us.

We do not share your personal information with any third party except the service providers described in Section 6 below, or where required by law.

5. Cookies and localStorage

First-party analytics identifiers

Kleverfind currently uses browser localStorage (not cookies) to store two first-party identifiers for analytics purposes. If we change this mechanism in the future (for example, to HTTP-only cookies for improved security), we will update this policy accordingly.

• kf_visitor_id: a UUID that persists across visits so we can understand aggregate usage patterns (e.g., how many unique visitors viewed a profile). It is not linked to your name, email, or account information, and by itself cannot identify you. When combined with other data, re-identification may be theoretically possible, which is why we apply the data minimization principles described in this policy.
• kf_session_id: a UUID that represents a single browsing session. It automatically rotates after 30 minutes of inactivity, tracked via kf_session_last_activity. This allows us to deduplicate events within a session (e.g., avoid counting a page reload as a new profile view).

Authentication cookies

If you are an artist who logs in to the Kleverfind dashboard, our authentication provider (Supabase) sets session cookies in your browser to maintain your authenticated state. These cookies are first-party and are cleared when you log out.

No third-party tracking cookies

Kleverfind does not use any third-party cookies, ad network pixels, or cross-site tracking technologies.

How to opt out

You can clear your localStorage identifiers at any time through your browser settings (typically under “Site Data” or “Storage” for kleverfind.com). Doing so will not affect your ability to browse the platform, but will reset analytics attribution — future visits will be treated as a new visitor and a new session.

6. Third-Party Service Providers

We share personal information only with the following service providers, and only to the extent necessary to provide the services described:

• Stripe — Payment processing and subscription billing. Stripe is PCI DSS Level 1 certified. Your full payment card details are entered directly into Stripe's hosted interface and are never transmitted to or stored by Kleverfind. Stripe's privacy policy is available at stripe.com/privacy.
• Supabase — Database storage and authentication. Your account data, profile information, portfolio photos, and analytics records are stored in Supabase-managed infrastructure. Supabase's privacy policy is available at supabase.com/privacy.
• Resend — Transactional email delivery. We use Resend to send account-related emails (signup, approval, billing). Your email address is shared with Resend solely for the purpose of delivering these messages. Resend's privacy policy is available at resend.com/legal/privacy-policy.
• Vercel — Hosting and infrastructure. The Kleverfind application is hosted on Vercel's platform. Vercel may process request metadata (IP addresses, headers) as part of standard web hosting operations. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

All third-party providers are required to process personal information only for the purposes described above. We do not authorize them to use your data for their own advertising, marketing, or commercial purposes.

7. Data Retention

• Account data: Retained while your account is active. Upon a verified account deletion request, personal data will be deleted within 30 days, except where retention is required by law (for example, financial and payment records retained for 7 years per Canadian tax law, as described below).
• Analytics data: Visitor and session analytics records are retained for 24 months, after which they are automatically deleted.
• Payment records: Financial transaction records are retained for 7 years in accordance with Canadian tax law and CRA requirements.
• Uploaded photos and content: Portfolio photos are retained while your account is active. Upon account deletion, photos will be removed from public display. Note that under the Content License in our Terms of Service, certain uses of content (such as model weights derived from training data) may persist in anonymized or aggregated form. See our Terms of Service for full details.

8. Your Rights Under PIPEDA

As a resident of Canada, you have the following rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):

• Right to access: You may request a copy of the personal information we hold about you.
• Right to correct: You may request that we correct inaccurate or incomplete personal information.
• Right to withdraw consent and delete your account: You may withdraw consent for us to process your personal information and request deletion of your account and associated data.
• Right to lodge a complaint: If you believe we have not complied with our privacy obligations, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

To exercise any of these rights, email us at precieux@kleverfind.com. We will respond within 30 days as required by PIPEDA, or will inform you within that period if an extension is required to process your request.

9. Security

We take reasonable measures to protect your personal information against unauthorized access, loss, or disclosure. These measures include: encrypted data transmission via HTTPS for all platform traffic; data encrypted at rest by default through Supabase's managed infrastructure; and payment information handled exclusively via Stripe's PCI DSS Level 1 compliant hosted checkout, meaning Kleverfind never processes or stores full payment card data.

No system is completely secure. While we work to protect your information, we cannot guarantee absolute security and are not responsible for security breaches outside our reasonable control.

In the event of a data breach that creates a real risk of significant harm to affected individuals, we will notify affected users and the Office of the Privacy Commissioner of Canada as required under PIPEDA's mandatory breach notification requirements.

10. Children's Privacy

Kleverfind is not directed at users under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted personal information to us, please contact us at precieux@kleverfind.com and we will delete the information promptly.

11. International Data Transfers

Kleverfind is based in Ontario, Canada. However, some of our service providers (Supabase, Vercel, Resend, Stripe) may store or process data in servers located in the United States or the European Union. By using Kleverfind, you acknowledge that your information may be transferred to and processed in jurisdictions outside Canada, which may have different data protection laws than your home jurisdiction.

We select service providers that operate under privacy frameworks and contractual safeguards appropriate to the nature of the data transferred.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy with a new “Last Updated” date at the top of this page. For material changes that significantly affect how we use your personal information, we will notify active artist accounts by email. Continued use of the platform after the effective date of any changes constitutes your acceptance of the updated policy.

13. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Privacy Officer: The individual responsible for privacy compliance at Kleverfind can be reached at precieux@kleverfind.com.