Privacy policy

What we collect

Depending on how you use the site, we may collect the following.

• Account: your name, email address, password and preferred language. Your password is stored only as a hash by our authentication provider. If you sign in with Google, Google shares your name, email address and profile picture with us.
• Profile: an optional phone number, so coordinators can reach you about shifts or your business listing.
• Volunteer applications: your name, email, phone, availability, interests and anything you write in the form, plus the shifts you sign up for in the portal.
• Business catalogue: the business name, description, contact details, address, links and photos you upload. Listings are shown to signed-in members of the portal after an admin approves them.
• Contact form: your name, email, subject and message.
• Comanda (event tabs): the items bought and the payments recorded on a tab. The QR card carries only a random code, never your name. If you pay by card online, Stripe collects your card details directly; we receive only the amount, the payment method and a confirmation.
• Arauwe enrolment: the child's name and age and the parent or guardian's contact details, sent to us by email or through the contact form.
• Technical data: our hosting providers keep short-lived server logs with your IP address, browser type and the pages requested, used for security and to keep the site running.

Why we use it

We use personal information to:

• create and secure your account and show you the right content in English or Portuguese;
• answer your messages and enrolment requests;
• organize volunteers, shifts and the activities of each event;
• review and publish business listings in the catalogue;
• run the comanda at events and keep accurate sales and payment records;
• send you emails about things you signed up for, such as confirmations, shift reminders or replies. We do not send marketing newsletters unless you ask for them;
• meet our legal obligations as a non-profit society, including keeping financial records.

Cookies

The site uses only essential cookies: a session cookie that keeps you signed in and a cookie that remembers your language choice. We do not use advertising or analytics trackers.

Pages that embed third-party services, such as Stripe Checkout or the honorary consul's appointment calendar, may set their own cookies under those providers' policies.

Who we share it with

We never sell personal information. We share it only with the service providers that run the site, with the volunteers who need it to do their work, and when the law requires it.

• Supabase hosts our database, sign-in and file storage. Vercel hosts the website. Stripe processes online card payments. Google provides sign-in with Google and the appointment calendar on the consul page. Some of these providers store data on servers outside Canada, mainly in the United States.
• ABRE admins can see accounts, applications, listings, messages and comanda records. Shift coordinators see who signed up for their shifts. Volunteers running the comanda see the items and balance on a tab, not who holds the card. Members of a registered business see only their own listing and sales.
• We may disclose information when required by law or to protect the safety of people at our events.

Photos and videos at events

We take photos and videos at public ABRE events to share on our website and social media. If you prefer not to be photographed, tell a volunteer at the event. If you want a photo of you or your child removed, contact us and we will take it down.

Children

Accounts on the site are for adults. Information about children in the Arauwe program is provided by a parent or guardian and is used only to run the program and to contact the family.

How long we keep it

We keep your account for as long as it exists. Volunteer applications are kept for up to two years after a decision, contact messages for up to one year, and comanda sales and payment records for as long as the law requires us to keep the society's financial records. Business listings stay in the catalogue until you or an admin removes them.

Your rights

You can ask us to show you the personal information we hold about you, correct it, delete it, or stop using it for a given purpose. You can also withdraw a consent you gave earlier. Use the contact form and we will reply by email. Some records, such as financial records, must be kept by law even after an account is deleted.

If you believe we have not handled your information properly, you can complain to the Office of the Information and Privacy Commissioner of Alberta.

Security

The site is served over HTTPS, passwords are never stored in plain text, and access to data is limited by role. No system is perfectly secure, so please use a strong, unique password and sign out on shared devices.

Changes to this policy

When we change this policy we will publish the new version here and update the date at the top. Significant changes will also be announced to account holders by email.

Contact

Questions about privacy, or a request to access, correct or delete your information, can be sent through our contact page. Choose the subject "General question" and mention privacy.