Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy is issued by ChaparHub ("ChaparHub", "we", "us" or "our"), operated from Quebec, Canada. It applies to personal information we handle through our public website at https://www.chaparhub.com and its subdomains, the ChaparHub application, our sign-in and account pages, our marketing communications, and any other service that links to this policy (together, the "Services").

"Personal information" (also called "personal data") means any information about an identified or identifiable natural person. This policy is written to meet the requirements of, among others: the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive; the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR); Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL); Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25; Alberta's and British Columbia's Personal Information Protection Acts; the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA); and the comprehensive consumer privacy laws of other US states. Where the laws of your jurisdiction give you greater protection than this policy describes, those laws prevail.

2. Our commitments

These commitments are not aspirations; they describe how the Services are built, and we hold ourselves to them in every jurisdiction, whether or not local law requires it:

• No sale, no sharing. We do not sell, rent or trade personal information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising. We do not buy personal information from data brokers.
• No third-party tracking on our site. Our public website uses no advertising cookies, no analytics cookies, no social-media pixels, no session-replay tools and no fingerprinting. The fonts are served from our own domain.
• Minimization. We collect the minimum information required for each purpose, and we do not use it for a new, incompatible purpose without your consent or a legal basis.
• Privacy by default. Every setting that affects your privacy is set to the most protective option by default. Nothing is made public unless you or your Client choose to publish it.
• No profiling with significant effects. We make no decision based solely on automated processing that produces legal or similarly significant effects on you.
• Security first. Two-step verification is mandatory for every account. Credentials are hashed or encrypted, and access to production data is restricted to personnel who need it.
• Accountability. We maintain records of processing activities and of confidentiality incidents, conduct privacy impact assessments where the law requires them, and train everyone with access to personal information.

3. The personal information we collect

We collect personal information directly from you, automatically when you use the Services, and from the Clients who invite you. We do not intentionally collect sensitive information (such as health, biometric, racial or ethnic origin, religious, sexual-orientation or precise geolocation data), and we ask you not to upload it.

4. Why we use it, and our legal bases

We use personal information only for the purposes below. Where the GDPR or UK GDPR applies, each purpose rests on the legal basis shown. Where Canadian law applies, we rely on your consent — express consent for any sensitive information or any secondary use — or on an exception the law provides.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that they are not overridden. You may ask us for that assessment, and you may object at any time (section 12).

5. Email, consent and anti-spam rules

• We send marketing email only to people who have given express consent, confirmed by clicking a link in a confirmation message (double opt-in). We record when, where and how consent was given.
• Every marketing message identifies us, gives a valid contact address, and contains a one-click unsubscribe link. Unsubscribe requests take effect immediately and in all cases well within the 10 business days CASL allows.
• After you unsubscribe, we keep only your email address and the date of withdrawal on a suppression list, so that we never contact you again by mistake.
• Our email contains a small image and tracked links that tell us whether it was opened or clicked. You can prevent this by disabling automatic image loading in your email client; doing so does not affect your ability to read the message.
• Service and security notices are not marketing; you will receive them while your account is active.

6. Cookies and similar technologies

Our public website uses only cookies that are strictly necessary to provide the service you request — to keep you signed in, to complete two-step verification, and to remember your language. We use no advertising or analytics cookies, so no consent banner is needed. The Cookie Policy lists every cookie and every browser-storage item by name, purpose and lifetime, and explains how to control them.

We honor Global Privacy Control (GPC) and equivalent browser opt-out signals as a valid request to opt out of sale, sharing and targeted advertising, even though we engage in none of them.

7. Who we disclose it to

We disclose personal information only to the recipients below, only to the extent necessary, and only under written contracts that require them to protect it, to use it solely to provide their service to us, and to delete or return it when that service ends.

If we are involved in a merger, acquisition, financing or sale of assets, personal information may be disclosed to the other party under a confidentiality agreement and used only to evaluate and complete the transaction; we will notify you before your information becomes subject to a different privacy policy. We will disclose personal information for any other purpose only with your consent.

We will challenge any request from a public authority that we consider unlawful, disclose the minimum required, and — unless the law prohibits it — notify the affected person or Client.

8. International transfers

We are based in Canada, and our service providers operate globally, so your information may be stored or processed in Canada, the United States and other countries whose laws may differ from those where you live. Whenever we transfer personal information out of the EU/EEA, the United Kingdom, Switzerland or Quebec, we put appropriate safeguards in place:

• Transfers to Canada from the EU/EEA rely on the European Commission's adequacy decision for organizations subject to PIPEDA, and from the UK on the equivalent UK adequacy regulations.
• Transfers to other countries rely on the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, the Swiss-approved equivalents, or a recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, together with supplementary measures such as encryption.
• Before communicating personal information outside Quebec, we conduct a privacy impact assessment as required by section 17 of Quebec's private-sector privacy Act and transfer only where the information will receive adequate protection.

You may request a copy of the safeguards that apply to a transfer by contacting our Privacy Officer.

9. How long we keep it

We keep personal information only for as long as the purpose for which it was collected requires, then delete it or irreversibly anonymize it. Anonymized information is used only for serious and legitimate purposes and in accordance with generally accepted best practices.

10. How we protect it

• All traffic is encrypted in transit with TLS; stored data is encrypted at rest by our infrastructure provider.
• Two-step verification (TOTP) is mandatory for every account; a password alone never opens a session.
• Passwords are stored only as salted PBKDF2 hashes; session tokens, recovery codes and reset tokens only as hashes; platform credentials only after AES-GCM encryption under a key held outside the database.
• Access is invitation-only and role-based; each person sees only the workspaces they are granted, at the level they are granted.
• Public forms are protected by rate limiting, honeypot fields and, where enabled, Cloudflare Turnstile.
• Personnel with access to personal information are bound by confidentiality obligations and receive privacy training.

No method of transmission or storage is perfectly secure. If you believe your account has been compromised, contact us immediately.

11. Confidentiality incidents and data breaches

We keep a register of every confidentiality incident and take prompt measures to reduce the risk of harm and prevent recurrence. Where the law requires, we notify: the Commission d'accès à l'information du Québec and the affected persons, when an incident presents a risk of serious injury; the Office of the Privacy Commissioner of Canada and the affected persons, when a breach creates a real risk of significant harm; the competent supervisory authority within 72 hours of becoming aware of a personal-data breach under the GDPR or UK GDPR, and the affected persons without undue delay when the risk to them is high; and the persons and authorities required by US state breach-notification laws. Where we act as a processor, we notify the affected Client without undue delay so that it can meet its own obligations.

12. Your rights

Subject to the conditions and exceptions of the law that applies to you, you have the right to:

• Know and access. confirm whether we process your personal information and obtain a copy of it, together with the purposes, recipients, sources and retention periods.
• Correct. have inaccurate, incomplete or ambiguous information rectified.
• Delete. have your information erased, including where it is no longer necessary or was collected unlawfully.
• Port. receive the information you provided in a structured, commonly used, machine-readable format, and have it transmitted to another organization.
• Restrict and object. limit how we use your information, and object to processing based on legitimate interests or for direct marketing — the latter without any need to give a reason.
• Withdraw consent. at any time, without affecting the lawfulness of processing before withdrawal.
• Opt out. of sale, sharing, targeted advertising and profiling with legal or similarly significant effects (we do none of these).
• De-indexation (Quebec). require us to cease disseminating your information or de-index any hyperlink attached to your name, where the conditions of the law are met.
• Be informed of automated decisions. and to present your observations to a person — though we make no decisions based solely on automated processing.
• Non-discrimination. we will never deny service, charge a different price or provide a different quality of service because you exercised a privacy right.
• Complain. to a supervisory authority (section 17). We would appreciate the chance to address your concern first.

Additional information for residents of California and other US states

In the preceding 12 months we collected the following categories of personal information defined by the CCPA: identifiers (name, email, IP address, account identifiers); customer records (billing address, telephone number); commercial information (invoices and payment history); internet or other electronic network activity (sign-in events, email engagement, request logs); approximate geolocation (country, region and city — never precise geolocation); professional information (job title and employer); and sensitive personal information limited to account log-in credentials. We collected them from the sources, for the business purposes, and disclosed them to the categories of service providers described in sections 3, 4 and 7, and we retain them for the periods in section 9.

We have not sold or shared personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only to authenticate you and secure your account, which are purposes for which the CCPA does not provide a right to limit. We do not offer financial incentives in exchange for personal information. We do not sell covered information as defined by Nevada law.

You may use an authorized agent to submit a request; we will ask for proof of the agent's authority and may ask you to verify your identity directly. If we decline your request in whole or in part, you may appeal by replying to our decision with the subject line "Privacy appeal"; we will respond in writing within the period your state's law requires (45 days in most states) and explain our reasons. If your appeal is denied, you may contact your state Attorney General.

Additional information for Quebec residents

The person in charge of the protection of personal information at our organization is our Privacy Officer, reachable at the address in section 16. You may request access to or correction of your information in writing; we answer within 30 days of receipt. If we refuse, we will give our reasons and the provision of law on which the refusal is based, and inform you of your right to apply to the Commission d'accès à l'information for a review. Your information is communicated to service providers outside Quebec only after the assessment described in section 8.

13. How to exercise your rights

1. 01Write to hello@chaparhub.com, stating the right you wish to exercise. You may also make most changes yourself on your profile page.
2. 02We will verify your identity in proportion to the sensitivity of the request — usually by confirming control of the email address on file. We will not ask for more information than verification requires, and we will use it only for verification.
3. 03We respond within 30 days of receipt. Where the GDPR or UK GDPR applies and the request is complex, we may extend this by up to two further months; where the CCPA applies, by up to 45 further days. We will tell you of any extension and the reason for it within the initial period.
4. 04Requests are free of charge. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive, and will explain why.

14. Children

The Services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from a child under 16 without verified consent from a parent or guardian where required, we will delete it promptly. If you believe this has happened, please contact us.

15. Changes to this policy

We will update this policy when our practices or the law change. The effective date at the top of the page shows when the current version took effect. We will notify account holders by email or in the application at least 30 days before any material change takes effect, and we will never apply a material change to information collected before it without your consent where the law requires it. Previous versions are available on request.

16. Contact us

Questions, requests and complaints about this policy or our handling of personal information go to our Privacy Officer, who is also the person in charge of the protection of personal information for the purposes of Quebec law: ChaparHub — Privacy Officer, hello@chaparhub.com. We acknowledge every request promptly and answer within the times in section 13.

17. Supervisory authorities

If you are not satisfied with our response, you may complain to the authority responsible for your jurisdiction, including:

• Quebec. Commission d'accès à l'information du Québec — www.cai.gouv.qc.ca
• Canada. Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• European Union / EEA. the data protection authority of your Member State — listed at www.edpb.europa.eu
• United Kingdom. Information Commissioner's Office — www.ico.org.uk
• California. California Privacy Protection Agency — www.cppa.ca.gov, or the California Attorney General
• Other US states. the Attorney General of your state