Privacy Policy
This Privacy Policy explains how Zandoro collects, uses, protects, and discloses personal information when you use our Canadian appointment scheduling marketplace, merchant software suite, and online storefronts.
At a Glance: Our Privacy Principles & Commitments
- We never sell, rent, or lease your personal data or phone number to data brokers or advertising networks.
- Direct In-Person Settlement: Customers settle payments directly with independent merchants (cash, Interac, POS). Zandoro does not store payment cards.
- Full compliance with CASL (Canada’s Anti-Spam Legislation): Transactional reminders service confirmed bookings with one-click unsubscribe options.
- Full statutory rights under PIPEDA: Request access, correction, or permanent account deletion at any time.
1. Scope & Canadian Statutory Framework
Zandoro (“we”, “our”, or “us”) operates an appointment scheduling platform and merchant software suite headquartered in Ontario, Canada. This Privacy Policy governs the collection, use, and disclosure of personal information collected through our website (zandoro.app), merchant dashboards, client booking portals, and associated communication services.
We adhere strictly to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy statutes, including:
- Alberta's Personal Information Protection Act (PIPA);
- British Columbia's Personal Information Protection Act (PIPA); and
- Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).
2. Roles of the Parties: Zandoro vs. Independent Service Providers
Two-Sided Marketplace Structure: Zandoro is a technology software platform connecting independent Service Providers (such as barber shops, hair salons, esthetics clinics, spas, massage therapists, dental offices, and tutors) with Clients seeking appointments.
Data Controller Distinctions:
- Zandoro as Data Controller: We are the data controller for information you provide directly to create your user account, browse the marketplace, receive booking notifications, and manage platform interactions.
- Service Providers as Independent Data Controllers: When you book an appointment with a Service Provider, that provider independently receives your name, contact information, and appointment notes to fulfill the service. Service Providers maintain their own professional client records (such as medical intake questionnaires, hair dye patch tests, or treatment charts). Service Providers are independently responsible for managing such records in compliance with applicable health privacy and professional regulatory body standards.
3. Personal Information We Collect
We collect only the personal information that is reasonably necessary to provide our appointment booking and marketplace services:
A. Information Collected from Clients
- Account Identity: Full name, verified email address, Canadian mobile telephone number, and hashed password.
- Appointment Details: Booked services, selected specialists, appointment date and time, duration, and customer service notes or preferences.
- Attendee & Guest Data: Full name, phone number, email address, and relationship of guests when you book on behalf of family members or friends.
- Reviews & Content: Star ratings, written feedback, and uploaded photos submitted regarding completed services.
B. Information from Service Providers
- Business Identity: Legal business trade name, custom booking URL slug, industry vertical, business email, and phone number.
- Physical Location: Civic address, city, Canadian province, postal code, and geographic coordinates for distance search.
- Specialist Team: Staff specialist names, working schedules, assigned services, and profile pictures.
- Tax & Compliance: Statutory sales tax rate (e.g. 13% Ontario HST), CRA Business Number registration status, and platform subscription details.
C. Automatically Collected Technical & Device Information
- Log & Device Data: Internet Protocol (IP) address, browser type, operating system, device identifiers, and timestamps of requests.
- Precise Geolocation: With your explicit browser permission, we collect latitude and longitude coordinates when you use “Use My Location” to calculate and display distances to nearby Canadian businesses. You can revoke location access in your device or browser settings at any time.
- Cookies & Local Storage: Strictly necessary session cookies and theme preference keys (e.g. dark/light mode toggle). We do not deploy third-party advertising tracking cookies or cross-site tracking pixels.
4. How We Use Personal Information
We process your personal information exclusively for legitimate business purposes:
- Reservation Fulfillment: Generating verified appointment slots, locking schedules, and preventing double-bookings.
- Marketplace Discovery: Sorting and presenting nearby providers based on your chosen city or geographic coordinates.
- Automated Notifications: Dispatching instantaneous booking confirmations, schedule changes, and 1-hour appointment reminders via email and platform alerts.
- Tax Calculation: Calculating statutory provincial sales tax (GST/HST/PST) itemized on customer receipts.
- Platform Security & Fraud Prevention: Detecting fraudulent account creation, preventing malicious appointment blocking, and safeguarding user data.
- Customer Support: Investigating service discrepancies, resolving account issues, and responding to inquiries.
5. How We Disclose & Share Personal Information
We disclose personal information only in the limited circumstances described below, always adhering to PIPEDA data minimization standards:
Sharing with Booked Service Providers
When you reserve an appointment, your name, email address, mobile phone number, and any customer notes you submit are transmitted directly to that Service Provider so they can prepare for your visit, verify your appointment, and communicate regarding schedule changes.
Trusted Third-Party Service Providers (Subprocessors)
We engage vetted third-party technology providers to perform essential infrastructure operations on our behalf:
- Database Hosting & Cloud Storage: Neon PostgreSQL (cloud database encrypted at rest with AES-256).
- Application Hosting & Edge Delivery: Vercel (encrypted in transit with TLS 1.3).
- Transactional Email Dispatch: Resend (delivers booking confirmations and reminders with DKIM/SPF verification).
These subprocessors are contractually bound to process data solely according to our instructions and maintain rigorous confidentiality and security standards.
Legal Compliance & Protection of Rights
We may disclose personal information if required to do so by Canadian law, court order, subpoena, or lawful request by government authorities (such as the Canada Revenue Agency for tax compliance), or to protect the vital safety, property, or legal rights of Zandoro, our users, or the public.
Business Reorganization or Transfer
In the event of a merger, acquisition, corporate reorganization, or sale of assets, personal information may be transferred to the acquiring entity, subject to the successor company agreeing to adhere to the privacy standards set out in this Policy.
Our Non-Sale Pledge: Zandoro does not sell, rent, lease, or monetize personal information or mobile phone numbers to third-party data brokers, telemarketers, or marketing aggregators.
6. Cross-Border Data Storage & Transfers
While Zandoro is based in Mississauga, Ontario, Canada, our cloud hosting infrastructure and email dispatch subprocessors utilize secure enterprise data centers located in Canada and the United States. Consequently, your personal information may be transferred, stored, or processed outside of your home province or outside of Canada. While stored in foreign jurisdictions, personal data is subject to the laws of those jurisdictions, which may permit local law enforcement or national security authorities to access personal data under lawful legal processes. All cross-border transmissions are encrypted using modern Transport Layer Security (TLS 1.3).
7. Canada's Anti-Spam Legislation (CASL) Compliance
Transactional Service Messages: When you book an appointment on Zandoro, you consent to receive functional electronic messages that directly service your booking (including instant confirmations, 1-hour automated reminders, cancellation notices, and schedule updates). Under CASL, these functional messages service an active transaction you initiated.
Commercial Marketing Messages: We will never send promotional offers or marketing broadcasts without your express, opt-in consent. Commercial emails will clearly identify Zandoro as the sender, display our physical mailing address, and provide a clear one-click unsubscribe mechanism.
8. Technical Safeguards & Data Breach Protocols
We implement industry-standard physical, technical, and organizational measures to safeguard personal information:
- Encryption in Transit: All web and API traffic is encrypted using modern Transport Layer Security (TLS 1.3).
- Encryption at Rest: Cloud databases and server backups are encrypted with AES-256.
- Cryptographic Password Protection: User passwords and sensitive tokens are protected using irreversible cryptographic one-way hashing algorithms.
- Multi-Tenant Isolation: Strict database isolation prevents cross-tenant access between different business owners and accounts.
- PIPEDA Breach Notification: In the event of a security safeguards breach involving personal information that poses a real risk of significant harm (RROSH), we will promptly notify affected individuals and report the breach to the Office of the Privacy Commissioner of Canada (OPC) as required by Canadian law.
9. Data Retention & Erasure Schedule
Active Accounts: We retain personal information for as long as your account remains active or as needed to provide booking and merchant services.
Account Deletion: If you request the deletion of your account, we will permanently delete or anonymize your personal information within thirty (30) calendar days, except where continued retention is required by law.
Statutory Financial Retention: Consolidated merchant invoices, completed transaction records, and tax remittance logs must be retained for up to seven (7) years to comply with statutory audit obligations mandated by the Canada Revenue Agency (CRA) and provincial tax authorities.
10. Your Individual Privacy Rights (Access, Correction & Deletion)
Under PIPEDA and applicable provincial privacy legislation, you have concrete statutory rights regarding your personal information:
Right of Access
You may request a written copy of the personal information Zandoro holds about you, along with an explanation of how it is processed.
Right of Rectification
You may update or correct inaccurate or incomplete profile records directly in your Account Settings or by contacting us.
Right of Erasure / Deletion
You may request the permanent deletion of your customer account and appointment history, subject to statutory tax audit requirements.
Right to Withdraw Consent
You may withdraw consent for optional processing activities (such as browser geolocation tracking or push notifications) at any time.
To exercise any of these rights, please submit a written request to our Privacy Desk at privacy@zandoro.app. We respond to all verified statutory privacy requests within thirty (30) calendar days as required by Canadian law.
11. Children's Privacy & Age of Majority
Zandoro is intended for individuals who have reached the age of majority in their province of residence (18 years of age in Ontario). We do not knowingly collect personal information directly from children under 13 years of age. If a child under the age of majority receives a booked service (such as a children's haircut or tutoring lesson), the appointment must be scheduled and authorized by a parent or legal guardian who attends or consents to the service. If we learn that we have inadvertently collected personal information directly from a child under 13 without verifiable parental consent, we will promptly delete that information.
12. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect enhancements to our platform, changes in legal obligations, or modifications to our data practices. When updates are published, we will revise the “Last Updated” date at the top of this page. In the event of material changes, we will provide prominent notice on the Platform or deliver an email alert to registered users.
13. Contacting Our Canadian Privacy Officer & Regulatory Recourse
If you have inquiries, questions, concerns, or complaints regarding this Privacy Policy or Zandoro's privacy governance practices, please contact our designated Chief Privacy Officer:
Zandoro Platform Privacy Governance Desk
Attention: Chief Privacy Officer
Privacy Inquiries: privacy@zandoro.app
General Support: support@zandoro.app
Physical Location: Mississauga, Ontario, Canada
If our Privacy Desk is unable to resolve your inquiry to your satisfaction, you have the statutory right to lodge a formal complaint with the Office of the Privacy Commissioner of Canada (OPC):
Office of the Privacy Commissioner of Canada (OPC)
Website: www.priv.gc.ca
Toll-Free Telephone: 1-800-282-1376
Address: 30 Victoria Street, Gatineau, Quebec, K1A 1H3, Canada