Privacy Policy

1. Who We Are

GEMiO ("GEMiO," "we," "our," or "us") is a local business discovery and marketplace platform. We provide digital storefronts, AI-assisted content creation, digital book publishing, and payment facilitation services through our website at gemio.ca.

GEMiO is the data controller responsible for personal information collected through the Platform. Our Privacy Officer can be contacted at support@gemio.ca.

2. Scope of This Policy

This Policy applies to all personal information we collect through the GEMiO website, mobile web experience, and any related services (collectively, the "Platform"). It applies to:

• Shoppers — visitors who browse businesses or purchase products;
• Sellers — business owners, creators, and authors who list products, services, or digital books;
• Visitors — anyone who accesses the Platform without creating an account.

This Policy does not apply to third-party websites linked from GEMiO, or to the data practices of individual Sellers operating their own businesses.

3. Information We Collect

3.1 Information You Provide Directly

Account Registration: When you create a GEMiO account, we collect your name, email address, password (hashed — never stored in plain text), and optionally your business name and phone number.

Seller Profile: When you create a seller profile, we collect your business name, business address, business description, product and service listings, profile photos, and pricing information.

Digital Books: If you create or purchase a digital book, we collect book content you submit for AI processing, your chosen book price, and (for buyers) your email for delivery.

Communications: If you contact us by email or through the Platform, we collect and retain the content of your message and your contact details.

3.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical information:

• Usage Data: Pages visited, features used, search queries, vote and interaction events, session duration, and referring URLs;
• Device Information: Browser type and version, operating system, screen resolution, and device type;
• Network Information: IP address (used for approximate geolocation and fraud prevention — not stored in plain text after processing), time zone, and internet service provider;
• Performance Data: Page load times, errors, and technical diagnostic data collected through Vercel Analytics.

3.3 Information from Third Parties

• Social Media Platforms: When you connect an Instagram or TikTok account, we receive your public profile information and the public posts and images you authorize us to import (see Section 8);
• Stripe: When you connect a payment account, Stripe provides us with confirmation of your identity verification status, payout account details, and transaction records. We do not receive full payment card numbers;
• Authentication Providers: If you sign in using a third-party authentication service, we may receive your name, email address, and profile image from that provider.

4. How We Use Your Information

We use the information we collect to:

• Operate the Platform: Create and manage your account, display your business profile to shoppers, process payments, and deliver digital books;
• Provide AI Features: Process your social media content and user-submitted materials to generate shop descriptions, product listings, and book drafts using AI;
• Process Transactions: Facilitate payments, calculate platform fees, process payouts to sellers, and manage disputes;
• Personalize Your Experience: Show you relevant local businesses, improve search results, and surface content relevant to your location or preferences;
• Communicate with You: Send account-related notifications, payment confirmations, security alerts, payout statements, and (with your consent) marketing communications;
• Improve the Platform: Analyze usage patterns, diagnose technical issues, conduct A/B testing, and develop new features;
• Safety and Fraud Prevention: Detect, investigate, and prevent fraudulent transactions, policy violations, and security incidents;
• Legal Compliance: Comply with applicable legal obligations, tax requirements, and law enforcement requests;
• Analytics: Aggregate, de-identified usage analytics to understand how the Platform is used.

5. Legal Basis for Processing

Under Canadian privacy law (PIPEDA), we collect, use, and disclose personal information with your knowledge and consent, or where permitted by law. The legal bases on which we rely include:

• Consent: For social media content import, marketing communications, and optional features — you may withdraw consent at any time;
• Contract: To perform our obligations under the Terms of Service — including operating your account, processing payments, and delivering purchases;
• Legitimate Interests: For fraud prevention, platform security, and product analytics, where our interests do not override your privacy rights;
• Legal Obligation: Where processing is required to comply with applicable Canadian law, tax law, or a valid court order.

6. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

6.1 With Other Users (as part of the Service)

When you create a seller profile, your business name, description, products, location, and contact information are visible to shoppers and the public. If you purchase from a seller, your name and order information are visible to that seller to fulfill your order.

6.2 With Service Providers

We share information with trusted third-party service providers who help us operate the Platform (see Section 9). These providers are contractually required to protect your information and use it only for the purposes for which it was shared.

6.3 For Legal Reasons

We may disclose your information if required to do so by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights or safety of GEMiO, our users, or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

6.4 Business Transfers

If GEMiO is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information, and you will have the opportunity to object to the transfer under applicable law.

6.5 With Your Consent

We may share your information with other third parties when you explicitly consent to such sharing.

7. Cookies and Tracking Technologies

7.1 What We Use

GEMiO uses the following technologies to collect information about your use of the Platform:

• Session Cookies: Temporary cookies that expire when you close your browser, used to maintain your login session and shopping cart state;
• Authentication Tokens: Stored in browser localStorage to keep you logged in between sessions. These do not contain personal data beyond your session identifier;
• Preference Storage: Browser localStorage is used to remember your vote preferences and UI settings (e.g., map view mode). No personal data is stored;
• Analytics (Vercel Analytics): We use Vercel Analytics to collect anonymized, aggregated data about Platform usage. Vercel Analytics is designed to be privacy-first and does not use cookies or store personal identifiers. See Vercel's privacy policy for details.

7.2 What We Do Not Use

We do not use: advertising cookies, cross-site tracking pixels, social media tracking buttons (beyond what social platforms load independently), or behavioral advertising networks. We do not sell your browsing data to advertisers.

7.3 Managing Cookies

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Platform, including your ability to stay logged in. You can clear localStorage data through your browser's developer tools or privacy settings.

8. Social Media Integration

If you choose to connect your Instagram or TikTok account to GEMiO, we will access only the public posts and profile information that you explicitly authorize. Specifically:

• We use Apify or official platform APIs to retrieve your public posts — we do not access private messages, followers lists, or non-public content;
• We do not store your social media login credentials;
• Imported content is processed by AI tools to generate your GEMiO shop listings;
• You can revoke this authorization at any time from your seller dashboard — revocation will not delete content already published to your GEMiO shop, but will stop future imports;
• You are responsible for ensuring that the content you authorize for import does not violate the terms of service of the source social media platform.

9. Third-Party Service Providers

We work with the following third-party service providers who may process your personal information:

Each provider is subject to its own privacy policy. We encourage you to review those policies. We have data processing agreements in place with providers where required by law.

10. International Data Transfers

GEMiO is operated from Canada. However, our service providers are located in the United States, the European Union, and other countries. When we transfer your personal information outside of Canada, we take steps to ensure that your information receives a level of protection consistent with PIPEDA, including relying on contractual safeguards, standard contractual clauses, or adequacy decisions.

By using the Platform, you acknowledge that your information may be transferred to, stored, and processed in countries outside Canada, including the United States, which may have different privacy laws than your province or territory.

11. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy, plus any additional period required by law. Our standard retention periods are:

• Active accounts: For as long as your account remains active;
• After account deletion: Account data and listings are retained for 90 days to resolve outstanding disputes or chargebacks, after which they are deleted;
• Transaction and payment records: Retained for 7 years as required by Canadian tax law (Income Tax Act);
• Analytics data: Aggregated, de-identified analytics data may be retained indefinitely;
• Legal holds: If we are required by law or court order to preserve certain data, we will retain it for as long as required.

When data is deleted, we use commercially reasonable methods to ensure it is permanently removed from our systems and from the systems of our service providers.

12. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS);
• Passwords are hashed using a one-way cryptographic algorithm — we cannot see your password;
• Access to personal data is restricted to GEMiO personnel and service providers who need it to fulfill their role;
• We use Supabase Row-Level Security (RLS) to ensure that database records are accessible only by authorized users;
• Payment information is processed entirely by Stripe — GEMiO never stores full credit card numbers or CVVs;
• We regularly review and update our security practices.

Security Breach Notification: In the event of a data breach that is likely to result in significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA's mandatory breach reporting requirements, within the timeframes required by law.

13. Your Privacy Rights

Under PIPEDA and applicable provincial privacy law, you have the following rights with respect to your personal information:

Right of Access

You have the right to request a copy of the personal information we hold about you, including the categories of information, the purposes for which it is used, and the third parties with whom it is shared. We will respond within 30 days of receiving a verifiable request.

Right of Correction

You have the right to request that we correct any inaccurate, incomplete, or outdated personal information we hold about you. Many corrections can be made directly through your account dashboard.

Right of Deletion

You have the right to request that we delete your personal information, subject to our legal obligations and legitimate business interests (e.g., retaining records required by tax law). You may also delete your account directly from your dashboard.

Right of Portability

You have the right to request a copy of your personal information in a structured, machine-readable format (CSV or JSON) to transfer to another service. Contact us to request a data export.

Right to Withdraw Consent

Where we process your personal information based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal. You may withdraw consent for: (a) social media content import (via your seller dashboard); (b) marketing emails (via the unsubscribe link in any marketing email).

Right to Object to Marketing

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us. Opting out of marketing does not affect transactional communications (account notices, payment confirmations, etc.).

How to Exercise Your Rights

To exercise any of the above rights, please email our Privacy Officer at support@gemio.ca with the subject line "Privacy Request." We may need to verify your identity before processing your request. We will respond within 30 days and will not charge a fee for reasonable requests.

Right to Complain

If you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca. We encourage you to contact us first — we will make every effort to resolve your concern directly.

14. Automated Decision-Making

GEMiO uses automated systems, including AI, in the following ways:

• Content Generation: AI tools are used to generate shop descriptions and book drafts based on content you provide. These outputs are reviewed and approved by you before publication;
• Search and Discovery: Automated algorithms determine the order in which businesses appear in search results, based on relevance, distance, and engagement signals;
• Fraud Detection: Automated systems may flag unusual account activity for human review.

No fully automated decisions are made about you that produce significant legal effects without a human reviewing the outcome. If you have concerns about an automated decision that has affected your account, you may contact us to request human review.

15. Children's Privacy

GEMiO is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us immediately at support@gemio.ca. We will delete that information from our records as quickly as possible.

Users between 13 and 18 may use GEMiO only with the consent and supervision of a parent or legal guardian.

16. Digital Books & Content Publishing

This section applies specifically to sellers (authors) who publish digital books on GEMiO and to buyers who purchase them. It sets out the most important protections for both parties.

16.1 Authors Retain Their Copyright

Publishing a digital book on GEMiO does not transfer your copyright or any other intellectual property rights to GEMiO. You remain the sole owner of your work. By listing a book, you grant GEMiO a limited, non-exclusive, royalty-free licence to host, display, deliver to buyers, and process your content using AI tools solely for the purpose of operating the Platform. This licence ends when you remove the book from sale or delete your account.

16.2 What GEMiO Will and Will Not Do With Your Book Content

• We will not sell, license, reproduce, or distribute your book content to any third party for any purpose other than delivering it to paying buyers.
• We will not use your book content in advertising, promotional materials, or any other marketing without your explicit written consent.
• We will not use your book content to train any AI model. When content is processed through the Anthropic Claude API for AI-assisted writing, Anthropic's API terms prohibit the use of API inputs and outputs to train their models.
• AI processing happens in real-time and transiently — your content is not stored by Anthropic beyond what is needed to fulfil the immediate request.
• We may display your book title, cover image, description, and author name publicly on the Platform as part of your listing.

16.3 Author Responsibilities Before Publishing

Before publishing a digital book on GEMiO, you represent and warrant that:

• You are the original author or hold all necessary rights, licences, and permissions to publish and sell the work;
• The content does not infringe any third-party copyright, trademark, privacy right, or other intellectual property right;
• If the book includes AI-generated content (text, images, or other material), you have disclosed this where required by applicable law and platform guidelines;
• The content does not contain unlawful material, hate speech, defamation, or explicit sexual content involving minors;
• All facts, advice, or professional information in the book are accurate to the best of your knowledge — GEMiO is not responsible for errors or omissions in book content.

16.4 Buyer Licence — What You Can and Cannot Do

When you purchase a digital book on GEMiO, you receive a personal, non-transferable, non-exclusive licence to read the book for your own private, non-commercial use. Specifically:

• You may download and read the file on your personal devices;
• You may not copy, redistribute, resell, share, upload to other platforms, or use the content commercially without the author's written permission;
• You may not remove or circumvent any watermark, identifier, or access measure applied to the file;
• Sharing your download link or file with others violates the author's copyright and GEMiO's Terms of Service.

16.5 Digital Content — No Refund Policy

Because digital books are delivered immediately upon purchase and cannot be "returned" once downloaded, all digital book purchases are final and non-refundable, except where required by applicable consumer protection law. If you believe you received a file that is corrupted, materially different from its description, or that the listing constituted fraud, please contact us within 7 days of purchase at support@gemio.ca and we will investigate.

16.6 Copyright Infringement — Takedown Procedure

GEMiO respects intellectual property rights and expects all sellers to do the same. If you believe that content published on GEMiO infringes your copyright:

• Send a written notice to support@gemio.ca with the subject line "Copyright Takedown Request";
• Include: (a) identification of the copyrighted work, (b) identification of the infringing listing on GEMiO, (c) your contact details, and (d) a statement that you are the rights holder or are authorized to act on their behalf;
• We will review and, where the claim is valid, remove the content within 5 business days;
• Sellers who receive a valid takedown notice will be notified and may submit a counter-notice if they believe the claim is in error;
• Repeat infringers will have their accounts permanently suspended.

GEMiO operates as a content-hosting platform under safe harbour provisions. We are not liable for infringing content uploaded by sellers, provided we act expeditiously to remove content upon receiving a valid notice.

16.7 Content Removal by GEMiO

GEMiO reserves the right to remove or restrict access to any digital book that:

• Violates these policies, our Terms of Service, or applicable law;
• Is subject to a valid copyright takedown notice;
• Receives credible reports of fraud, misrepresentation, or harmful content;
• Is associated with an account that has been suspended or terminated.

Where possible, we will notify the author before removal. In cases involving illegal content or imminent harm, removal may occur without prior notice.

16.8 Buyer Data for Digital Book Purchases

When you purchase a digital book, we collect your email address to deliver the book and send a purchase confirmation. We do not share your email address with the author/seller without your consent. Purchase records are retained for 7 years as required by Canadian tax law (see Section 11).

16.9 Book Studio — Content Import & AI Processing

Book Studio lets you connect Instagram, YouTube, and/or TikTok to turn your own posts and videos into a ghostwritten book. Before any content is imported, we show you a consent screen and record your acceptance — the same disclosure is set out here in full.

• What we import: captions, thumbnails, and basic metadata from any Instagram, YouTube, or TikTok account you connect yourself — only content you actively select, never your whole account automatically.
• Transcription: video/reel audio you connect or upload is sent to OpenAI (Whisper) to produce a text transcript. For YouTube specifically, we use the video's own official captions when available instead of transcription — GEMiO never downloads or scrapes the underlying video or audio file from YouTube.
• AI writing: all imported text (captions, transcripts, your own notes) is sent to Anthropic (Claude) to extract knowledge and draft your manuscript — the same real-time, non-training-data processing described in Section 16.2 above.
• What we store: your imported captions/transcripts and the resulting AI-generated manuscript, in GEMiO's database, for as long as your book exists.
• Your control: you can disconnect any connected account, or delete your book and its imported content entirely, at any time from Book Studio.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated policy on this page with a new "Last updated" date;
• Email registered sellers at least 30 days before the changes take effect.

For non-material changes (corrections, clarifications, or legal compliance updates), the updated policy takes effect immediately upon posting. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.

18. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or GEMiO's privacy practices, please contact our Privacy Officer:

You may also file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or by phone at 1-800-282-1376.