Privacy Policy

Who We Are

IN-STORE Design Inc. is a digital marketing and technology agency incorporated in Ontario, Canada. We operate in-store.ca as our primary marketing, onboarding, and client services platform.

We act as a data controller for personal information we collect directly. Where we process personal data on behalf of our White-Label Partners or their clients, we act as a data processor.

Where we access data held on third-party platforms - including Meta (Facebook, Instagram, WhatsApp, Threads) and TikTok - on behalf of a Direct Client or a White-Label Partner, we likewise act as a service provider / data processor on that client's documented instructions. The client remains the controller of that data (see Section 15).

Contact for Privacy Matters: legal@in-store.ca | IN-STORE Design Inc., Ontario, Canada

Scope of This Policy

This Policy applies to: Direct Clients who engage IN-STORE through our website or intake platform; White-Label Partners authorized to resell our services; End Clients of Partners whose data Partners provide to IN-STORE in connection with White-Label service delivery; and Website Visitors who visit in-store.ca or its intake routes. It also applies to Platform Data we access from third-party platforms (including Meta and TikTok) strictly on behalf of clients who have authorised that access, as described in Sections 4.6 and 15. This Policy does not apply to third-party websites or services linked from our platforms.

Legal Framework

Personal Information We Collect

4.1. Information You Provide Directly

4.2. Information Collected Automatically

When you visit our websites, we automatically collect technical data including IP address and approximate geographic location, browser type and version, operating system, pages visited and session duration, referring URL, device type, and session identifiers.

4.3. Device & Technical Environment Data (Signed-In Users)

When you sign in to and use our client platform, we collect a technical profile of the device and browser environment you use to access the Services. This information is made available by your browser through standard web interfaces (such as the User-Agent string and User-Agent Client Hints) and may include: browser name and version; operating system and version; device type and, where the browser exposes it, device model; screen resolution and pixel density; input capabilities (touch or pointer); preferred language; time zone; and connection characteristics (such as network type).

We collect this information for the following limited purposes: (a) operating the platform and rendering it correctly on your device; (b) diagnosing and resolving technical issues, including reproducing errors on the same browser and device configuration on which they occurred; (c) ensuring compatibility of new features across the devices our clients actually use; and (d) protecting the security of your account, including identifying sign-ins from unrecognized devices. The legal basis for this processing is contractual necessity and our legitimate interest in maintaining a reliable and secure service.

Device and technical environment data is not used for advertising, behavioural profiling, or automated decision-making, is not enriched with data from other sources, and is not disclosed to third parties except to the service providers listed in Section 6.1 to the extent strictly necessary to host and operate the platform. We do not employ device fingerprinting techniques that circumvent browser privacy controls.

4.4. Information from Third Parties

We may receive personal information from White-Label Partners who provide End Client data; CRM and marketing platforms integrated by Client; third-party platforms whose APIs we access on a client's behalf under the client's own authorisation, including Meta and TikTok (see Section 4.6); and public professional sources such as business directories and LinkedIn (used in the IN-STORE AI Sales service).

4.5. Sensitive Information

We do not intentionally collect sensitive personal information such as health data, financial account numbers, government identification numbers, racial or ethnic origin, or religious beliefs. If such information is inadvertently provided, we will delete it and notify you promptly.

4.6. Platform Data Accessed on Behalf of Clients (Meta, TikTok and Similar Platforms)

Where a client engages us to manage their presence or advertising on a third-party platform, the client grants us access to their own business assets through the platform's own delegated-access system - for example Meta Business Manager partner access or TikTok Business Center access. We never obtain such access by asking for the client's password.

Through those authorised connections we may access, on the client's instructions:

• Meta: the client's Facebook Pages and their published content, comments and engagement metrics; linked Instagram professional accounts, their media, comments and insights; ad accounts, campaigns, audiences and advertising performance data; product catalogues; WhatsApp Business accounts, phone numbers, message templates and messaging analytics; and the client's datasets/pixels, including server-side conversion events sent from the client's own website.
• TikTok: the client's TikTok Business Account, its published videos, profile information, comments and engagement metrics; TikTok Ads Manager advertiser accounts, campaigns, audiences and performance reports; and, where used by the client, TikTok Pixel and Events API data originating from the client's own properties.

This information may incidentally include personal information of people who interact with the client's channels (for example, the display name of a commenter). We access it only to the extent needed to deliver the contracted service, we process it under the client's instructions, and we treat it under the restrictions in Sections 6.5, 8, 13 and 15.

How We Use Your Information

How We Share Your Information

IN-STORE does not sell personal information. We share data only in the following circumstances.

6.1. Service Providers & Technology Partners

We use third-party processors to deliver our Services, including automation platforms (e.g., Make/Integromat), AI model providers (e.g., OpenAI, Anthropic, Google), CRM and outreach tools, cloud hosting providers, payment processors, and analytics providers. All are bound by data processing agreements.

6.2. White-Label Partners

Client data provided by the Partner is shared with IN-STORE solely for the purpose of service delivery. IN-STORE does not use End Client data for any purpose beyond fulfilling the Partner's service contract.

6.3. Legal & Regulatory Disclosure

We may disclose personal information if required by law, court order, or regulatory authority. Where legally permissible, we will notify the affected individual prior to disclosure.

6.4. Business Transfers

In connection with a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity subject to equivalent privacy protections.

6.5. What We Never Do

• We do not sell, rent, or trade personal information to third parties for their own marketing purposes;
• We do not use End Client data provided through White-Label Partners for IN-STORE's own marketing;
• We do not share personal information across unrelated White-Label Partner accounts;
• We do not disclose personal information to advertisers or data brokers.
• We do not sell, license or otherwise monetise Platform Data obtained from Meta, TikTok or any other platform API;
• We do not combine Platform Data belonging to one client with data of any other client, and we do not use it to build IN-STORE's own audiences, profiles or marketing lists;
• We do not use Platform Data for advertising outside the client's own advertising accounts;
• We do not use Platform Data to train artificial-intelligence or machine-learning models;
• We do not attempt to re-identify individuals from aggregated or anonymised platform metrics, and we do not use Platform Data in connection with eligibility decisions (credit, insurance, employment, housing or similar).

Cookies & Tracking Technologies

You may manage cookie settings through our cookie consent banner on first visit, your browser settings, or opt-out tools provided by analytics providers. We honor Do Not Track browser signals to the extent technically practicable.

Data Retention

Following the applicable retention period, personal information is securely deleted or irreversibly anonymized.

Cancelling is not the same as deleting. If you cancel your subscription, we place your data on hold for 60 days so you can return or transition away without losing your work. If you delete your account, everything listed in Section 16 is erased immediately and cannot be recovered - by you or by us - apart from the financial records we are legally required to keep.

International Data Transfers

IN-STORE operates in Canada and uses technology providers that may process data in the United States, the European Union, and other jurisdictions. Where personal data is transferred outside Canada, we ensure appropriate safeguards including standard contractual clauses (SCCs), adequacy decisions, and data processing agreements with all third-party processors.

Your Privacy Rights

10.1. Canada (PIPEDA)

Right to access personal information we hold; request correction of inaccurate information; withdraw consent to non-essential processing; and file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

10.2. Quebec (Law 25)

Additionally: data portability, request correction and its communication to third parties, request de-indexing, and file a complaint with the Commission d'accès à l'information (www.cai.gouv.qc.ca).

10.3. EU / EEA (GDPR)

Right to access, rectification, and erasure; restriction of processing and data portability; object to processing based on legitimate interests; withdraw consent; and lodge a complaint with your local Data Protection Authority.

10.4. California (CCPA / CPRA)

Right to know what personal information is collected, used, shared, or sold; delete personal information; opt out of the sale or sharing of personal information (note: IN-STORE does not sell personal information); and non-discrimination for exercising privacy rights.

10.5. How to Exercise Your Rights

Submit a written request to legal@in-store.ca. We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request. Step-by-step instructions for requesting deletion, including deletion of Platform Data, are set out in Section 16 of this Policy.

Security Measures

IN-STORE implements commercially reasonable technical and organizational security measures to protect personal information, including encryption of data in transit and at rest, access controls, and regular security assessments. Platform API credentials issued to us (such as Meta system-user tokens) are held in encrypted storage with file-level access restrictions, are never embedded in client-side code, are accessible only to personnel responsible for the client concerned, and can be revoked at any time by the client from their own platform settings. All access to platform APIs occurs over encrypted (TLS) connections, and multi-factor authentication is enforced on the accounts that administer such access. In the event of a data breach affecting your personal information, we will notify you and applicable regulatory authorities as required by law.

White-Label Partners - Data Responsibilities

Where IN-STORE delivers services through a White-Label Partner, the Partner is the data controller for all personal information of End Clients. IN-STORE acts as a data processor, processing End Client data only as instructed by the Partner and as necessary to deliver the contracted services. White-Label Partners are responsible for their own privacy policy, lawful basis for data collection, and executing a Data Processing Agreement with IN-STORE.

IN-STORE maintains strict data isolation between different Partner accounts. End Client data from one Partner is not accessible to or shared with any other Partner under any circumstances.

Automated Decision-Making & AI

Some of our Services use AI and automated processing to generate content and analyze data. Where AI tools process personal information on your behalf: we use AI solely to deliver contracted Services, not to make legally significant automated decisions about individuals; content generated by AI is subject to Client review and approval before publication; and we do not use Client data to train third-party AI models beyond what is permitted under our agreements with those providers. Platform Data obtained from Meta or TikTok APIs is never used to train, fine-tune or evaluate any artificial-intelligence or machine-learning model, whether ours or a third party's.

Children's Privacy

Our Services are intended for businesses and professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we may hold information about a minor, please contact us at legal@in-store.ca.

Third-Party Platform Data - Developer Policy Compliance

When we access data through Meta's APIs we do so as a Tech Provider acting on behalf of the client that authorised the access, and we comply with the Meta Platform Terms, Meta Developer Policies, Meta Business Tools Terms and the applicable product terms (including the WhatsApp Business Terms). When we access data through TikTok's APIs we comply with the TikTok Developer Terms of Service, TikTok Business Products (Data) Terms and TikTok Advertising Policies.

In each case we: use Platform Data only for the permitted purpose of providing the contracted service to the client whose assets the data belongs to; retain it no longer than needed for that purpose (Section 8); protect it as described in Section 11; do not transfer it except to subprocessors bound by equivalent obligations (Section 6.1); and delete it when the authorisation ends or the platform or client requires deletion. If a platform requests certification of deletion, we provide it. Clients may revoke our access at any time directly in Meta Business Manager or TikTok Business Center, without notice to us.

Data Deletion Instructions

This section is our official data deletion procedure for the purposes of Meta, TikTok and any other platform requiring published deletion instructions.

Delete your account yourself, at any time. Sign in and open Settings, then Payments & subscription, and use Unsubscribe and delete my account. You will be shown exactly what is about to be erased and asked to confirm. On confirmation we immediately cancel your subscription and erase your profile, email address and contact details, your intake answers and account settings, your content, media plan and uploaded files, and your stored payment profile. No refund is issued for the remainder of the current period.

This is immediate and permanent. There is no hold period, no restore, and no way for our support team to recover anything afterwards. If you only want to stop being billed, cancel your subscription instead: your data is then held for 60 days, as set out in Section 8.

What we keep even then. Invoices and payment records are retained for 7 years, as tax law requires. Card details are never stored by us at all; they are held by our payment processor. Content already published to your own website or social accounts is on your property and is not ours to remove. Copies of deleted data may persist in encrypted backups until those backups are overwritten on their normal rotation, within 30 days.

If you are a client (or White-Label Partner) and want us to stop processing data connected to your platform accounts:

1. Revoke our access at the source. In Meta Business Manager: Settings → Users → Partners → select IN-STORE → remove assigned assets or remove the partner. In TikTok Business Center: Members / Partners → remove IN-STORE. Revocation takes effect immediately and ends our ability to read or write anything on your accounts.
2. Request erasure of what we hold. Email legal@in-store.ca with the subject line "Data deletion request", stating your business name and the accounts or services concerned.

If you are an individual - for example you commented on or messaged a page we manage for a client, or you submitted information through our website - email legal@in-store.ca with the subject line "Data deletion request" and enough detail for us to locate your information (the page, account or form concerned and the name or handle you used). Where we hold the data as a processor for a client, we will forward your request to that client and assist them in fulfilling it, as platform rules and privacy law require.

What happens next. A deletion you perform yourself in your account takes effect immediately and is confirmed by email. For requests sent to us by email, we acknowledge within 5 business days, verify the requester's identity or authority, complete deletion within 30 days, and confirm completion in writing. We may retain the minimum records we are legally required to keep (for example, invoices and CASL consent logs); if so, we will say so in our confirmation. There is no charge for making a deletion request.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, post the updated Policy on our website, and notify active Clients by email at least 14 days before changes take effect. Continued use of our Services after the effective date constitutes acceptance of the revised Policy.

Contact & Complaints

If you are not satisfied with our response, you may contact: the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); Commission d'accès à l'information - Quebec (www.cai.gouv.qc.ca); your local EU/EEA Data Protection Authority; ICO - UK (www.ico.org.uk); or the California Attorney General (oag.ca.gov).