Privacy Policy

Article 1 — Preamble and Jetroque's commitment

Jetroque Inc. is a Quebec company whose mission is to fight waste and overconsumption by facilitating the reuse of goods through swapping and donating between individuals, businesses and organizations.

This Privacy Policy informs you in full transparency about how we collect, use, retain and protect your personal information.

1.1 Scope

• Any user of our website (jetroque.com and app.jetroque.com) and our mobile application;
• Any person who has created an account;
• Any person interacting with our services (newsletter, support, events);
• Any partner company, non-profit organization or municipality.

1.2 Acceptance

By accessing our Services, you acknowledge that you have read and understood this Policy. If you do not accept its terms, do not use our Services.

Article 2 — Data controller

2.1 Chief Privacy Officer (CPO)

In accordance with section 3.1 of Law 25, Jetroque has designated a CPO responsible for ensuring compliance with this Policy. You may contact them:

• Email: privacy@jetroque.com
• Postal address: CPO, Jetroque Inc., 1085A Saint-Denis, Montreal, Quebec, H2X 3J3

Article 3 — Definitions and terminology

• Personal information: any information about an individual that allows them to be identified directly or indirectly.
• Processing: any operation performed on personal information (collection, use, retention, disclosure, destruction).
• User / You: any natural or legal person who uses Jetroque's Services.
• Platform: the Jetroque website and mobile application.
• Cookies: small files stored on your device.
• Processor: a third-party service provider that processes personal information on behalf of Jetroque.
• Law 25: An Act to modernize legislative provisions as regards the protection of personal information (Quebec, September 22, 2022).
• CAI: Commission d'accès à l'information du Québec (Quebec Access to Information Commission).

Article 4 — Personal information collected

Jetroque applies the principle of data minimization.

a) Identification and profile

• First and last name (required); date of birth (age verification); email address (required); profile photo + biography (optional); phone number (optional, SMS).

b) Location

• Postal code and city (required); GPS with explicit consent; approximate geolocation via IP; neighbourhood displayed publicly (never the exact address).

c) Login and authentication

• Username, encrypted password (bcrypt), login history, third-party methods (Google/Apple/Facebook), 2FA codes.

d) Transactional data

• Swap and donation history, Jetroque Credits balance, ratings, pickup requests (with address), item photos and descriptions.

e) Payment data (paid subscriptions)

Stripe collects: cardholder name, card number, expiry date + CVV, billing address, payment history. Jetroque receives only: payment status, last 4 digits, card type, transaction identifier. See stripe.com/privacy.

f) Technical data

• IP address, device type, OS, browser, Device ID, cookies (see Article 12).

g) Usage and behaviour

• Pages visited, searches, interactions (swipes, likes, matches), time spent, traffic source.

h) Communications

• Internal messages, exchanges with support, survey responses.

i) Identity verification (KYC)

In cases of fraud or premium requests, proof of identity may be required. Retained for a maximum of 6 months, then deleted/anonymized, accessible only to authorized employees.

Article 5 — Purposes of processing

Article 6 — Legal bases for processing

6.1 Performance of contract

The majority of our processing is necessary for the performance of the contract entered into with you (Terms of Service). Without this data, we cannot provide our Services.

6.2 Consent

Certain processing is based on your free, informed and specific consent: marketing communications · non-essential cookies (analytics, advertising) · precise GPS · sharing of impact with municipalities · push notifications. Withdrawal is possible at any time, without affecting the lawfulness of prior processing.

6.3 Legitimate interest

Platform security and fraud prevention · continuous improvement of Services · ecological impact measurement.

6.4 Legal obligation

Tax and accounting obligations, anti-money laundering, responding to judicial requests.

Article 7 — Data hosting and location in Quebec

7.2 Specific commitments

• Account data, listings, messaging and history: stored in Quebec;
• Backups in Quebec in separate data centres;
• Access and security logs in Quebec;
• Primary host in Quebec or Canada;
• International transfers only to processors offering equivalent guarantees (Standard Contractual Clauses, GDPR-compliant DPA, PCI-DSS / SOC 2 certifications).

7.3 Why host primarily in Quebec?

• Native compliance with Law 25;
• Digital sovereignty and support for the local economy;
• Reduced carbon footprint (Quebec hydroelectricity);
• Reduced exposure to extraterritorial legislation (such as the US Cloud Act) for data stored in Canada. Important: data processed by US processors (e.g. Stripe) remains subject to the laws of their home jurisdiction — you are informed of this below.

7.4 International processors (documented exceptions)

For each of these transfers, Jetroque has assessed the necessity, proportionality and legal safeguards. An up-to-date list of processors is available upon request at privacy@jetroque.com.

7.5 Privacy Impact Assessments (PIA)

In accordance with Law 25, Jetroque conducts PIAs before any project involving personal information (selection of service providers, new features).

Article 8 — Recipients and processors

a) Other Users (public visibility)

To enable swapping, certain information is visible: first name/username, profile photo, biography, neighbourhood or city (never the exact address), listings, ratings and reputation.

b) Technical processors

All our processors are bound by contracts compliant with Law 25 (processing according to our instructions, confidentiality, security, no transfer without authorization, incident notification).

c) Public authorities

Disclosure to authorities (police, courts, tax authorities) only upon legal obligation or valid court order, vital emergency, or investigation into fraud/serious breach of the Terms of Service.

d) Partner municipalities (aggregated data)

Only aggregated and anonymized data is shared (kg diverted, CO₂ avoided, number of exchanges). No identifiable individual data.

e) Assignment, merger, restructuring of Jetroque

In the event of a merger, acquisition, total or partial transfer of assets, demerger, restructuring, bankruptcy or similar transaction involving Jetroque Inc., your personal information may be transferred to the successor or acquirer, who will be required to protect it under conditions at least equivalent to this Policy. You will be notified within a reasonable time and will retain all of your rights, including the right to close your account before the transfer is completed. This clause is strictly governed by Law 25 and the GDPR (art. 6.1.f).

f) Non-sale commitment

Outside the cases listed above, Jetroque does not sell, rent or exchange your personal information for commercial purposes.

Article 9 — Data retention periods

In accordance with Law 25, data is retained for the strictly necessary period plus applicable legal retention requirements.

Article 10 — Data security

10.1 Technical measures

• HTTPS / TLS 1.3 encryption;
• AES-256 encryption of sensitive data at rest;
• bcrypt password hashing;
• 2FA available;
• Firewalls and IDS/IPS;
• Anti-DDoS protection;
• Banking tokenization (Stripe);
• Encrypted and redundant backups in Quebec.

10.2 Organizational measures

• Restricted "need to know" access;
• Tracked access logs;
• Ongoing employee training;
• Confidentiality agreements;
• Strict password policy;
• Documented incident management procedures.

10.3 Audits

• Annual penetration testing by external providers;
• Law 25 audits;
• Continuous vulnerability monitoring;
• Security updates without delay.

Article 11 — Your rights (Law 25)

11.1 How to exercise your rights

Via your account settings, by email at privacy@jetroque.com, or by postal mail to the CPO. Proof of identity may be required.

11.3 Free of charge

Exercising your rights is free of charge. In the case of manifestly unfounded or excessive requests (particularly repetitive ones), reasonable administrative fees may be charged or the request may be refused with reasons given.

11.4 Limitations and reasoned refusals

Certain rights, in particular the right to erasure, may be limited or refused when:

• A legal obligation requires retention (e.g. tax and accounting obligations: 7 years in Canada);
• The data is necessary for establishing, exercising or defending a legal claim;
• The data concerns an ongoing dispute with another user or Jetroque;
• The data is contained in backups whose deletion will occur automatically upon expiry of the cycle (maximum 90 days);
• Reasonable proof of identity has not been provided (to prevent impersonation);
• Erasure would infringe the rights of third parties (e.g. ratings left about you by other users, which remain visible in anonymized form).

Any refusal is provided in writing and indicates the avenues of recourse available with the CAI or the competent supervisory authority.

Article 12 — Cookies

12.1 What is a cookie?

A cookie is a small text file placed on your device that allows certain browsing information to be stored.

12.2 Categories used

12.3 Management

Via the consent banner (first visit), the preference centre in the footer, or your browser settings. Declining analytics/marketing cookies does not affect use of the Services.

Article 13 — Minors and youth protection

Jetroque does not knowingly collect personal information about minors below the required age. Registering by means of false age declarations constitutes a violation of the Terms of Service and results in immediate account closure.

If you are a parent or guardian and are aware that a minor has created an account without your authorization, contact us immediately at privacy@jetroque.com. The account and associated data will be deleted as soon as possible (and no later than within 30 days).

For European users, this processing falls within the framework of Article 8 of the GDPR; for Quebec users, within Articles 4.1 and 4.2 of Law 25.

Article 14 — Privacy incident notification

14.1 Legal obligation

In accordance with section 3.5 of Law 25, in the event of an incident presenting a serious risk of harm, Jetroque undertakes to:

• Notify the Commission d'accès à l'information (CAI) as soon as possible;
• Notify you personally if you are affected (email or in-app notification);
• Maintain an incident register;
• Take appropriate corrective measures.

14.2 Content of the notification

Description of the incident and its nature · categories of data concerned · potential consequences · measures taken · recommendations · contact information for further information.

Article 15 — Commercial communications and marketing

15.1 Canada's Anti-Spam Legislation (CASL)

In accordance with CASL, Jetroque will only send you commercial electronic messages after obtaining your explicit consent. Withdrawal is possible at any time.

15.2 Types of communications

• Transactional notifications (swap confirmation, pickup, security): no consent required, necessary for the service;
• Jetroque newsletter: consent required;
• Promotional offers: consent required;
• Surveys: consent required.

15.3 Unsubscribe

At any time via the link in each email, account settings, or privacy@jetroque.com.

Article 16 — Automated decisions and profiling

16.1 Use of algorithms

Jetroque uses algorithms (including AI) to: suggest relevant items · detect fraudulent behaviour · automatically generate descriptions from photos · estimate ecological impact (CO₂ avoided).

16.2 Rights relating to profiling (Law 25)

• Be informed of the use of automated decisions;
• Obtain explanations of the criteria used;
• Contest an automated decision with a human employee;
• Refuse profiling for marketing communications.

16.3 Partially automated decisions (security)

Certain security and fraud prevention measures (anti-spam filtering, detection of multiple accounts, temporary blocking after suspicious login attempts) may be triggered automatically by our systems. In all such cases:

• You are informed of the measure and its nature;
• You may contest the measure with a human employee via support@jetroque.com;
• Any final decision with significant legal impact (permanent closure of a paid account, exclusion from a partner program, reporting to authorities) is subject to prior documented human review.

Article 17 — Amendments to this Policy

Jetroque may amend this Policy to reflect legislative changes, new features, best practices, or recommendations from competent supervisory authorities.

17.1 Notice

In the event of a substantial amendment, Jetroque will inform you at least 30 days before the effective date, through the following channels: email, in-app notification, and banner on the website. The date of the last update and the effective date are always indicated in the header.

17.2 Right to object

If you do not accept the new version, you may at any time, and no later than before the effective date, close your account without charge or penalty via the application settings or by writing to privacy@jetroque.com. Continuing to use your account after the effective date constitutes acceptance of the new version.

17.3 Non-substantial amendments

Purely formal amendments (spelling corrections, updated contact details, editorial clarifications that do not change purposes or rights) may be made without notice, with the date in the header updated accordingly.

17.4 Archiving

Previous versions of the Policy are retained and provided upon simple request to privacy@jetroque.com.

Article 18 — Complaints and supervisory authority

18.1 Complaint to Jetroque

File a complaint with the CPO: privacy@jetroque.com (subject: "Complaint — Personal Information Protection"). Acknowledgement of receipt within 5 business days, response within 30 days maximum.

18.2 Complaint to the CAI

18.3 Supervisory authorities for international users

If you reside outside Quebec, you may also contact the supervisory authority of your place of habitual residence:

Article 19 — Contact the Privacy Officer (CPO)

Article 20 — Limitation of liability

Jetroque implements reasonable technical and organizational measures, consistent with the state of the art and recognized industry standards (Article 10), to protect your personal information. However, no system is entirely infallible.

Subject to mandatory statutory provisions that cannot be excluded by contract:

• Jetroque is only liable for direct, foreseeable and reasonably attributable damages resulting from a fault of Jetroque;
• Jetroque is not liable for indirect damages (loss of opportunity, loss of revenue, reputational harm, data loss caused by the user's failure to maintain backups);
• Jetroque's total liability, for all causes combined, is capped at the amount actually paid by the user to Jetroque in the 12 months preceding the triggering event. For free accounts, this cap is set at CAD $100;
• These limitations do not apply in cases of gross negligence, fraud, or bodily harm.

These limitations reflect a reasonable balance between the free or low-cost nature of the Services and the risks inherent in any data processing.

Article 21 — Force majeure

Jetroque shall not be held liable for any failure to fulfil its obligations resulting from a force majeure event, as understood under Quebec and European law, including in particular:

• Cyberattacks of exceptional scale or exploiting an unknown vulnerability ("0-day") despite the implementation of reasonable security measures;
• Compromise of an essential processor despite its own certifications;
• Decision by a public authority requiring suspension of the Service;
• Natural disasters, massive infrastructure outages (network, power), armed conflicts, pandemics.

In all such cases, Jetroque undertakes to: (i) inform you as soon as possible; (ii) take all reasonable measures to limit the consequences; (iii) fulfil its incident notification obligations (Article 14) where applicable.

Article 22 — User indemnification

You agree to defend, indemnify and hold harmless Jetroque, its officers, employees and processors against any claim, action, damages, losses or costs (including reasonable legal fees) arising from:

• Providing false, inaccurate or misleading information during registration or when publishing listings;
• Use of your account by a third party due to your failure to protect your login credentials;
• Your violation of the Terms of Service or this Policy;
• Infringement of third-party rights (intellectual property, privacy, defamation) through your activity on the Platform;
• Any fraud, scam or illegal activity committed through your account.

This clause does not exclude the mandatory consumer protections to which you are entitled.

Article 23 — Passive host status for private messaging

Messages exchanged privately between users via Jetroque's messaging service are strictly confidential. Jetroque acts as a passive host with respect to these communications:

• No Jetroque employee systematically or proactively reads the content of your private messages;
• Automated systems may detect certain prohibited content (illegal material, spam, scam attempts, sharing of contact details circumventing the Platform);
• Jetroque may access messages in strictly limited cases: user report, fraud investigation, valid court order, vital emergency;
• Jetroque is not responsible for the content of messages exchanged or for private agreements concluded between users.

This regime falls within the framework of the LCEN (France, art. 6), European Directive 2000/31/EC and the Civil Liability Act in Quebec.

Article 24 — Data accuracy and user responsibility

You are solely responsible for the accuracy, currency and truthfulness of the information you provide to Jetroque. You undertake to:

• Provide complete and accurate information at registration;
• Update this information without delay in the event of any change;
• Not impersonate any third party;
• Reasonably protect your login credentials (password, 2FA codes).

Jetroque makes its decisions (matching, reputation calculation, payment processing) based on the information you provide. Jetroque is not responsible for consequences resulting from inaccurate or outdated information on your part.

Article 25 — Governing law, jurisdiction and dispute resolution

25.1 Governing law

This Policy is governed by the laws of Quebec and applicable Canadian federal law, without prejudice to any more protective mandatory provisions to which you are entitled under the law of your place of habitual residence (in particular the GDPR for users in the European Union).

25.2 Amicable resolution

In the event of a dispute, the parties undertake to seek an amicable solution. You are invited to contact our CPO at privacy@jetroque.com first, who has a maximum of 30 days to respond.

25.3 Jurisdiction

Failing amicable resolution, any dispute relating to this Policy shall be submitted to the exclusive jurisdiction of the courts of the judicial district of Montreal, Quebec, Canada, subject to any mandatory consumer jurisdiction rules under the law of your place of habitual residence.

25.4 Mediation and authorities

Prior to any legal action, you may contact the competent supervisory authorities listed in Article 18 free of charge.

Article 26 — Miscellaneous provisions

26.1 Entire agreement

This Policy, together with the Terms of Service and any ancillary policies, constitutes the entire agreement between you and Jetroque regarding the processing of your personal information.

26.2 Severability

If any provision of this Policy is found to be invalid, unlawful or unenforceable by a court of competent jurisdiction, that provision shall be deemed unwritten and the remaining provisions shall continue in force.

26.3 No waiver

Jetroque's failure to enforce any provision shall not be construed as a waiver of its right to do so at a later date.

26.4 Language

This Policy is drafted in French, which prevails in the event of any discrepancy with any translation.

26.5 No third-party beneficiaries

This Policy does not create any rights for third parties who are not parties to it.

Document generated June 24, 2026 · Version 2026.2 — Effective June 24, 2026 · Jetroque Inc. · Compliant with Law 25 (Quebec), PIPEDA (Canada) and GDPR (EU)