Cyannect — Marketing Mesh
Log inGet Started
Draft — legal review required. This template reflects the Cyannect product’s actual data flows (cy_ref, cashback, Stripe, Resend, MongoDB, EAS Push) so Canadian counsel can validate it against PIPEDA + Quebec Law 25 before launch.

Privacy Policy

Last updated: February 2026

This Privacy Policy explains how Cyannect Inc.(“Cyannect”, “we”, “us”) collects, uses, discloses and protects personal information when you use cyannect.com, app.cyannect.com, our mobile apps or any related services (the “Services”). Cyannect is based in Canada and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec’s Law 25.

1. Scope

This Policy covers information about Shoppers (individuals who discover and redeem coupons) and Merchant contacts (business representatives who administer merchant accounts). It does not apply to Merchants’ own customer transactions on their own websites — those are governed by each Merchant’s own privacy policy.

2. Information we collect

a. Information you provide

  • Account details: name, email address, password hash (bcrypt), phone number (optional).
  • Merchant profile: business name, category, website, logo, banner, storefront descriptions, province coverage, tax/business identifiers where required.
  • Payment details: managed by Stripe. We store your Stripe customer ID and subscription IDs but never receive full card numbers.
  • Support correspondence sent to us.

b. Information collected automatically

  • Device and log data: IP address, user-agent, timestamps, referrer, campaign/UTM parameters, page paths.
  • Attribution: our cy_ref token issued when a Shopper activates an offer. It ties an outbound click on the Merchant’s website back to your Cyannect account so we can compute cashback.
  • Approximate location: derived server-side from IP address at the province level (province-aware coupon delivery is a core product feature).
  • Cookies and local storage: essential session cookies, CSRF tokens, marketing/attribution parameters.
  • Push tokens (mobile app only, when you opt in).

c. Information from third parties

  • Merchants may report verified sales through the conversions API. The report includes the cy_ref token, order ID, revenue, discount, and product-level line items.
  • Stripe reports billing events via webhooks.
  • Resend reports email delivery status (delivered, opened, bounced) so we can maintain deliverability.

3. How we use information

  • Operate the marketplace: authenticate accounts, surface province-appropriate offers, route Shoppers to Merchant sites with cy_ref.
  • Compute and settle cashback and Merchant performance fees.
  • Fraud detection and abuse prevention (rate limiting, IP allowlisting, chargeback protection).
  • Merchant billing (Stripe) and invoicing.
  • Product improvement and analytics on aggregate, non-identifiable behaviour.
  • Transactional and, if you opt in, marketing communications.
  • Comply with legal obligations (tax, anti-fraud, court orders).

Under PIPEDA we rely on your implied or express consent depending on the sensitivity of the information; and where consent is impractical, on limited PIPEDA exceptions such as fraud prevention, legal compliance and business transactions. Quebec residents may separately exercise Law 25 rights via the mechanisms in section 7.

5. When we share information

  • Merchants — when you redeem an offer we share the cy_ref token, offer ID and, at the Merchant’s option, coarse conversion metadata (e.g., that a click occurred). Cyannect does not disclose your name or email to a Merchant without your consent (for example, when you opt into a Merchant’s post-purchase list).
  • Service providers (processors) — Stripe (billing), Resend (email), MongoDB Atlas (hosted database), Expo Application Services (mobile builds and push), Cloudflare (DNS/edge), and our cloud infrastructure providers. Each is contractually bound to process personal information only on our instructions.
  • Legal — where required by law, court order or lawful demand, or to protect Cyannect, users or the public.
  • Corporate transactions — in the event of a merger, acquisition or asset sale, information may be transferred subject to confidentiality obligations and a continuing right to opt out.

6. Location of processing

Personal information may be processed and stored in Canada, the United States and other jurisdictions where our service providers operate. When information is transferred outside Canada, we use appropriate contractual and technical safeguards.

7. Your rights and choices

You may:

  • Access, correct or update your account information from your settings screen.
  • Request a copy of the personal information we hold about you.
  • Request deletion of your account and associated personal information, subject to retention obligations (e.g., financial records).
  • Withdraw consent to marketing emails at any time by clicking “unsubscribe”.
  • Complain to the Office of the Privacy Commissioner of Canada, or (Quebec) the Commission d’accès à l’information.

To exercise these rights, contact us at privacy@cyannect.com. We will respond within 30 days.

8. Retention

We retain personal information for as long as it is needed for the purposes described in this Policy, or as required by law. Typical retention periods:

  • Account records — for the life of the account plus 7 years after closure (financial records retention).
  • Conversion/cashback ledger — 7 years (accounting).
  • Session logs and analytics — up to 24 months.
  • Marketing preferences — until you opt out plus 30 days.

9. Security

We use industry-standard safeguards, including HTTPS across all surfaces, bcrypt password hashing, SHA-256 hashed reset tokens, IP allowlisting during private beta, rate limiting, encrypted secrets in environment variables, and least-privilege database access. No system is perfectly secure — please use a strong, unique password and enable device-level protections.

10. Children

The Services are not directed to children under the age of majority in their province of residence. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it.

11. Cookies

We use only cookies that are strictly necessary for the operation of the Services (authentication, CSRF protection, attribution token pass-through). We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies will make the Services unusable.

12. Changes to this Policy

We may update this Policy from time to time. Material updates will be highlighted at the top of the page and, where required, notified to you before they take effect.

13. Contact

Cyannect Privacy Officer
Email: privacy@cyannect.com
Cyannect Inc., Ontario, Canada.