GemSwapperLegal
Privacy Policy
Version 2026-10-14 · Effective 2026-10-14
This policy explains what personal information GemSwapper collects when you browse, request stones, list stones or trade, why, who sees it, how long we keep it and what rights you have. It follows Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA, and also addresses the GDPR, the UK GDPR and the CCPA/CPRA for members in those places. The French version prevails if the two differ.
- MVP-SPEC §10 describes a 3-day inspection window, but the chosen model is final sale once shipped. Reconcile (epic E8).
- MVP-SPEC §2 says eligible returns remain available to guests, which contradicts final sale.
- MVP-SPEC §10 allows untracked shipping, but tracking is mandatory in these terms. Pick one.
- Loss in transit: who refunds the buyer (seller, carrier, insurance) and when are held funds released or returned?
- 14-day hold: verify feasibility with Stripe (time-limited card authorizations), that GemSwapper is not acting as its own escrow, and any licensing duties.
- Final sale versus disputes: confirm that fraud, material misrepresentation and non-conforming items remain disputable after shipment (mandatory consumer rights).
- Pre-shipment refund: who bears Stripe fees and taxes? Fees, currency conversion, taxes (GST/QST) and high-value limits are undecided.
- Private buyer: anonymity conflicts with shipping address and payment checks. Limits to define (decision 7).
- Prohibited items and cross-border compliance (rough diamonds and the Kimberley Process, protected species such as coral or ivory, customs, sanctions) not yet drafted.
- Vercel Analytics and the AI provider (Anthropic) are described but neither approved nor wired; cookie consent, marketing opt-in and acceptance logging (IP, time, version) are still to build.
- Phone, billing address and approximate country are described but not yet stored; IP logs come from the host. Align schema and policy.
- Pro price, trial, cancellation, fees, suspension durations, appeals and untracked payout: proposed values awaiting approval (see docs/legal/TODO.md).
- Proposed retention periods, export/deletion workflow, privacy impact assessment (Law 25) and processor agreements to complete.
- Registrar acceptance of the trade name, the privacy@/legal@/support@ mailboxes, and review by Québec counsel (final sale, liability limits, transfers outside Québec).
1. Who we are and who to contact
9576-6127 Québec inc. (NEQ 1182589508), doing business as Troqueur de gemmes / Gem Swapper, 130, rue d'Ostende, Laval (Québec) H7K 3L1, Canada, operates the marketplace at gemswapper.com. We are responsible for the personal information described here.
The person in charge of the protection of personal information is Charles De Lafontaine. Write to privacy@gemswapper.com for any question or request.
2. Information we collect
We collect information you give us, information created when you use GemSwapper, and limited technical information from your device. We do not collect more than we need, and we do not ask for identity documents at launch.
Card details are handled by Stripe and are never stored by GemSwapper. Our servers and providers keep security logs that include your IP address and browser details.
| Category | Examples | Source |
|---|---|---|
| Account | Email, username, display name, password (stored hashed), buyer/seller role, tier | You |
| Contact and delivery | Shipping and billing address, phone number, country | You |
| Marketplace content | Stone requests, listings, photos you upload, offers, bids, messages, reports and documents | You |
| Transactions | Orders, payment status and amounts, tracking details, disputes, reputation events | You, Stripe, carriers |
| Technical and security | IP address, browser and device type (user agent), approximate country derived from IP, login events, error reports, record of terms acceptance (date, IP, version) | Your device |
| Video calls | Invitation, time and participants of a call. We do not record calls or store their content | You, the video provider |
| Preferences | Language, light or dark theme, notification and marketing choices | You |
3. How we use information
We use personal information only for the purposes below. Where we rely on your consent, you may withdraw it at any time.
| Purpose | Legal basis |
|---|---|
| Create and run your account, tiers and storefront | Contract; consent where Law 25 requires it |
| Match requests to stones and alert buyers and sellers | Contract; legitimate interests |
| Process payments, shipping, refunds and disputes | Contract; legal obligation |
| Calculate reputation, enforce commitments, prevent fraud and abuse, keep security logs | Legitimate interests; legal obligation |
| Record your acceptance of terms and commitments | Contract; legitimate interests |
| Send confirmations, transaction updates and service notices | Contract |
| Send marketing emails | Consent, which you can withdraw at any time |
| Measure and improve the site with analytics | Consent where required; legitimate interests |
| Comply with tax, accounting and other laws | Legal obligation |
5. Automated criteria extraction
When you write a free-text stone request, we plan to send the text to an artificial intelligence provider (Anthropic, through its Claude API) so that it suggests structured criteria such as stone, color or budget. Do not include sensitive personal details in a request.
The suggestion is not a decision about you: you review and edit the criteria before saving, and your explicit filters override it. We use the provider only to process the request and not to train its models, and we will confirm this with the provider before launch.
6. Marketing emails
We send promotional emails only with your consent, in line with Canada's anti-spam law, and each message has an unsubscribe link. Transaction confirmations and service notices are not marketing and are sent regardless.
7. What other members see
Visibility depends on tier. Standard members do not receive seller identity or reputation details; Pro members can see them. Listings and public profile fields you publish are visible to others.
Your off-platform contact details are never shown to other members. A private buyer can transact without their identity being shown to a seller; GemSwapper still knows who they are, and a seller receives the shipping information needed to deliver the stone.
8. Service providers we share data with
We share personal information with providers that process it for us under contract, only as needed to provide their service. We also share it where the law requires, to protect rights and safety, and in a business sale, with notice to you. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
| Provider | Purpose |
|---|---|
| Supabase | Database and sign-in |
| Stripe | Payments, refunds and payouts |
| Resend | Transactional and marketing email delivery |
| Inngest | Background jobs and notifications |
| Amazon Web Services | Image storage |
| Sentry | Error monitoring, without default personal data |
| Vercel | Hosting and, once enabled, analytics |
| Anthropic | Criteria suggestions from request text, once enabled |
| Google Meet or equivalent | Live video calls you choose to start |
9. Where information is processed
GemSwapper is used internationally and our providers may process information outside Québec and Canada, including in the United States. Before transferring information outside Québec we assess the risks and protections, as Law 25 requires, and rely on contracts and safeguards such as standard contractual clauses where the GDPR or UK GDPR applies.
10. How long we keep information
We keep personal information only as long as needed for the purpose, then delete or anonymize it. A fulfilled stone request is deleted the same day.
| Records | Kept for |
|---|---|
| Account and profile | Until you close the account, then 30 days |
| Transactions, payments, tax and accounting records | 7 years |
| Disputes and sanctions | 7 years after resolution |
| Messages | 2 years after last activity |
| Security logs (IP, user agent) | 12 months |
| Terms acceptance records | For as long as the related contract and its limitation periods |
| Marketing consent | Until you withdraw it |
| Fulfilled stone requests | Deleted the same day |
11. How we protect data
Marketplace data is accessed only through our servers. It is not exposed to anonymous visitors, and every database table is protected by row level security. We encrypt data in transit, hash passwords, and limit staff access to what is needed.
No system is perfectly secure. Use a strong, unique password.
12. Your rights and how to use them
You can ask to access, correct or delete your personal information, receive it in a portable format, withdraw consent, and ask how automated processing was used. Under the GDPR and UK GDPR you can also object to or restrict processing and, where we rely on consent or contract, receive your data. Under the CCPA/CPRA you can know, delete and correct, opt out of sale or sharing (which we do not do), and you will not be treated differently for exercising a right.
Write to privacy@gemswapper.com. We may ask you to confirm your identity. We answer within 30 days, and tell you if we need more time or must refuse part of a request, and why. If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, your EU or UK data protection authority, or the California Privacy Protection Agency.
13. Minors
GemSwapper is for people 18 and older. We do not knowingly collect information from minors. If you think a minor has given us information, write to us and we will delete it.
14. Privacy incidents
If an incident puts your information at serious risk of harm, we will notify you and the authorities as the law requires and take steps to limit the harm.
15. Changes to this policy
We will post updates on this page with a new effective date and, for significant changes, notify you before they apply.
16. Contact
9576-6127 Québec inc., 130, rue d'Ostende, Laval (Québec) H7K 3L1, Canada. Privacy: privacy@gemswapper.com. Support: support@gemswapper.com. Legal notices: legal@gemswapper.com.