Privacy Policy
1. Who We Are
CuddleBridge (“CuddleBridge,” “we,” “us,” or “our”) is an online platform operated by Sino Turing and Molan Liu, with its principal place of business in Vancouver, British Columbia, Canada. We connect shelter dogs with caring people for day-long outings, with the goal of increasing adoption outcomes for dogs in the Vancouver shelter network.
CuddleBridge acts as the data controller for personal information collected through the cuddlebridge.ca website and any associated mobile applications (collectively, the “Platform”).
We are committed to protecting your personal information in compliance with the BC Personal Information Protection Act (PIPA) and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
2. What Personal Information We Collect
2.1 Account Information
When you register on the Platform, we collect your full name, email address, and phone number. This information is necessary to create and manage your account, communicate with you, and verify your identity as a borrower.
2.2 Identity Verification Data
To vet borrowers and ensure the safety of the dogs and partner shelters, we collect a copy of your government-issued photo identification. This data is encrypted in transit and at rest, used solely for verification purposes, and deleted within seven (7) days of successful verification. We do not retain copies of identity documents beyond that window except where required by a legal obligation or investigation.
2.3 Transaction Data
Payment processing is handled entirely by Stripe, Inc. CuddleBridge does not collect, transmit, or store raw payment card numbers, CVV codes, or full bank account details. We receive and store transaction confirmation records from Stripe (e.g., amount, date, booking reference, and last four digits of the card). These transaction records are retained for seven (7) years in compliance with Canada Revenue Agency requirements.
2.4 Location Data
When you initiate or are engaged in a borrow session, we may collect your approximate geographic location to coordinate session logistics. We do not continuously track your location outside of active borrow sessions.
2.5 Dog Behavioral Data (C-BARQ Scores)
CuddleBridge collects, stores, and processes C-BARQ scores for dogs listed on the Platform. C-BARQ data describes animal behavior, not individual human behavior, and does not constitute personal information under PIPA or PIPEDA. We use aggregate and anonymized C-BARQ data to train and improve our behavioral matching models; no personally identifiable information is included in that training pipeline.
2.6 Usage Data and Analytics
When you visit or use the Platform, we automatically collect certain technical and usage information, including your IP address, browser type, device type, operating system, pages visited, and referring URLs. This data is collected through Vercel Analytics and our application server logs.
2.7 Communications
Messages exchanged between borrowers and partner shelters through the Platform’s in-app messaging system are stored on our servers for the purpose of facilitating the borrow arrangement, resolving disputes, and maintaining a record of any commitments made.
3. Why We Collect It — Legal Basis
CuddleBridge collects personal information only for reasonable purposes that a person would consider appropriate in the circumstances (the standard required under PIPA s. 11 and PIPEDA Principle 4.4).
| Category | Primary Purpose | Legal Basis |
|---|---|---|
| Account information | Creating and managing your account | Contractual necessity |
| Identity verification | Vetting borrowers; ensuring dog and public safety | Legitimate interest (safety) + legal obligation |
| Transaction data | Processing payments; tax compliance | Contractual necessity; legal obligation |
| Location data | Session coordination within service area | Contractual necessity; consent |
| C-BARQ scores | Behavioral matching; ML model improvement | Legitimate interest |
| Usage data / analytics | Platform performance and improvement | Legitimate interest |
| Communications | Facilitating bookings; dispute resolution | Contractual necessity; legitimate interest |
4. Who We Share Your Information With
CuddleBridge does not sell personal information.
4.1 Partner Shelters
When you book a borrow session, we share booking details necessary to facilitate the session with the relevant partner shelter — your name, contact information, booking date and time, and confirmation that identity verification was completed. We do not share your government-issued ID image with shelters.
4.2 Stripe, Inc.
Payment processing is handled by Stripe, Inc., a PCI DSS-compliant payment processor. Stripe may process and store your payment data on servers located outside Canada, including in the United States. We encourage you to review Stripe’s Privacy Policy at stripe.com/privacy.
4.3 Supabase, Inc. (Data Storage)
CuddleBridge uses Supabase as its primary database. Supabase is a US-based company and its servers may be located in the United States or other jurisdictions outside Canada. By using the Platform, you acknowledge that your personal information may be transferred to and stored in the United States.
4.4 Vercel, Inc. (Hosting and Analytics)
The Platform is hosted on Vercel’s infrastructure. Vercel Analytics collects aggregate, anonymized usage data and does not collect personally identifiable information.
4.5 Weights & Biases, Inc. (ML Tracking)
CuddleBridge uses W&B for machine learning experiment tracking. We share only aggregate, anonymized metrics with W&B — no personally identifiable information is transmitted.
4.6 Legal Disclosure
We may disclose your personal information without your consent where permitted or required by PIPA s. 18, including:
- To comply with a court order, subpoena, or other legal process.
- To a government institution that has identified its lawful authority to request the information.
- In connection with an investigation of a breach of an agreement or contravention of a law.
- In an emergency that threatens life, health, or safety.
5. Your Rights
Under PIPA and PIPEDA, you have the following rights with respect to your personal information held by CuddleBridge:
- Right to Access:You may request access to the personal information we hold about you. We will respond within thirty (30) days of receiving a valid access request.
- Right to Correct:If you believe that personal information we hold about you is inaccurate or incomplete, you may request that we correct it.
- Right to Request Deletion:You may request that we delete your personal information, subject to our legal retention obligations.
- Right to Withdraw Consent:Where we collect and use personal information on the basis of your consent, you may withdraw that consent at any time.
- Right to Data Portability:You may request a copy of the personal information you have provided to us in a structured, commonly used, and machine-readable format.
- Right to Lodge a Complaint:If you are not satisfied with how CuddleBridge has handled your personal information, you may contact the Office of the Information and Privacy Commissioner for BC (OIPC BC) at oipc.bc.ca.
To exercise any of these rights, contact us at privacy@cuddlebridge.ca.
6. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data (name, email, phone, history) | 3 years after last account activity, then deleted |
| Identity verification documents | Deleted within 7 days of successful verification |
| Transaction records | 7 years from transaction date (CRA requirement) |
| Location data (session records) | Retained as part of session history; deleted with account |
| Usage / analytics data | Aggregate only after 90 days; raw logs deleted within 90 days |
| Communications | Duration of account + 3 years, or until deletion request |
7. Data Security
We implement reasonable administrative, technical, and physical safeguards to protect your personal information. Specific measures include:
- Encryption of data in transit (TLS) and at rest
- Encrypted storage of identity verification documents
- Access controls limiting employee access to personal information on a need-to-know basis
- Two-factor authentication for administrative access to data systems
- Regular security reviews
In the event of a breach of personal information that creates a real risk of significant harm to you, we will notify you and the OIPC BC as required under PIPA and applicable law.
8. Children and Age of Majority
CuddleBridge is a service for adults. You must be at least nineteen (19) years of age to create an account, which is the age of majority in British Columbia under the Age of Majority Act (RSBC 1996, c. 7). We do not knowingly collect personal information from individuals under the age of 19.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by posting a notice on the Platform at least thirty (30) days before the change takes effect.
10. Cookie Policy
10.1 What Are Cookies
Cookies are small text files stored on your device when you visit a website. CuddleBridge also uses similar technologies such as local storage and session tokens.
10.2 Cookies We Use
| Cookie Name | Purpose | Type | Expiry |
|---|---|---|---|
| fb_access | Session authentication token. Keeps you logged in. Set as httpOnly to reduce XSS risk. | Strictly necessary | 7 days |
10.3 Third-Party Analytics
We use Vercel Analytics to collect aggregate usage data. Vercel Analytics is designed to be privacy-preserving: it does not use tracking cookies and does not collect personally identifiable information.
10.4 No Advertising or Third-Party Tracking Cookies
At launch, CuddleBridge does not use any third-party advertising networks, retargeting pixels, social media tracking buttons, or behaviorally targeted advertising. We do not sell your data to advertisers.
11. Contact and Complaints
CuddleBridge — Privacy Officer
Sino Turing and Molan Liu
Vancouver, British Columbia, Canada
Email: privacy@cuddlebridge.ca
Website: cuddlebridge.ca
We will acknowledge your inquiry within five (5) business days and respond fully within thirty (30) days, as required under PIPA.
If you are not satisfied with our response, you have the right to contact the Office of the Information and Privacy Commissioner for BC (OIPC BC):
- Website: oipc.bc.ca
- Phone: 250-387-5629 (Victoria) / 604-660-2421 (Vancouver)
- Address: PO Box 9038 Stn Prov Govt, Victoria, BC V8W 9A4