Privacy policy

No advertising network, no tracking pixels, no analytics cookies.

There is no Google Analytics on this site, no ad network, and nothing that follows you to another site. We count visits ourselves, in totals, without cookies, and Microsoft Clarity shows us how pages are used, with every word hidden and without a cookie.

We never sell your personal information.

Not to anyone, for any price. We do not rent or trade mailing lists either.

We email you about things you did.

Verifying an address, a claim, a reminder that a yearly plan renews, a reply. There is no newsletter and no marketing list. Payment receipts come from Whop.

Most of the directory is business information, not personal information.

If a listing carries something personal about you, tell us and we will change or remove it.

You can ask what we hold, correct it, or have it deleted.

One email does it, and it is free. Your rights says how.

This summary is a guide to the page, not a substitute for it. The numbered sections are the policy.

Via Ottawa operates viaottawa.ca from Ottawa, Ontario, Canada, and is responsible for the personal information it holds. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it.

Privacy questions, access requests and complaints all go to the same place: info@viaottawa.ca, or the contact form. A person reads it.

We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the privacy law of the province you are in, where that applies.

When you simply read the site

Our server and the network in front of it record the ordinary details of a request: the address your request came from, the page asked for, the time, the referring page, and your browser and device as your browser reports them. These are held for a short time so the site works, so it can be kept up, and so abuse can be blocked. Your address is also used to apply rate limits, which means it sits briefly in a counter and then expires.

We use one analytics product from someone else, Microsoft Clarity, described under how pages are used. No Google Analytics, no advertising or attribution network, no pixels, no fingerprinting, and nothing that follows you off this site. We also keep our own counts, described below.

When you hold an account

Your email address, your name if you give one, your password stored as a hash we cannot reverse, whether the address has been verified, and a record of each sign-in session, including the address it was created from and the browser reported. You sign in with an email address and a password; we use no other sign-in provider.

When you add or claim a business

The details of the business: name, address, phone number, website, hours, description, logo, and anything else the form asks for. This is business information, but it can also identify a person — a sole trader working from home, for example. Business information in the directory deals with that.

With a new business we also keep the email address it was sent from, which becomes the account that holds the listing, and the internet address the form was sent from, so abuse can be traced. Every new listing, every edit and every logo is checked by an AI model before it appears (see who else sees your information). A claim keeps what you told us to support it.

If you serve customers where they are, or run the business from your home, you can hide the street address from your dashboard. The page then shows only the neighbourhood, and no list, map or search shows the street, the postal code or a pin. We keep the address privately, to place the listing in its neighbourhood.

When you write to us

Your name, email address, phone number if you give one, the business you mention, and what you wrote. Messages to our team are kept so we can answer them and so we have a record of what was agreed.

When you use the assistant

Set out in full under the assistant.

When you pay for a plan

Payment is handled by Whop, on Whop's own checkout page, and paying means using a Whop account. We receive a record of the transaction: your name and email address, the country, province and city Whop has for you, the plan, the amount, the currency, the status, the period it covers and Whop's identifiers. When you start the checkout, our site tells Whop which listing and which account the plan is for, so the payment comes back to the right listing. Your card number never reaches us and we never store it.

Counts across the site

We count, in daily totals, which pages are read; which website sent a visit (its name only, never the page you were on); the three campaign labels a link can carry (utm_source, utm_medium and utm_campaign); the country our network reports; whether the screen is phone, tablet or desktop size; which of our buttons and outgoing links are used; where our forms go wrong; and how many different visitors came each day. We also count how often a listing page was viewed, and how often its call, directions and website buttons were used, so an owner can see whether their listing is doing anything.

None of this uses a cookie or stores anything in your browser. So that one person is not counted twice, your address and browser details are turned into a coded value that cannot be turned back and that changes every day; it is kept for an hour at most, and the address itself is never stored. The daily count of visitors keeps only a statistical summary from which no value can be read back. The totals are not tied to you, and they cannot be used to reconstruct who did what.

On the public pages of viaottawa.ca — articles, the directory, listing pages and our forms — we use Microsoft Clarity to see how a page is used: where people click or tap, how far they scroll, and where a form makes them hesitate. It shows us this as heatmaps and as replays of a single page view.

Clarity sees no words on the page. Every piece of text on it, and anything typed into a form or into the assistant, is hidden in your browser before anything is sent, so a replay shows the shape of the page and the pointer, not what the page or you wrote. What it does receive is the page's address and title, which are public. It sets no cookie and keeps nothing in your browser: each page view gets a new random identifier, so one visit is never linked to another, and we attach nothing about you or your account to it.

It never runs on the sign-in pages, your dashboard, the admin, or the link that confirms a claim. It does not run at all if your browser sends Global Privacy Control or Do Not Track, and an ad or tracker blocker usually stops it too.

For each page view Microsoft receives the address and browser details of the request, as any service a page loads from does, and the masked description of the page with the clicks, taps and scrolling. We load Clarity in a way that does not let Microsoft set its cookies; if your browser already holds cookies for Microsoft's Clarity service from another website, it sends them with these requests, as it would to any site that set them. Clarity is run by Microsoft in the United States, and what Microsoft does with what it receives is governed by its privacy statement. You can turn it off in this browser here; the choice is kept in your browser as vo_clarity_off.

We use personal information for these purposes and no others:

• to show the directory and the guides, and to make search and the assistant work;
• to run accounts: verifying an address, signing you in, letting you claim and edit a listing, and telling you when something happens to one;
• to take payment for a plan, send renewal reminders, and keep our records straight;
• to answer your messages, and to keep a record of what we answered;
• to keep the site up and safe: rate limits, bot checks, blocking abuse, investigating a problem, and keeping backups;
• to review the quality of the assistant's answers and improve them (see the assistant);
• to screen new listings, edits and logos before they appear, and to notify our team of them;
• to meet a legal obligation, or to establish or defend a legal claim.

Where the law requires your consent, using the site and giving us the information is that consent, and you can withdraw it (see your rights). Withdrawing it may mean we can no longer keep your account or your listing.

We do not sell personal information, and we do not use it to profile you or to target advertising.

Most of the directory describes businesses, not people: a name, a street address, a phone number, opening hours. Under PIPEDA, the name, title, business address and business phone number of someone acting in a business capacity are business contact information, and the Act's consent rules work differently for it. Much of what we publish also comes from public datasets that are licensed for exactly this kind of reuse, and the terms list them.

We know the line is not always clean. A business run from a home has a home address on it. A sole trader's business name is their own name.

So the rule is simple: ask, and we act. If a listing carries something about you that you do not want published — an address, a number, a name, a photograph — tell us which page and what to take off, and we will change or remove it. It costs nothing, you do not need an account, and you do not have to explain why. Where the detail came from a public dataset, we will also tell you where it came from, because removing it here does not remove it from the source. If you hold the listing, you can also hide its street address yourself from your dashboard, at any time.

Our assistant, on the Ask page and behind the Ask button, answers questions about places, businesses and neighbourhoods in Ottawa. When you use it, we keep:

• your questions and its answers, including any address or place you type, what it searched for, and which listings and articles it showed you;
• a random identifier in a cookie named vo_ask, sent only to the assistant, so a conversation can continue;
• a code made from your internet address with a secret key we hold, so requests from one network can be recognized. The address itself is not stored;
• your account, if you are signed in, and the browser your request reported.

We use this to answer you, to review and improve the quality of answers, and to prevent abuse, which can include blocking a browser or network that misuses the assistant. Our administrators can read these conversations.

To keep automated traffic out, the first question of a conversation passes a Cloudflare Turnstile check, the same one our forms use. Cloudflare may process information about your browser and connection to do this.

To write an answer, your question and the directory information relevant to it are sent to our model provider, AI Box, a service based in Vietnam. If you type an address or a place, it is also sent to the City of Ottawa's address finder, to place it on the map. Please do not type sensitive personal information into the assistant — health details, identification numbers, financial details or anyone else's private information.

Conversations are deleted automatically twelve months after their last message. To ask for earlier deletion, write to us.

This site sets a small number of cookies, all of them doing a job you asked for: keeping you signed in, showing the right thing in the header when you are, remembering that a conversation with the assistant is yours, and passing the bot check on our forms. There are no advertising cookies and no analytics cookies, which is why you are not being asked to dismiss a consent banner.

Each one is listed, with what it is for and how long it lasts, on the cookies page.

We share personal information only with the services that make the site run, only as much as each one needs, and only so it can do its job for us. They are:

Cloudflare

Sits in front of the site and serves it, runs the Turnstile bot check on our forms and on the assistant, and stores the images we publish and the nightly copies of our database, each kept for thirty days. It processes the address and connection details of every request.

Whop

Takes payments, and runs the account where you manage or cancel a plan. Your card details go to Whop, not to us. What Whop itself collects is governed by its own privacy policy.

AI Box

Our AI model provider, based in Vietnam. Receives the questions put to the assistant and the directory information relevant to them; the text of every new listing and every edit, and every uploaded logo, so they can be screened before they appear; and the text of listings and articles, so search can find them by meaning.

Resend

Delivers the messages described under email we send you. Receives your address and the content of the message.

Discord

Notifies our team that something arrived: a new business or an edit (its name and page), a payment (the business, the plan and the amount), or a message (the sender's name where given, the business, the subject and the first lines). It is not sent the email address or phone number you give us, and the full message stays with us.

The City of Ottawa

Its public address finder turns an address into a point on the map: an address typed into the assistant, and the address of a business being added or edited.

OpenFreeMap

Serves the map tiles on a listing page. Because your browser fetches the tiles directly, your address reaches them when a map loads. The map loads only when you scroll it into view.

Esri

Serves the satellite photographs on a listing page's map: the small preview on its Satellite button, and the full view when you press it. Your browser fetches them directly when the map loads, so your address reaches them.

Microsoft Clarity

Shows us how our public pages are used, as described under how pages are used. Your browser sends it the address and browser details of each request, the page's address and title, and a description of the page with every word on it hidden; we set no cookie for it, and no account or name goes with it.

Oracle Cloud

Rents us the server that runs the site and holds its database.

We will also disclose information:

• when the law requires it, or in response to a lawful request from an authority with the right to make one — and we check that the request is valid before we answer it;
• to establish, exercise or defend a legal claim, or to protect the safety and rights of people who use the site;
• if the site is ever sold or merged, to the buyer, who would take on this policy — and we would say so on this page before it happened.

That is the whole list. We do not sell, rent or trade personal information.

We use service providers that operate internationally, so some of what you give us is processed outside Canada:

• the questions you put to the assistant, and the text and logos of listings being screened, go to AI Box, in Vietnam;
• a payment goes through Whop, which is based in the United States;
• our email goes through Resend, and our team's notifications through Discord, both based in the United States;
• the masked record of how a public page is used goes to Microsoft Clarity, in the United States;
• Cloudflare's network handles requests around the world, and the server Oracle Cloud rents us may be outside Canada.

While information is in another country it may be accessible to the courts and authorities of that country under its own laws. If that concerns you, do not use the assistant — the rest of the site works without it — and turn Clarity off under how pages are used.

Assistant conversations

Twelve months after the last message, then deleted automatically.

Your account

Until you ask us to close it. A sign-in session stops working after thirty days; its record, with the address it was created from, is kept with the account.

Listings and the changes made to them

For as long as the listing is published, plus a record of who changed what, which we keep so an ownership question can be settled later.

What you sent to add or claim a business

The form as sent, the email address and the internet address it came from, and the outcome, kept with the listing as the record of how it was added or claimed, until you ask us to delete them.

Messages you send us

While we deal with them, and afterwards as a record of what was agreed, until you ask us to delete them.

Payment records

As long as tax and accounting law requires us to keep them, which is currently six years.

Request logs

A short period, for keeping the site up and investigating abuse.

Deleted information can survive for up to thirty days in our encrypted nightly backups, which are deleted after that. We do not restore a backup to bring back something you asked us to remove.

Traffic to the site is encrypted in transit. Passwords are stored as hashes we cannot reverse. Card details never reach our servers. The internet address behind an assistant conversation is stored only as a code made with a secret key. Administrative screens are behind an account with a separate role, and changes to a listing are recorded against the person who made them.

No service can promise perfect security, and we do not. If a breach ever creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, as the law requires.

You can ask us to:

• tell you what we hold about you, where it came from and who we have shared it with;
• correct anything that is wrong or out of date;
• delete your account, a listing, a message or an assistant conversation;
• withdraw your consent to our using it, subject to what the law or a contract requires us to keep;
• give you a copy of what you gave us, in a form you can read.

Write to info@viaottawa.ca. Tell us what you want and enough for us to find it — the page, the email address on the account, or the business. There is no fee. We answer within thirty days, and if we need longer we tell you why. We may have to confirm who you are first, and we will ask for the least we can get away with.

If we refuse a request we will tell you why in writing, and what you can do about it.

If you are not satisfied

Come back to us first — most of it is a misunderstanding we can clear up. If that does not settle it, you can complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator of your own province. We will not treat you any differently for having complained.

Every email we send answers something you did: verifying an address, a claim on a listing, a listing going live, a reply from our team, a password reset, a sign-in notice, a reminder that a yearly plan renews in a fortnight, or a notice about a change to a plan you hold. Receipts for payments come from Whop.

There is no newsletter, no mailing list and no marketing program, so there is nothing to unsubscribe from. If we ever start one it will be something you opt into, it will say who it is from, and every message will carry a working unsubscribe link — as Canada's anti-spam legislation requires.

You can stop the rest by closing your account, though it will also stop us being able to tell you about your own listing.

This site is for adults running or looking for businesses, and is not directed at children. We do not knowingly collect personal information from a child under 13. If you believe a child has given us information, write to us and we will delete it.

We update this page when what we do changes. The date at the top is the date the wording last changed. If a change materially affects how we handle information we already hold about you, we will tell account holders by email before it takes effect, and we will say what changed rather than leaving you to compare two versions.