Privacy policy

No third-party analytics, no advertising network, no tracking pixels.

There is no Google Analytics on this site, no ad network, and nothing that follows you to another site. We count visits ourselves, in totals, without cookies.

We never sell your personal information.

Not to anyone, for any price. We do not rent or trade mailing lists either.

We email you about things you did.

Verifying an address, a claim, a receipt, a renewal reminder, a reply. There is no newsletter and no marketing list.

Most of the directory is business information, not personal information.

If a listing carries something personal about you, tell us and we will change or remove it.

You can ask what we hold, correct it, or have it deleted.

One email does it, and it is free. Section 11 says how.

This summary is a guide to the page, not a substitute for it. The numbered sections are the policy.

Via Ottawa operates viaottawa.ca from Ottawa, Ontario, Canada, and is responsible for the personal information it holds. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it.

Privacy questions, access requests and complaints all go to the same place: info@viaottawa.ca, or the contact form. A person reads it.

We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the privacy law of the province you are in, where that applies.

When you simply read the site

Our server and the network in front of it record the ordinary details of a request: the address your request came from, the page asked for, the time, the referring page, and your browser and device as your browser reports them. These are held for a short time so the site works, so it can be kept up, and so abuse can be blocked. Your address is also used to apply rate limits, which means it sits briefly in a counter and then expires.

We use no third-party analytics product: no Google Analytics, no advertising or attribution network, no pixels, no fingerprinting, and nothing that follows you off this site. We keep our own counts, described below.

When you hold an account

Your email address, your name if you give one, your password stored as a hash we cannot reverse, whether the address has been verified, and a record of each sign-in session, including the address it was created from and the browser reported. If you sign in through another provider, we keep the identifier that provider gives us — not your password there.

When you add or claim a business

The details of the business: name, address, phone number, website, hours, description, logo and photographs, and anything else the form asks for. This is business information, but it can also identify a person — a sole trader working from home, for example. Section 5 deals with that.

When you write to us

Your name, email address, phone number if you give one, the business you mention, and what you wrote. Messages to our team are kept so we can answer them and so we have a record of what was agreed.

When you use the assistant

Set out in full in section 6.

When you pay for a plan

Payment is handled by Stripe. We receive a record of the transaction — the plan, the amount, the currency, the status, the period it covers and Stripe's identifiers. Your card number never reaches us and we never store it.

Counts across the site

We count, in daily totals, which pages are read; which website sent a visit (its name only, never the page you were on); the three campaign labels a link can carry (utm_source, utm_medium and utm_campaign); the country our network reports; whether the screen is phone, tablet or desktop size; which of our buttons and outgoing links are used; where our forms go wrong; and how many different visitors came each day. We also count how often a listing page was viewed, and how often its call, directions and website buttons were used, so an owner can see whether their listing is doing anything.

None of this uses a cookie or stores anything in your browser. So that one person is not counted twice, your address and browser details are turned into a coded value that cannot be turned back and that changes every day; it is kept for an hour at most, and the address itself is never stored. The daily count of visitors keeps only a statistical summary from which no value can be read back. The totals are not tied to you, and they cannot be used to reconstruct who did what.

We use personal information for these purposes and no others:

• to show the directory and the guides, and to make search and the assistant work;
• to run accounts: verifying an address, signing you in, letting you claim and edit a listing, and telling you when something happens to one;
• to take payment for a plan, send receipts and reminders, and keep our records straight;
• to answer your messages, and to keep a record of what we answered;
• to keep the site up and safe: rate limits, bot checks, blocking abuse, investigating a problem, and keeping backups;
• to review the quality of the assistant's answers and improve them — see section 6;
• to meet a legal obligation, or to establish or defend a legal claim.

Where the law requires your consent, using the site and giving us the information is that consent, and you can withdraw it — see section 11. Withdrawing it may mean we can no longer keep your account or your listing.

We do not sell personal information, and we do not use it to profile you or to target advertising.

Most of the directory describes businesses, not people: a name, a street address, a phone number, opening hours. Under PIPEDA, the name, title, business address and business phone number of someone acting in a business capacity are business contact information, and the Act's consent rules work differently for it. Much of what we publish also comes from public datasets that are licensed for exactly this kind of reuse — section 4 of the terms lists them.

We know the line is not always clean. A business run from a home has a home address on it. A sole trader's business name is their own name.

So the rule is simple: ask, and we act. If a listing carries something about you that you do not want published — an address, a number, a name, a photograph — tell us which page and what to take off, and we will change or remove it. It costs nothing, you do not need an account, and you do not have to explain why. Where the detail came from a public dataset, we will also tell you where it came from, because removing it here does not remove it from the source.

Our assistant, on the Ask page and behind the Ask button, answers questions about places, businesses and neighbourhoods in Ottawa. When you use it, we keep:

• your questions and its answers, including any address or place you type, what it searched for, and which listings and articles it showed you;
• a random identifier in a cookie named vo_ask, sent only to the assistant, so a conversation can continue;
• a one-way hash of your address. The address itself is not stored;
• your account, if you are signed in, and the browser your request reported.

We use this to answer you, to review and improve the quality of answers, and to prevent abuse, which can include blocking a browser or network that misuses the assistant. Our administrators can read these conversations.

To keep automated traffic out, the first question of a conversation passes a Cloudflare Turnstile check, the same one our forms use. Cloudflare may process information about your browser and connection to do this.

To write an answer, your question and the directory information relevant to it are sent to our model provider, AI Box, which may process them outside Canada. Please do not type sensitive personal information into the assistant — health details, identification numbers, financial details or anyone else's private information.

Conversations are deleted automatically twelve months after their last message. To ask for earlier deletion, write to us.

This site sets a small number of cookies, all of them doing a job you asked for: keeping you signed in, remembering that a conversation with the assistant is yours, and passing the bot check on our forms. There are no advertising cookies and no analytics cookies, which is why you are not being asked to dismiss a consent banner.

Each one is listed, with what it is for and how long it lasts, on the cookies page.

We share personal information only with the services that make the site run, only as much as each one needs, and only so it can do its job for us. They are:

Cloudflare

Sits in front of the site and serves it, runs the Turnstile bot check on our forms and on the assistant, and stores the images we publish. It processes the address and connection details of every request.

Stripe

Takes payments and runs the billing portal where you manage or cancel a plan. Your card details go to Stripe, not to us.

AI Box

The model provider behind the assistant. Receives your question and the directory information relevant to it.

Our email provider

Delivers the messages in section 12. Receives your address and the content of the message.

OpenFreeMap

Serves the map tiles on a listing page. Because your browser fetches the tiles directly, your address reaches them when a map loads. The map loads only when you scroll it into view.

Our hosting and database provider

Runs the servers and the database the site is stored on.

We will also disclose information:

• when the law requires it, or in response to a lawful request from an authority with the right to make one — and we check that the request is valid before we answer it;
• to establish, exercise or defend a legal claim, or to protect the safety and rights of people who use the site;
• if the site is ever sold or merged, to the buyer, who would take on this policy — and we would say so on this page before it happened.

That is the whole list. We do not sell, rent or trade personal information.

We operate from Canada, and we use service providers that operate internationally. Two things certainly cross the border: the questions you put to the assistant, which go to AI Box, and the ordinary request handling done by Cloudflare's global network. Stripe also operates internationally.

While information is in another country it may be accessible to the courts and authorities of that country under its own laws. If that concerns you, do not use the assistant — the rest of the site works without it.

Assistant conversations

Twelve months after the last message, then deleted automatically.

Your account

Until you ask us to close it. Sign-in sessions expire on their own well before that.

Listings and the changes made to them

For as long as the listing is published, plus a record of who changed what, which we keep so an ownership question can be settled later.

Messages you send us

While we deal with them, and afterwards as a record of what was agreed.

Payment records

As long as tax and accounting law requires us to keep them, which is currently six years.

Request logs

A short period, for keeping the site up and investigating abuse.

Deleted information can survive for a time in encrypted backups, which are themselves deleted on a schedule. We do not restore a backup to bring back something you asked us to remove.

Traffic to the site is encrypted in transit. Passwords are stored as hashes we cannot reverse. Card details never reach our servers. The address behind an assistant conversation is stored only as a one-way hash. Administrative screens are behind an account with a separate role, and changes to a listing are recorded against the person who made them.

No service can promise perfect security, and we do not. If a breach ever creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, as the law requires.

You can ask us to:

• tell you what we hold about you, where it came from and who we have shared it with;
• correct anything that is wrong or out of date;
• delete your account, a listing, a message or an assistant conversation;
• withdraw your consent to our using it, subject to what the law or a contract requires us to keep;
• give you a copy of what you gave us, in a form you can read.

Write to info@viaottawa.ca. Tell us what you want and enough for us to find it — the page, the email address on the account, or the business. There is no fee. We answer within thirty days, and if we need longer we tell you why. We may have to confirm who you are first, and we will ask for the least we can get away with.

If we refuse a request we will tell you why in writing, and what you can do about it.

If you are not satisfied

Come back to us first — most of it is a misunderstanding we can clear up. If that does not settle it, you can complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator of your own province. We will not treat you any differently for having complained.

Every email we send answers something you did: verifying an address, a claim on a listing, a listing going live, a reply from our team, a password reset, a sign-in notice, a receipt, or a reminder that a plan renews in a fortnight.

There is no newsletter, no mailing list and no marketing programme, so there is nothing to unsubscribe from. If we ever start one it will be something you opt into, it will say who it is from, and every message will carry a working unsubscribe link — as Canada's anti-spam legislation requires.

You can stop the rest by closing your account, though it will also stop us being able to tell you about your own listing.

This site is for adults running or looking for businesses, and is not directed at children. We do not knowingly collect personal information from a child under 13. If you believe a child has given us information, write to us and we will delete it.

We update this page when what we do changes. The date at the top is the date the wording last changed. If a change materially affects how we handle information we already hold about you, we will tell account holders by email before it takes effect, and we will say what changed rather than leaving you to compare two versions.