Privacy Policy

1. Who we are

Experts.ca is a Canadian business directory operated from Montreal, Quebec. This policy explains what personal information we collect when you use the site, why we collect it, which companies process it for us, and what you can do about it.

The person responsible for the protection of personal information at Experts.ca is the Founder, responsible for the protection of personal information. You can reach them at hello@experts.ca.

2. What we collect, and why

• Business applications and waitlist requests. When you apply to list a business or join a waitlist, we collect what you enter in the form: the business name, a contact name, email address, phone number, website, category, location, and your message or description. We use it to review the request and reply to you.
• Quote requests made from a listing. A quote request can only be passed on by email, so the request form appears only on listings whose business has given us an email address, and only while our email provider is set up. On other listings we show the business's phone number or website instead and ask you for nothing; a request sent to such a listing is refused and nothing you entered is kept. When you do send a request, we collect your name, email address, phone number and the description of your project, and we record your IP address and browser type to detect spam and abuse. We email the request, with your contact details, to the business so it can answer you; we keep a copy that our team can see in our administration tools, and a copy goes to our own notification mailbox. We tell you whether our email provider accepted the message. We cannot confirm that the business received or read it. At the time of writing, no listing has given us an address, so the form is not shown anywhere and every listing offers its phone number or website instead.
• Searches. When search is available and you use it, we keep the words you typed, the time, the service and city we understood from them, and which results were shown, so we can improve results. To understand a search, its text is sent to an artificial-intelligence service (see section 4). Please do not type personal details into the search box.
• Location. To show businesses near you, we estimate your city from your IP address when you arrive. We do not store the IP address for this. If you choose “use my location”, your browser asks for your permission and, if you agree, your coordinates are used to find your city and are saved, with that city, in a cookie on your own device for up to 30 days. The city we estimate from your IP address is kept in a cookie on your device for one day. You can pick a city by hand instead, or clear your location at any time.
• Analytics, only with your permission. See section 3.
• Technical records. Our hosting provider keeps standard server logs. When a page is not found, we record the address requested, the browser type and the referring page so we can fix broken links. To limit abuse of our forms and search, we briefly count requests per IP address.
• Accounts. Sign-in on the site is for our own staff, and is handled by our sign-in provider, Clerk. Clerk's script loads on every page, including for visitors who never sign in, and may set the cookies it needs for security.
• Business listings. Listings are about businesses and are gathered from public sources and from the businesses themselves. For a business run by one person or from a home, a listing can include details that also identify that person, such as a name, a phone number or an address. If a listing shows information about you that is wrong or that you want removed, write to us at the address in section 11.

3. Analytics and your choice

The first time you visit, we ask whether you accept analytics. Nothing in this section runs, and nothing in it is stored, unless you accept. If you decline or make no choice, it stays off. You can change your mind at any time from the Cookie Policy page or the “Cookie preferences” link at the bottom of every page.

If you accept, two things happen:

• Third-party analytics tools load in your browser: Google Analytics, Vercel Analytics, Vercel Speed Insights, Ahrefs Web Analytics. They receive information about your visit, such as the pages you view, the site you came from, your browser and device type, and your approximate location, and some of them set their own cookies. Each provider handles that information under its own privacy policy.
• We record our own listing statistics. When a listing is shown to you or you click its phone number, website or directions, we record which listing it was, the page and position it appeared in, a random session identifier kept in a cookie for one day, your browser type, the referring page and any campaign tags in the link. We do not store your IP address in these records. Depending on how the site is configured, we may store a hashed form of it, computed with a secret value that changes every day. A hash is not the address itself, but it is still derived from it, so we treat it as personal information.

If you later withdraw your permission, the analytics tools stop loading, our session cookie and the analytics cookies we can reach are removed, and no further statistics are recorded for your visits.

4. Who processes information for us

We do not sell personal information. We share it only with a business you ask us to contact, as described in section 2, and with the companies that run parts of the site for us:

• Vercel hosts the site and, with your permission, provides Vercel Analytics and Speed Insights.
• Neon hosts our database.
• Clerk handles staff sign-in.
• Postmark delivers the emails that carry your requests to us and, where the business has given us an email address, to the business you chose.
• Google (Google Analytics) and Ahrefs (Ahrefs Web Analytics), with your permission only.
• OpenAI, and Anthropic as a backup, interpret the text of searches that our own rules cannot read; they receive only the words of the search.
• BigDataCloud turns coordinates or an IP address into a city name when the location features need it.
• Algolia runs a backup search index that may receive the text of a search.
• Upstash holds the short-lived request counts we use to limit abuse.
• Stripe processes payments for businesses that buy a paid listing. Card details are entered on Stripe's own pages, not on ours.

This list comes from our own code, which shows which companies receive information and what they receive. We have not yet confirmed the settings on our accounts with each of them, such as how long each one keeps information and whether it may use it for its own purposes. Section 5 says which locations we have confirmed and which we have not. We will update this policy as we confirm more.

5. Where information is kept

We have confirmed where two things are. Our database, hosted by Neon, and the servers that run the site, hosted by Vercel, are in the United States. Personal information you give us is therefore stored and processed outside Quebec and outside Canada, where it is subject to the laws of the United States.

For the other companies named in section 4, we have not yet confirmed in which country or countries each one stores and processes information. Until we have, please assume that information they handle for us may also be processed outside Canada.

6. How long we keep it

• Applications, waitlist requests and quote requests are kept for as long as we need them to handle the request and to operate the directory. You can ask us to delete them (see section 8).
• Your analytics choice is remembered for 180 days, after which we ask again. Our analytics session cookie lasts one day.
• A location you choose is remembered on your device for up to 30 days, and a language choice for up to one year.

7. How we protect it

The email address and phone number you submit in a form are encrypted in our database using AES-256-GCM; your name and message are stored as you wrote them. The site is served over an encrypted connection (TLS). Access to administrative tools requires sign-in with multi-factor authentication.

8. Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector, you may ask us what personal information we hold about you, ask us to correct or delete it, and withdraw a consent you gave. Write to the person responsible named in section 1 at hello@experts.ca. We will answer your request as the law requires; in some cases the law allows or obliges us to keep certain records, and we will tell you if that applies. If you are not satisfied with our answer, you may complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

9. Cookies

We use a small number of essential and preference cookies, and analytics cookies only with your permission. See our Cookie Policy for details and to change your choice.

10. Changes

When we materially change this policy, we will update the date at the top of the page and, where appropriate, notify users via email or an on-site notice.

11. Contact

Questions or requests: hello@experts.ca (Founder, responsible for the protection of personal information).