Privacy Policy · Stallkeeper

Stallkeeper runs the technology behind makers' markets like Krampus Market. For a market's vendors, ticket buyers and site visitors, **the market organizer is the one deciding what's collected and why (the "controller" under Canadian privacy law), and Stallkeeper is the technology provider that stores and processes it on the organizer's behalf (the "processor")**. This policy covers the Stallkeeper platform itself -- see our Terms of Service for that controller/processor split in full, and our Organizer Privacy Template for a starting point organizers can adapt and publish on their own market site. ## What we collect, and why - **Vendor applications:** business name, contact email, contact phone, and up to six photos, so a market's jury can review your application and the organizer can reach you about it. - **Marketing consent (CASL):** a separate, explicit opt-in before we or a market email you about your application status or next season's applications. You can unsubscribe at any time, and every such email identifies the sending market and carries an unsubscribe link, as Canada's anti-spam law (CASL) requires. - **Ticket purchases:** the buyer's name and email, and each ticket holder's name and email, so we can issue, verify and (if needed) refund tickets, and so door staff can check you in. You'll see this same notice again, in short form, at the ticket checkout itself. - **Event-day check-in:** a market's door staff use a roster of confirmed vendors' names on their own phone or tablet to check vendors in. That roster (and any check-ins recorded while offline) is wiped from the device automatically within 48 hours of being downloaded, or 48 hours after the event ends -- whichever check-in staff's device sees first -- so a lost or forgotten device doesn't hold vendor names indefinitely. - **Vendor feedback:** your answers to a market's own post-season questions, including whether you're comfortable being quoted publicly -- which we only use if you say yes. - **Scam reports:** if you report a suspicious message, we keep the sender, a short excerpt and (if you give it) your contact email, so our staff can investigate. This is staff-only information; it never appears in any audit trail a market organizer can read. - **Site visitor counts:** we count visits to a market's public site without cookies and without storing your IP address or browser identity. We compute a one-way, irreversible fingerprint from your IP and browser string, mixed with a secret value that changes every day and is discarded after about 48 hours -- there is no way to connect two days' visits to the same person, and no raw IP address is ever stored. ## Cookies and sign-in Our market sites (each market's own public pages) and our marketing site (stallkeeper.ca) set **no cookies at all** and run with no client-side tracking script. The only place Stallkeeper ever sets a cookie is the organizer/vendor sign-in app (`app.stallkeeper.ca`), where a single session cookie keeps you signed in -- it's set to HttpOnly, Secure and SameSite=Lax, so it can't be read by page scripts and isn't sent to other sites. Signing in always happens through that app; there's no sign-in on a market's public site. ## Who processes information on our behalf - **Cloudflare** -- hosting, our edge network, bot/abuse protection (Turnstile on report, ticket and verify forms), temporary key-value storage, and our visitor-count engine (Analytics Engine). - **Supabase** -- our database and sign-in system, hosted in Canada (`ca-central-1`). - **Stripe** -- payment processing for booth fees, ticket sales and our own subscription (PCI-DSS Level 1 certified). Booth-fee and ticket money is held in your market's account until the organizer chooses to release it to their bank -- Stallkeeper doesn't push payouts out automatically, so an organizer always controls the timing of their own payout. - **Sentry** -- error tracking, hosted in the EU (Frankfurt). Before anything leaves our servers, an allowlist (not a blocklist) rebuilds each error report field-by-field: only a safe, named set of headers survives, request/response bodies, cookies and query strings are always stripped, and your identity is reduced to an opaque internal id with no IP address attached. - **Our email provider** -- either Cloudflare's own email sending service, or Resend (a US-based email provider), depending on how a given market's email is configured. A local/test-only mail catcher (Mailpit) is refused outright unless its address is on your own machine, so it can never see real mail. - **Anthropic** -- only when Stallkeeper's own staff draft or adjust a market's starting website content, through a staff-run tool that never runs automatically and is never triggered by a visitor's request. We send only the organizer-supplied facts, captions and must-say/avoid notes for that market -- never vendor applications, ticket data, scam reports or (as of this writing) photos -- and a Stallkeeper staff member, then the organizer, reviews every draft before anything goes live. The AI never publishes directly. ## Cross-border and cross-provincial transfers Because Stallkeeper's processors are located in more than one place, your information may be processed outside the province (or country) where you are. Supabase's database is in Canada; Sentry's is in the EU; Stripe, Resend, Anthropic and parts of Cloudflare's global network operate in the United States or other countries. We've assessed this cross-border processing in an internal Privacy Impact Assessment (see `docs/legal/law25-pia.md` in our source repository, prepared with Quebec's Law 25 section 17 in mind) and keep it current as our processors change. ## How long we keep things - Site-visitor fingerprints: at most ~48 hours, then unrecoverable (the day's secret value is discarded). - Event-day check-in rosters and offline check-in queues on a helper's device: at most 48 hours from download, or 48 hours past the event's end, whichever comes first. - Raw visit counts live in Cloudflare's analytics engine for up to 3 months; the daily totals we keep ourselves (pageviews, visitor counts, outbound-link clicks -- never a per-visit record) are kept indefinitely. - Everything else (applications, tickets, feedback, scam reports) is kept for as long as the market that collected it is active, plus a reasonable period for recordkeeping, refunds, tax and dispute resolution. ## Your rights, and how to use them Under PIPEDA and BC's Personal Information Protection Act, you can ask to see the personal information we (or, for a market's own vendor/ticket/visitor data, the organizer) hold about you, ask us to correct it, or ask us to delete it, subject to legal and legitimate business limits (for example, financial records we're required to keep, or an active dispute). Email us at the address below to make a request or to raise a concern about how we've handled your information; we'll respond within a reasonable time and, if we can't act on a request, we'll tell you why. ## If something goes wrong If we discover a breach of security safeguards involving your personal information that creates a real risk of significant harm, we'll notify you and the applicable privacy regulator (the Office of the Privacy Commissioner of Canada, BC's Office of the Information and Privacy Commissioner, or Quebec's Commission d'accès à l'information, depending on where you are) without unreasonable delay. ## Children Stallkeeper is built for market organizers, vendors and the general public buying tickets or browsing a market's site -- it isn't directed at children, and we don't knowingly collect personal information from anyone under 13. If you believe a child has given us information, contact us and we'll delete it. ## Changes to this policy When we change this policy in a way that matters, we'll bump the version number at the top of this page and update the "last reviewed" date below; the previous version stays available on request. ## Contact / Privacy Officer **Andrew Appleby**, Stallkeeper's Privacy Officer -- email **privacy@stallkeeper.ca**. **[PLACEHOLDER]** confirm this inbox exists and is monitored before this page goes live for anyone outside Krampus Market. ## Governing law This policy, and Stallkeeper's handling of personal information under it, is governed by the laws of British Columbia, Canada, and the federal laws of Canada that apply within it. This page describes how Stallkeeper is built to work today. Andrew reviewed it with AI assistance on 2026-10-08, benchmarked against several comparable products' published policies and against PIPEDA, BC PIPA, Quebec Law 25 and CASL guidance -- it has not been reviewed by a lawyer, and nothing here is legal advice. If anything here conflicts with how the product actually behaves, the product's behaviour is what governs, and we'll correct this page.

Stallkeeper Privacy Policy