Privacy Policy

1. Who we are and who this applies to

Hispanic Canadian Heritage Council, based in Toronto, operates Latin Eats, a guide to Latin businesses, events and community in Canada, available as an iPhone app (Android coming soon) and as a website at latineats.ca. We are responsible for the personal information we handle and have designated a person accountable for personal information protection (see “Contact”).

This policy applies to website visitors, people with an account, people who post in Community and Forum, people who submit requests or reports, and people who claim or manage a business on Latin Eats.

The laws we use as a reference are the federal Personal Information Protection and Electronic Documents Act (PIPEDA); Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25; the private-sector Personal Information Protection Acts (PIPA) of Alberta and British Columbia; and Canada’s Anti-Spam Legislation (CASL). In Ontario and the other provinces and territories without their own private-sector law, the federal law applies.

2. The short version

• We do not sell your information or share it for advertising.
• We use no third-party advertising or analytics, and we do not track your activity across other apps or websites.
• Your location, if you allow it, is used on your device to show what is nearby; we do not send it to or store it on our servers.
• Your password is never stored in plain text, only an irreversible hash.
• You can delete your account and what you posted from the app or the website at any time.
• What you post in Community and Forum is visible to other people with an account; think before sharing personal details.

3. What information we collect

We collect only what we need to provide the service. Depending on how you use it, we handle the following:

We do not collect financial or health data, your contact list, your private messages, your advertising identifier or biometric data. If this changes, we will update this policy and, where the law requires, ask for your consent first.

4. How we use your information and on what basis

• Provide the service: show the guide, map, listings, events and community, and manage your account.
• Verify business claims and let a verified owner manage their listing.
• Moderate content and handle abuse and error reports.
• Protect the service: prevent fraud, abuse and unauthorized access, and limit how often some actions can be performed.
• Send you transactional emails (verification codes, security notices and changes to your account).
• Meet legal obligations and respond to requests from competent authorities.

We ask for your clear and free consent for anything that is not obvious or necessary for the service (for example, access to your location, which your device asks about at the time). By creating an account, posting content or submitting a request, you authorize us to handle that information for the purposes described here. You can withdraw your consent at any time, with the consequences that has for the service (for example, you will not be able to post without an account).

We do not make decisions that significantly affect you based exclusively on automated processing.

5. Who we share your information with

We do not sell personal information. We share it only with service providers who can use it solely to serve us, and in the situations described below.

• Public content: what you post in Community and Forum is seen by other people with an account, under the name you post with. Photos, videos and business listing data are public.
• External links: if you tap “Open in maps”, a business website or a delivery link, you leave Latin Eats and that third party’s policy applies.
• Legal obligation: we may disclose information if required by law, a court order or a competent authority, or to protect rights and safety or prevent fraud.
• Change of ownership: if Latin Eats merges or is transferred, information will be transferred under this same policy and we will let you know.

6. Where your information is processed

Our providers run infrastructure in several countries, including Canada, the United States and the European Union, so your information may be stored or processed outside your province or Canada. In that case it is subject to the laws of those countries, which may allow their authorities to access it. We require our providers to apply reasonable contractual and technical safeguards, and for Quebec residents we assess privacy factors before communicating information outside Quebec, as the law requires.

7. How long we keep your information

We keep information only as long as it is needed for the purposes described or required by law:

After deletion, our providers’ backups may keep information for a limited time before being overwritten. We may keep what is strictly necessary where the law requires it or to resolve disputes or prevent abuse.

8. Your rights and how to exercise them

Depending on the applicable law, you can:

• Access the personal information we hold about you and learn how we use it and who we share it with.
• Ask us to correct inaccurate or incomplete information.
• Withdraw your consent and ask us to stop using or to delete your information, unless the law requires us to keep it.
• If you live in Quebec: receive your personal information in a structured, commonly used technological format (portability), ask us to stop disseminating it or to de-index a link that harms you, and be informed of automated processing, if any.
• File a complaint with the relevant privacy authority.

To exercise these rights, write to the address in “Contact”. We may ask you to confirm your identity before giving you or changing information, to protect your account. We reply within 30 days at most; if we need more time, we will tell you and explain why. We normally do not charge for this.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), Quebec’s Commission d’accès à l’information (cai.gouv.qc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or that of British Columbia (oipc.bc.ca).

9. How to delete your account and data

• In the app: My account → “Delete my account”.
• On the web: sign in at latineats.ca/cuenta and choose “Delete my account”.
• If you cannot sign in, write to us from your account email at the “Contact” address and we will delete it after confirming your identity.

When you delete your account we erase your profile, email, password, sessions, business claims and their documents, logged prices, and everything you posted in Community and Forum (posts, comments, likes, questions and replies), including your photos and videos on the CDN. If you signed in with Apple, we also revoke access. Saved places that exist only on your device stay there: remove them by uninstalling the app. Other people’s comments or likes on your posts are deleted along with them.

Requests and reports you sent about a business are not deleted with the account because they are not tied to it; you can ask for their deletion by email.

10. How we protect your information

• All traffic is encrypted (HTTPS).
• Passwords are stored only as an irreversible hash (Argon2id with a secret key), and passwords found in known breaches are rejected.
• Session tokens are stored only as hashes; refresh tokens rotate on every use and are invalidated if reused.
• We rate-limit sign-in attempts and email sending.
• Claim documents are visible only to a team member with administration access, are never displayed online and are downloaded as forced attachments.
• The mailbox is read only by administrators with verified access; messages are shown only as text, with no remote images or code.
• We review and sanitize what you write before displaying it, to prevent malicious code.

No system is perfectly secure. If an incident involves a real risk of significant harm, we will notify the authorities and the people affected as the law requires (in Quebec, a “confidentiality incident”), and we keep a record of incidents.

11. Children

Latin Eats is not directed at children under 13 and we do not knowingly collect their information. If you live in Quebec, consent from the person with parental authority is required for children under 14. If you believe a child gave us information, write to us and we will delete it.

12. Cookies and local storage

The website does not use advertising or third-party analytics cookies. It uses your browser’s local storage to keep you signed in, which is necessary for the account to work; it is cleared when you sign out. Our infrastructure providers may use technical security and performance technologies. You can clear the site’s storage from your browser settings.

13. Email (CASL)

We only send transactional emails: verification codes, security notices and changes to your account or a claim. We do not send marketing emails. If we ever did, it would be only with your express consent, clearly identifying us and with a simple way to unsubscribe, as Canada’s anti-spam law requires.

14. Information for the Apple App Store and Google Play

Summary of the app’s data, for the stores’ privacy labels (all of it is collected for app functionality, is not used to track you, is not sold and can be deleted with the account):

• Contact info: name (optional), email address and phone number (only if you enter it in a claim or request).
• Identifiers: the account’s user ID.
• User content: photos or videos, reviews, posts, comments, forum questions, logged prices and claim documents.
• Usage: technical connection data and an IP hash for security.
• Location: processed only on the device and not collected.
• We do not use the advertising identifier and do not track across apps or websites.
• Data deletion: in the app and on the web (latineats.ca/cuenta), as explained in section 9.

15. Changes to this policy

We may update this policy. We will publish the current version on this page with its update date and, if the change is significant (for example, new uses of your information), we will notify you in the app or by email and, where the law requires, ask for your consent again.

16. Contact