Privacy Policy

AssetShift Inc. ("AssetShift", "we", "us", "our") operates the AssetShift marketplace platform at assetshifts.com. We are the data controller for personal information collected through the Platform.

Contact for privacy matters: info@assetshifts.com

Account Information. Name, email address, password (stored as a one-way Argon2 hash — never readable in plaintext), account type, and optional fields: phone, business name, address, province, postal code, business registration number, website, tax number.

Identity Verification Documents. Government-issued ID and business registration documents. Used solely for verification purposes.

Listing Content. Asset description, category, condition, quantity, price, photographs, and location (postal code or city).

Direct Acquisition Submissions. All submission details, photographs, asking price, and the full content of the AI intake conversation.

Transaction and Payment Data. Transaction parties, agreed price, shipping mode, and transaction status. Payment processing is handled entirely by Stripe — we receive only a Stripe customer ID and last-four card digits. We do not store full card numbers or banking credentials.

Platform Communications. Messages sent through Platform chat are stored and may be reviewed by AssetShift staff for moderation, dispute resolution, and safety.

Usage Data. Standard server logs: IP addresses, browser type, referring pages, page navigation. Used for security monitoring, debugging, and Platform improvement.

Location Data. Seller postal codes and cities are geocoded via Google Maps API to obtain geographic coordinates. We store both exact coordinates and fuzzed (offset up to approximately 800 metres) coordinates. Only fuzzed coordinates are displayed publicly on the map.

Session Data. Session cookies maintain your login state. See the Cookie Policy for details.

We use personal information to: provide and operate the Platform; process payments and coordinate payouts via Stripe Connect; verify identity and business credentials; moderate communications and enforce Platform rules; coordinate freight and logistics; review direct acquisition submissions; send transactional communications (offer notifications, payment confirmations, dispute updates); investigate disputes, fraud, and violations; comply with legal obligations; and improve the Platform through aggregated analytics.

We do not sell your personal data to third parties. We do not use your information for targeted advertising.

We process personal information on the following bases:

• Contractual necessity: Providing services you have requested (account creation, transactions, payouts)
• Consent: Identity verification document uploads; explicit referral consent for direct acquisitions
• Legitimate interests: Security monitoring, fraud prevention, Platform improvement
• Legal obligation: Responding to lawful government requests and court orders

Between Transaction Parties. After payment is confirmed, we share the seller's exact location and contact with the buyer (and vice versa) solely to enable delivery coordination.

AssetShift Staff. Internal staff may access all Platform data for moderation, dispute resolution, and operations. All staff access is logged.

Stripe. Transaction and customer data is shared with Stripe, Inc. and Stripe Payments Canada Ltd. for payment processing and Connect payouts. Stripe's Privacy Policy governs their use.

Google Maps. Location strings (postal codes, cities) are sent to Google's Geocoding API to obtain coordinates. Google's Privacy Policy applies.

Resend (Email Service). Email content and recipient addresses are processed by Resend, Inc. to deliver transactional emails.

Uploadcare (File Storage). Photographs and documents are stored with Uploadcare. Uploadcare's Privacy Policy applies.

Referral Partners — NEVER without explicit consent. AssetShift will NEVER share your personal information or submission details with any third-party partner without your explicit, affirmative, recorded consent. In direct acquisition referrals, consent is always obtained before sharing, specifying who you consent to be referred to. You may revoke consent at any time before information is shared.

Legal Requirements. We may disclose information to law enforcement or regulatory authorities where required by law or court order.

Personal information is retained while your account is active and for a minimum of 7 years after closure for legal compliance. Transaction records: 7 years. Verification documents: 2 years after the verification decision or 2 years after account closure, whichever is later. Direct acquisition records (including AI intake conversations): 7 years. Server logs: 90 days.

We implement appropriate safeguards: encrypted connections (HTTPS/TLS); passwords stored using Argon2 one-way hashing; database access restricted to backend services with no direct public access; staff access controls and access logging; payment card data handled entirely by Stripe (PCI DSS Level 1 compliant).

No system is perfectly secure. In the event of a data breach posing risk to users, we will notify affected users and applicable regulators within the timeframe required by law.

Subject to applicable Canadian privacy law, you have rights to: access personal information we hold; request correction of inaccuracies; request deletion subject to legal retention requirements; withdraw consent where processing is consent-based; and revoke referral consent at any time before information is shared.

Contact info@assetshifts.com. We will respond within the timeframe required by applicable law.

We use cookies as described in the Cookie Policy. Cookies are limited to those necessary for Platform operation (session/authentication) and basic analytics. We do not use tracking cookies for targeted advertising.

AssetShift uses AI for: chat moderation (detecting and redacting prohibited contact information, payment links, and off-platform solicitation); direct acquisition intake assistance; and listing support. No legally significant decisions — transaction approval, fund release, account termination — are made solely by automated systems without human review.

The Platform may contain links to third-party websites. AssetShift is not responsible for their privacy practices.

The Platform is not directed at persons under 18. We do not knowingly collect data from minors. If we become aware of such collection, we will delete it promptly.

We may update this Privacy Policy at any time. Material changes will be communicated via email and/or Platform notification. The "Last updated" date will be revised. Continued use after changes constitutes acceptance.

If not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your applicable provincial commissioner.