Privacy Policy

Overview

Ruffus (operated by Boucle Technologies, Inc., based in Québec, Canada) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information about you when you use our services — whether you're a merchant setting up a loyalty program or a customer collecting stamps.

We comply with Québec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada's Anti-Spam Legislation (CASL). If you are located in the European Union, the rights described in this policy also satisfy the GDPR.

Information We Collect

We collect only the personal information necessary to provide the Ruffus service (the principle of data minimisation required by Law 25). This includes:

• Account information (name, email address, business name)
• Payment information (processed securely via our payment provider — we never store card numbers)
• Loyalty card activity (stamps collected, rewards redeemed, scan timestamps)
• Device and usage data (browser type, IP address, pages visited)

How We Use Your Information

• To provide and improve the Ruffus service
• To send transactional emails and service notifications
• To process payments and manage subscriptions
• To detect and prevent fraud or abuse
• To comply with legal obligations

Cookies & Tracking

We use cookies and similar technologies to keep you signed in, understand how you use our service, and improve performance. We do not sell your data to advertisers or use third-party ad tracking.

Any marketing or promotional emails we send are subject to CASL — you will only receive them if you have given express or implied consent, and every message includes a clear unsubscribe link. Transactional and service emails (account confirmation, billing receipts, security alerts) do not require marketing consent and cannot be opted out of while your account is active.

You can control cookies through your browser settings. Disabling cookies may affect your ability to use certain features of Ruffus.

Sharing Your Information

We do not sell your personal information. We may share it with:

• Service providers who help us operate Ruffus (payment processors, hosting, analytics)
• Law enforcement or regulators when required by law
• Acquirers in the event of a merger, acquisition, or asset sale

Your Rights

Under Québec's Law 25 and PIPEDA, and regardless of where you are located, you have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to or restrict certain processing activities
• Data portability — receive your data in a structured, commonly used format
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your rights have been violated

To exercise these rights, email our Privacy Officer at privacy@ruffus.app.

Merchant Data Processing

When merchants use Ruffus to run a loyalty program, their customers' data (names, emails, stamp activity) is processed by Ruffus on the merchant's behalf. In this context, the merchant is the data controller and Ruffus acts as a data processor, handling that data only as instructed and as described in our merchant agreements.

If you are a customer of a business that uses Ruffus and wish to exercise your data rights, please contact that business directly. We will assist them in responding to your request as required by our agreements.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you close your account, we will delete or anonymise your personal data within 90 days, unless we are required by law to retain it longer.

Transaction records and loyalty activity logs may be retained for up to 7 years for financial and compliance purposes, in accordance with applicable law.

International Transfers

Ruffus is operated from Québec, Canada. Your information may be stored and processed in Canada or in other countries where our service providers operate (including the United States). As required by Québec's Law 25, we conduct a Privacy Impact Assessment (PIA) before transferring personal information outside Québec, to ensure it receives a level of protection equivalent to what is required here.

For EU users, we rely on appropriate safeguards such as Standard Contractual Clauses when transferring data outside the EEA.

Children's Privacy

Ruffus is not directed at minors under the age of 14. Under Québec's Law 25, we do not collect personal information from anyone under 14 without verified parental or guardian consent. If we become aware that we have inadvertently collected such information, we will delete it promptly. Please contact us at privacy@ruffus.app if you believe a minor has created an account.

Security

We use industry-standard encryption and security practices to protect your data. No method of transmission over the internet is 100% secure, but we work hard to protect your information against unauthorised access, alteration, disclosure, or destruction.

In the event of a confidentiality incident (data breach) that presents a risk of serious harm, we will notify the Commission d'accès à l'information du Québec (CAI) and all affected individuals as soon as reasonably possible, as required by Law 25.

Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of material changes by email or by posting a notice on our website at least 15 days before the changes take effect. Your continued use of Ruffus after the effective date constitutes your acceptance of the updated policy.