Privacy Policy

Last updated: 2026-04-17

This Privacy Policy explains how Repblend Inc. ("RepBlend," "we," "us") — a British Columbia corporation — collects, uses, and protects personal information. It complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and takes into account GDPR and CCPA principles for users in those jurisdictions.

1. Who we are and how to reach our Privacy Officer

Privacy Officer: Travis Steward. Contact: trav@repblend.com (subject line: "Privacy request"). We respond to privacy requests within 30 days.

Mailing address (as of 2026-04): available on request from the Privacy Officer.

2. Information we collect

We collect only what's needed to operate the service.

From merchants

• Business legal name, trade name, and jurisdiction.
• Primary contact name, email, and phone number (if provided during Stripe connection).
• Stripe connected-account ID and associated metadata Stripe surfaces to us (business type, country, payouts status).
• Your product catalog as exposed via Stripe (names, prices, descriptions).
• Commission rules you configure.
• Refund / dispute activity on sales through RepBlend-generated Payment Links.

From representatives

• Legal name, email, primary jurisdiction of residence.
• Tax forms as applicable: IRS W-9 (US persons), W-8BEN or W-8BEN-E (non-US persons). Collected at signup, stored encrypted.
• Stripe Express connected-account ID and payouts status (we don't see your bank details — Stripe holds those).
• Your enlistment history, generated Payment Links, and earnings history.
• Any pitch-page content you author on our platform.

From customers who buy through a rep's Payment Link

• We don't collect customer payment-card information — that stays with Stripe. We see invoice-level metadata required to route commissions: charge ID, amount, currency, and the rep identifiers we encoded on the Payment Link.
• If a merchant or rep shares additional customer data (e.g., via a pitch-page form), we process it on the merchant's behalf under the merchant's own privacy obligations.

From site visitors

• Basic server logs (IP, user agent, timestamps) held by our hosting provider (Cloudflare) for operational and security purposes.
• No third-party ad trackers, no marketing pixels, no data enrichment or behavioral profiling.

3. Why we collect it (purposes and legal bases)

• To provide the service — generate Payment Links, route commissions, compute tax reporting, operate dashboards. Legal basis: contract performance.
• To fulfill tax and regulatory obligations — issue T4A Box 048 to Canadian reps, keep transaction records for audit, comply with CRA / IRS / FINTRAC requirements. Legal basis: legal obligation.
• To prevent fraud and abuse — detect anomalous patterns, block sanctioned jurisdictions, respond to chargebacks. Legal basis: legitimate interest.
• To communicate with you — account notifications, transactional emails (payout confirmations, refund alerts), and material product updates. Legal basis: contract performance.
• To improve the service — aggregated, anonymized analytics (e.g., which merchant verticals see higher conversion). Legal basis: legitimate interest. We never sell or share identifiable data for advertising.

4. Who we share information with

We share personal information with a small set of service providers that are necessary to operate the platform. Each is bound by a data-processing agreement or equivalent, and each is a substantial operator with its own privacy program.

• Stripe — payment processing, Connect onboarding, identity verification, payouts, tax reporting (Stripe issues 1099-K to US reps where applicable). Stripe is a licensed money transmitter in all US states and a registered money services business in Canada. Stripe's privacy policy.
• Cloudflare — website hosting, Workers runtime, Queues, KV, and Hyperdrive (database proxy). Cloudflare processes requests and caches some static assets. Cloudflare's privacy policy.
• Neon — managed Postgres database provider. Stores operational data (accounts, Payment Links, transfer records). Neon's privacy policy.
• Email providers (Cloudflare Email Sending; SendGrid as fallback) — transactional email delivery.
• Tax authorities — CRA for T4A filings; IRS only if required under a future structure flip or backup-withholding scenario.
• Legal / regulatory — we disclose information if required by law or court order. We'll notify you unless legally prohibited.

We do not sell personal information. We do not share it for behavioral advertising. We do not enrich your data with third-party brokers.

5. International transfers

RepBlend is a Canadian corporation, but our service providers are US-based (Stripe, Cloudflare, Neon). Personal information may be processed in the US and other jurisdictions. These providers are bound by contractual data-protection obligations and maintain appropriate safeguards. If you have questions about transfers, contact the Privacy Officer.

6. Retention

• Account records (merchant / rep profile, email, jurisdiction) — for the life of your account plus 7 years after account closure, to meet CRA record-keeping requirements.
• Financial / transaction records (Payment Links, charges, transfers, commission history, tax forms) — 7 years from the year of the transaction, per CRA and IRS record-keeping standards.
• Webhook and operational logs — 24 months, then deleted.
• Email communication — indefinitely, unless you request deletion of specific messages.
• Server logs held by Cloudflare — subject to Cloudflare's retention (typically short-term).

7. Security

• Transport-layer encryption (TLS 1.2+) on every connection between you, RepBlend, and our providers.
• Platform database accessible only through authenticated Workers; no public database endpoint.
• Magic-link authentication — short-lived tokens in an isolated Cloudflare KV namespace; no plaintext password storage.
• Stripe holds all sensitive payment data. We never see card numbers or bank details.
• Access to production systems is restricted to the Privacy Officer (currently the sole operator of RepBlend).

No system is perfectly secure. If you discover a vulnerability, please email trav@repblend.com with "Security" in the subject.

8. Data-breach notification

If a breach creates a real risk of significant harm to you, we'll notify you and the Office of the Privacy Commissioner of Canada without unreasonable delay, per PIPEDA. Notification will describe what happened, what was affected, and what you can do.

9. Your rights

You have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix information that's inaccurate or incomplete.
• Deletion — request deletion, subject to retention obligations (e.g., we can't delete tax records before their retention period expires).
• Portability — request your data in a machine-readable format.
• Objection / restriction — object to certain uses (e.g., legitimate- interest-based processing) or ask us to restrict processing while we resolve a dispute.
• Withdraw consent — where we rely on consent, you can withdraw at any time. Withdrawal doesn't affect processing that already happened. If you withdraw consent necessary to operate your account, we may need to close the account.
• Complaint — if you're not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada or your local data-protection authority.

To exercise any right: email trav@repblend.com. We may ask for verification (a quick identity check) to prevent third-party data requests.

10. Cookies and tracking

repblend.com uses minimal, strictly-functional cookies for authentication (session tokens) and site operation. We do not use advertising cookies, marketing pixels, or cross-site tracking. If you block cookies, authenticated features may not work.

11. Children

RepBlend is not directed at children under 18. We don't knowingly collect information from anyone under 18. If you believe a child has signed up, contact the Privacy Officer and we'll delete the account.

12. Jurisdiction-specific notes

• EU / UK (GDPR): the legal bases we rely on are set out in §3. Our EU / UK representative is not yet designated as of 2026-04; EU or UK residents may contact the Privacy Officer directly.
• California (CCPA / CPRA): we do not sell or share personal information for cross-context behavioral advertising. California residents have the same access, deletion, and correction rights set out in §9.
• Quebec: RepBlend does not currently operate in Quebec (see Terms of Service §4). If this changes, we'll update this policy with Quebec Law 25–specific obligations before onboarding any Quebec-resident user.

13. Changes to this policy

We'll update this policy from time to time. Material changes are announced by email to account holders and posted here with an updated "Last updated" date. Continued use after the effective date means you accept the revised policy.

14. Contact

Privacy questions, access requests, complaints: trav@repblend.com.