Privacy policy

Effective October 17, 2026

This policy explains how the operator of fraud.ca (“fraud.ca”, “we”, “us”) handles personal information when you use fraud.ca. It’s intended to meet our obligations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25).

1. Who is responsible

fraud.ca is responsible for personal information under its control and has designated a Privacy Officer as the person in charge of the protection of personal information. You can reach the Privacy Officer at privacy@fraud.ca.

2. What we collect

When you create an account: your email address, the display name you choose, and, if you add them, your city and province.

When you participate: your reviews, ratings, discussion posts, replies, helpful votes, reports and suggested edits, with the dates they were made and their moderation history.

If you claim a business page: your name, your role, and optionally a phone number and a note; plus, depending on how you verify, the address at the business’s domain we email (the email we send there includes your name), or the document you upload (which may contain other personal information — you may black out what we don’t need). To check a website code, we look for it on the business’s website and in its public DNS records.

Email settings: whether you want notification emails, the language you use, and a record of which notification emails we sent.

When you contact us: your messages and the details you include.

Automatically, when you use the site: technical information such as your IP address, browser and device type, pages requested and timestamps. We and our service providers use it for security, to prevent abuse (for example with the bot check at sign-in) and to keep the site running. We also use it, in aggregate, to see which pages are visited and how quickly they load.

We don’t currently collect payment information, and we don’t buy personal information from data brokers.

3. Public information about businesses

Business listings come from public and open sources, including Corporations Canada (the federal corporations registry) and Overture Maps. Some of this information can relate to individuals — for example a sole proprietor’s business name, or the names of a corporation’s directors and its registered office address, which the federal government publishes in its public registry.

We publish this information because it’s relevant to the purpose for which it’s public: letting people know who they are dealing with. Registry information is shown with its source and retrieval date. We don’t publish directors’ home addresses; any registered office address we show is the one Corporations Canada publishes. To correct or ask about this information, email privacy@fraud.ca.

4. Why we use it

We use personal information to:

• create and run your account and sign you in by email link;
• publish your reviews and posts under your display name;
• moderate content, prevent fraud, spam and abuse, and enforce our terms and guidelines;
• verify that people who claim a business page are connected to it;
• send service emails (sign-in links, the outcome of moderation on your content, replies to your posts, business responses to your reviews, answers to your questions) — you can turn off notification emails on your account page or with the unsubscribe link they include (sign-in and business-claim emails can’t be turned off), and we don’t send marketing emails without your consent;
• respond to reports, legal requests and complaints, and protect our legal rights;
• keep the site secure and understand, in aggregate, how it’s used so we can improve it.

By creating an account and posting, you consent to these uses. You can withdraw consent by closing your account (section 12), but we can’t operate an account or show your content without it.

5. Automated moderation

When you submit a review or post, it’s first checked automatically: simple rules (for example for links and email addresses) and an artificial intelligence model that compares the text with our guidelines. Based on that check, a submission can be published, returned to you with a note, rejected, or held for a human moderator — so some decisions about your content are made by automated means alone.

The AI receives the content being checked (such as its text, title and star rating), basic information about the business, and related context, such as the review or post it replies to or, when it’s re-checked, the report. We don’t send it your account email address or your IP address. You have the right to know the reasons for a decision and to have it reviewed by a person: email support@fraud.ca.

6. What's public

Your reviews, ratings, discussion posts and replies are public. They appear with your display name and, if you added it, your city and province, and they can be found through search engines and copied by others. Your email address is never shown publicly. Think carefully before including details that could identify you or anyone else.

7. Who we share it with

We don’t sell or rent personal information. We may share it in situations such as the following:

• with service providers that run parts of fraud.ca for us, under agreements or other safeguards that limit how they may use it: Cloudflare (website hosting, databases, file storage, security and bot protection, site analytics, and access to AI services), Postmark (sending email), and Anthropic (which provides the AI model used for moderation and receives, through Cloudflare, the content being checked and related context);
• when the law requires or permits it — for example to comply with a court order, subpoena or other legal obligation, to respond to law enforcement where the law allows, to protect someone’s safety, or to establish or defend legal claims;
• in a business transaction, such as a merger or sale of fraud.ca, with the parties involved, who must agree to protect it as the law requires.

8. Where it's stored

Our service providers store and process information in North America, including in the United States, and possibly elsewhere. Information processed outside Quebec or Canada is subject to the laws of those places and may be accessible to their courts and authorities.

9. How long we keep it

• Account information: while your account is open, and after it’s closed, as needed for the records described in this section.
• Reviews and posts: while they’re on fraud.ca; after you delete them, close your account or we remove them, a copy is kept with our moderation records.
• Sign-in links and sessions: as long as needed to sign you in, keep you signed in and protect your account.
• Business claim records: as long as needed to manage the page and handle disputes, or as required or permitted by law. Uploaded proof is deleted when you close your account, and may be deleted sooner.
• Record of notification emails sent: for as long as reasonably needed to run the service and answer questions about it.
• Moderation and report records (including what was submitted and the decision): for as long as reasonably needed to handle disputes and legal claims and to prevent abuse.
• Technical logs: for periods set by us or our service providers.
• Copies needed to meet legal obligations or defend legal claims: for as long as required.

We keep personal information for as long as it’s needed for the purposes described in this policy, or as required or permitted by law. After that, we take reasonable steps to delete it or make it anonymous; copies may remain in backups for a time.

10. How we protect it

Our safeguards include using encryption in transit (HTTPS), storing sign-in links and session identifiers in scrambled (hashed) form, keeping account information separate from public content, and limiting who can access personal information. No system is perfectly secure; if a breach creates a real risk of significant harm, we’ll notify you and the regulators as the law requires.

11. Cookies

We use a small number of cookies that are necessary for the site to work: for example, one that keeps you signed in and one used during our private preview. Our hosting provider may also set cookies needed for security. Our bot check (Cloudflare Turnstile) may process technical information to tell people from bots. We don’t use advertising or cross-site tracking cookies.

12. Your rights

You can ask us to:

• access the personal information we hold about you, and how we’ve used and shared it;
• correct information that’s inaccurate or incomplete;
• withdraw consent and close your account — we’ll remove your reviews and posts from public view and keep other information as described in section 9;
• if you’re in Quebec, receive your information in a commonly used technological format (portability), and ask us to stop disseminating or to de-index information as the law allows;
• know the reasons for an automated decision and have it reviewed by a person (section 5).

You can download your data and close your account yourself from your account page. For anything else, email privacy@fraud.ca. We may need to confirm your identity first. We’ll respond within the time the law requires (generally 30 days), and won’t charge you except where the law allows.

13. Children

fraud.ca isn’t directed to children, and you must be at least 18 (or the age of majority where you live) to create an account. If we learn we’ve collected personal information from a child, we’ll take reasonable steps to delete it.

14. Changes

We may update this policy. We’ll post the new version here with a new effective date and, for significant changes, take reasonable steps to let you know, for example on the site or by email. Where the law requires your consent to a change, we’ll ask for it.

15. Contact and complaints

Questions, requests or complaints: our Privacy Officer at privacy@fraud.ca.

If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.