Privacy policy
Last updated 9 October 2026
Draft for legal review. This page is a first draft prepared for MediaBuy.ca and has not yet been reviewed by a lawyer.
MediaBuy.ca (“we”) helps advertisers plan media and connects them with the media outlets they choose. This policy explains what personal information we collect, why, and the choices you have, in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect
- Your campaign brief: budget, timing, region, audience, goal, industry and any notes.
- Your contact details, if you submit a brief: name, company, website, work email and phone number, plus your contact preference.
- Consent records: the exact consent wording you agreed to, the outlets it named and when.
- Technical data: a one-way hash of your IP address (we do not store the address itself), browser type, and campaign tags (UTM) on the link that brought you here.
- Media and agency accounts: name, work email, company, billing details (handled by Stripe) and listing information.
- Usage analytics: which steps of the planner were viewed and completed, tied to a random session identifier, not to your name.
How we use it
- To build your media plan and send your brief to the outlets you approved.
- To share your contact details with those outlets’ representatives, only with your consent. See How we share your details.
- To send you a confirmation and service messages about your brief.
- To prevent spam and abuse, and to keep records required by law.
- To improve the planner (aggregate funnel statistics).
We do not sell your information to data brokers and we do not send it to outlets you did not approve.
Where it is stored
Our database is hosted in Canada (Montréal region). Some service providers process data outside Canada: website hosting (Vercel), email delivery (Resend), payments (Stripe), spam protection (Cloudflare Turnstile) and analytics (PostHog). They act on our instructions and are bound to protect it.
How long we keep it
Briefs and contact details are kept for 24 months after submission, then deleted or anonymized. Consent records are kept for as long as needed to show we had consent, and at least three years after your last interaction.
Your rights
You can ask to see, correct or delete your information, or withdraw consent at any time, by writing to privacy@mediabuy.ca. Withdrawing consent stops future sharing; outlets that already received your details must stop contacting you when you ask them. You can also complain to the Office of the Privacy Commissioner of Canada.
Contact
Privacy officer, MediaBuy.ca · privacy@mediabuy.ca