Privacy Policy
RUSHSAVOR INCORPORATED.
Privacy Policy
Effective Date: February 19, 2026
Version 1.0
Applies to: RushSavor Mobile App & Website
SCOPE
This Privacy Policy applies to all users of the RushSavor platform — consumers who purchase last-minute restaurant deals and merchant partners who list their restaurants. It covers our mobile applications (iOS and Android), our website, and all associated services. Jurisdiction-specific provisions for Canada, Quebec, and United States residents appear at the end of this document.
SUMMARY
We collect the information needed to operate the platform: your account details, location (to show you nearby deals), and transaction data (processed by Stripe). We do not sell your personal information. We do not share it beyond the service providers necessary to run the platform. You have the right to access, correct, and delete your data at any time.
1. About RushSavor and This Policy
RushSavor Incorporated. ("RushSavor," "we," "us," or "our") operates a last-minute restaurant deal marketplace that connects consumers with local restaurants offering discounted meals to reduce food waste. We are incorporated in Ontario, Canada, and serve consumers and restaurant partners in Canada and the United States.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, with whom we share it, and what rights you have over your information. It applies every time you access our mobile applications, visit our website, create an account, purchase a deal, or interact with us as a merchant partner.
This Policy should be read alongside our Terms of Useand, for restaurant partners, our Merchant Partnership Agreement. In the event of any conflict between this Policy and those documents, this Policy governs with respect to privacy matters.
Our Privacy Contact
For any privacy questions, requests, or concerns, you may contact our Privacy Officer:
Privacy Officer: Maya Muharemagic
Email: privacy@rushsavor.com
Mailing Address: RushSavor Incorporated., 1554 Carling Avenue, Suite #M436, Ottawa, ON, K1Z 7M4
Response Time: Within 30 days of receipt
2. Information We Collect
We collect personal information only to the extent necessary to operate the RushSavor platform. The categories below describe what we collect, from whom, and why.
2.1 Information You Provide Directly
Consumer Account Information
• Full name
• Email address
• Mobile phone number
• Password (stored in hashed form — we never store your plain-text password)
• Profile preferences (dietary preferences, favourite cuisines — optional)
Payment Information
All payment processing is handled by Stripe, Inc., our payment processor. RushSavor does not store your full payment card number, CVV, or banking credentials. We receive only:
• Last four digits of the payment card
• Card expiry month and year
• Billing postal code
• Stripe transaction identifiers for our records
Merchant Partner Information
• Business name, address, and contact details
• Owner or authorized representative name and contact information
• Bank account or payout details (for commission settlement via Stripe Connect)
• Menu items, pricing, and deal descriptions submitted to the platform
• Business registration documentation where required
2.2 Information Collected Automatically
When you use the RushSavor app or website, we automatically collect:
Location Data
Precise GPS location (with your explicit permission) — used to show you nearby restaurant deals in real time. You may disable location access in your device settings at any time; however, doing so will prevent the core functionality of the app from working.
Device and Usage Information
• Device type, operating system, and version
• Unique device identifiers (device ID, advertising ID)
• App version and language settings
• IP address and approximate location derived from it
• Pages or screens viewed, features used, and actions taken within the app
• Crash reports and error logs
• Time and date of interactions
Communications
• Records of support requests, feedback, or disputes you submit to us
• Survey responses where you voluntarily participate
2.3 Information from Third Parties
We may receive limited information from the following sources:
• Stripe — transaction confirmation and fraud signals
• App stores (Apple App Store, Google Play) — download and installation records
• Analytics providers — aggregated, anonymised usage statistics
WE DO NOT
RushSavor does not purchase data from data brokers. We do not collect information from social media profiles unless you choose to connect a social login. We do not collect biometric data, health information, government identification numbers, or sensitive personal information beyond what is described in this section.
3. How We Use Your Information
We use personal information only for the purposes described below. We will not use your information for a materially different purpose without notifying you and, where required by law, obtaining your consent.
3.1 To Operate the Platform
• Create and manage your account
• Identify nearby restaurant deals based on your location
• Process deal purchases and facilitate payment through Stripe
• Communicate your deal redemption details to the participating restaurant
• Send transaction confirmations and receipts
• Provide customer support
3.2 To Improve the Platform
• Analyse usage patterns to improve features, fix bugs, and enhance performance
• Conduct internal research and testing
• Monitor platform integrity and prevent fraud or abuse
3.3 Marketing and Communications
With your consent (where required by applicable law), we use your contact information to:
• Send push notifications about nearby deals or time-sensitive offers
• Send email newsletters, promotional offers, and platform updates
• Send transactional messages related to your account or purchases
CASL — CANADA
All commercial electronic messages to Canadian users require express consent under Canada's Anti-Spam Legislation (CASL). We will always identify ourselves, explain why you are receiving the message, and provide a clear, free, and easy unsubscribe mechanism. You may withdraw consent at any time by clicking "Unsubscribe" in any email or disabling push notifications in your device settings.
3.4 Legal Obligations
• Comply with applicable laws, regulations, and court orders
• Respond to valid legal requests from law enforcement or regulatory bodies
• Enforce our Terms of Use and Merchant Agreements
• Investigate and prevent fraud, security incidents, or harmful activity
3.5 Business Operations
• Manage our relationship with merchant partners
• Process merchant onboarding and commission settlements
• Maintain required business records and tax documentation
4. How We Share Your Information
RushSavor does not sell, rent, or trade your personal information to any third party. We share information only as described below, and only to the extent necessary.
4.1 Service Providers
We share personal information with third-party service providers who process it on our behalf and under our instructions. These providers are contractually required to protect your information and use it only for the purposes we specify. Current categories include:
Service Provider, What They Process, Why ?
Stripe, Inc.
Payment card data, transaction records, merchant payout details.
Payment processing and fraud prevention.
Cloud Hosting Provider:
All platform data (encrypted at rest)
Secure storage and infrastructure
Analytics Provider:
Anonymised usage data, device identifiers
Platform improvement and performance monitoring
Push Notification Service:
Device tokens,
Delivery of app notifications
Email Delivery Provider:
Email address, message content,
Transactional and marketing emails
Customer Support Tool
Support correspondence,
Responding to inquiries and complaints
4.2 Restaurant Partners
When you purchase a deal, we share the minimum information necessary with the participating restaurant to enable your redemption:
• Your first name and the last four digits of your order reference number
• The deal purchased, quantity, and redemption time window
• Any dietary preferences you have submitted that are relevant to the order
We do not share your full name, email address, phone number, or payment information with restaurants.
4.3 Legal Disclosure
We may disclose personal information if we have a good-faith belief that such disclosure is necessary to:
• Comply with a legal obligation, court order, or regulatory requirement
• Protect the rights, property, or safety of RushSavor, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues
4.4 Business Transfers
If RushSavor is involved in a merger, acquisition, financing, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify affected users via email or a prominent notice in the app prior to any transfer, and we will require the acquiring entity to maintain protections consistent with this Privacy Policy.
4.5 Cross-Border Transfers
RushSavor is incorporated in Ontario, Canada and our infrastructure providers may process data in the United States and Canada. If you are a resident of Quebec or another Canadian province, your personal information may be transferred to and processed in the United States, where privacy laws may differ from those in your province.
QUEBEC RESIDENTS
Transfers of personal information outside Quebec are subject to a Privacy Impact Assessment (PIA) under Law 25. We have conducted or will conduct a PIA before transferring Quebec resident data to any jurisdiction outside Canada. Transfers only proceed where we are satisfied that the receiving jurisdiction provides adequate protection. You may request information about our cross-border transfer practices by contacting our Privacy Officer.
5. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The table below describes our standard retention periods. Specific Quebec Law 25 retention obligations are described in the Quebec-specific section of this Policy.
Category, Retention Period, Reason / Legal Basis, Consumer account data
Duration of account + 2 years,
Platform operation; dispute resolution,
Transaction records
7 years after transaction,
Tax law (Canada and US); accounting obligations
Location data (precise GPS)
Session only — not stored,
Not retained beyond active session
Payment data (Stripe tokens)
Per Stripe's retention policy,
Payment processing compliance
Marketing consent records
Until consent withdrawn + 3 years,
CASL compliance; proof of consent
Support correspondence
3 years from close of ticket,
Dispute resolution; service improvement
Analytics / usage data
26 months (anonymised),
Platform improvement (anonymised — not personal data)
Merchant account data
Duration of agreement + 7 years,
Tax obligations; contract records
Inactive accounts
2 years after last login, then deleted or anonymised,
Quebec Law 25; data minimisation principle
When retention periods expire, personal information is securely deleted or irreversibly anonymised in accordance with our internal Data Destruction Procedure. We maintain a register of destruction activities as required by Quebec Law 25.
6. Your Privacy Rights
Depending on where you are located, you may have some or all of the rights described below. The jurisdiction-specific sections at the end of this Policy describe additional or modified rights for residents of Canada, Quebec, and US states with specific privacy laws.
To exercise any right, contact our Privacy Officer at privacy@rushsavor.com. We will respond within 30 days. In complex cases we may extend this period by a further 30 days, in which case we will notify you.
6.1 Right to Access
You have the right to request a copy of the personal information we hold about you, including the categories of information, the purposes for which we use it, and the third parties with whom we share it.
6.2 Right to Correct
You have the right to request correction of any inaccurate or incomplete personal information we hold about you. You may also update most account information directly in the app settings.
6.3 Right to Delete
You have the right to request deletion of your personal information. We will delete your data unless we are required to retain it by law (for example, transaction records required for tax purposes) or where we have a legitimate interest in retaining it for security or fraud prevention purposes. We will explain any exceptions at the time of your request.
6.4 Right to Withdraw Consent
Where we process your information based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for marketing communications is immediate — use the unsubscribe link in any email or toggle notifications off in your device settings.
6.5 Right to Data Portability
You have the right to receive your personal information in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to transmit that information to another service provider. Submit a portability request to privacy@rushsavor.com.
6.6 Right to Object to Processing
You have the right to object to our processing of your personal information for direct marketing purposes. We will stop all marketing communications promptly upon receipt of your objection.
6.7 Right to File a Complaint
If you are unsatisfied with how we have handled your personal information or your rights request, you have the right to file a complaint with the relevant supervisory authority:
• Canada (federal): Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• Quebec: Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca
• United States: Varies by state — see the US-specific section of this Policy
7. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies (pixels, local storage, session storage). Our mobile applications use device identifiers and app analytics SDKs.
7.1 What We Use: Type, Examples, Purpose, Essential
Session cookies, authentication tokens
Required for the platform to function. Login state, security tokens. Cannot be disabled.
Functional
Preference cookies,
Remember your settings (language, notification preferences). Disabled if you withdraw consent.
Analytics
Usage analytics SDK,
Understand how users navigate the app and website. Data is aggregated and anonymised where possible. Disabled if you withdraw consent.
Marketing
Email tracking pixels,
Measure whether marketing emails are opened or clicked. Disabled if you withdraw marketing consent.
QUEBEC RESIDENTS
Quebec Law 25 requires explicit opt-in consent before deploying any tracking technology that is not strictly essential. All non-essential cookies and tracking on our website are disabled by default for Quebec residents. A consent banner will request your explicit permission before activating any analytics, functional, or marketing tracking. You may withdraw this consent at any time.
7.2 Managing Your Preferences
• Website: Use our cookie preference centre (accessible via the footer link "Cookie Settings") to review and change your choices at any time.
• App: Toggle analytics and marketing preferences in Settings > Privacy.
• Device: Disable advertising tracking in iOS Settings > Privacy & Security > Tracking or Android Settings > Google > Ads.
• Email: All marketing emails include a one-click unsubscribe link.
8. Security
We implement technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:
• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of personal data at rest in our cloud storage systems
• Password hashing using industry-standard algorithms (bcrypt or equivalent)
• Role-based access controls limiting employee access to personal data on a need-to-know basis
• Regular security testing and vulnerability assessments
• Incident response procedures with defined notification timelines
No method of electronic transmission or storage is completely secure. While we take these precautions seriously, we cannot guarantee absolute security. If you suspect a security issue with your account, contact us immediately at privacy@rushsavor.com.
8.1 Data Breach Notification
In the event of a data breach that poses a real risk of significant harm to individuals, we will:
• Notify the applicable regulatory authority as soon as feasible and in any event within 72 hours of becoming aware (or as required by applicable law)
• Notify affected individuals without undue delay where required by law
• Maintain a register of all security incidents as required by Quebec Law 25
• Take immediate steps to mitigate harm and prevent recurrence
9. Children's Privacy
The RushSavor platform is not directed at children under the age of 13 (or 14 in Quebec). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verifiable parental or guardian consent, we will delete that information promptly.
If you are a parent or guardian and believe your child has provided personal information to us, please contact us at privacy@rushsavor.com.
QUEBEC
Under Quebec Law 25, parental or tutor consent is required before collecting, using, or disclosing any personal information about a person under the age of 14. If you are under 14 and located in Quebec, you may not use RushSavor without the verified consent of a parent or guardian.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
• Posting the updated Policy in the app with a "Last Updated" date
• Sending an email notice to registered users at least 30 days before material changes take effect
• Displaying an in-app notice at the time of your next login following a change
Your continued use of the platform after the effective date of any updated Policy constitutes your acceptance of the changes, except where applicable law requires fresh consent. Where fresh consent is required, we will request it explicitly before the change takes effect.
We maintain a revision history of this Policy. Prior versions are available upon request from our Privacy Officer.
🇨🇦 PART A — CANADA: ADDITIONAL PRIVACY PROVISIONS
The following provisions apply to residents of all Canadian provinces and territories. They supplement — and in the event of conflict, supersede — the general provisions of this Privacy Policy with respect to Canadian residents. Residents of Quebec should also read Part B below, which contains further province-specific provisions.
A.1 Governing Law — PIPEDA and Provincial Laws
RushSavor's handling of personal information about Canadian residents is governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level. In British Columbia, Alberta, and Quebec, substantially similar provincial laws may apply instead of PIPEDA for intra-provincial activities. In all provinces, we commit to meeting the higher standard where laws overlap.
A.2 PIPEDA's Ten Fair Information Principles
Our practices are designed to reflect all ten fair information principles set out in Schedule 1 of PIPEDA:
• Accountability — We have designated a Privacy Officer responsible for compliance.
• Identifying Purposes — We identify the purposes for collecting personal information before or at the time of collection.
• Consent — We obtain informed consent for the collection, use, or disclosure of personal information, except where law permits otherwise.
• Limiting Collection — We collect only the information necessary for the identified purposes.
• Limiting Use, Disclosure, and Retention — We use and disclose information only for the purposes for which it was collected, unless law requires otherwise.
• Accuracy — We take reasonable steps to ensure personal information is accurate and up to date.
• Safeguards — We protect personal information with security measures appropriate to the sensitivity of the information.
• Openness — We make information about our privacy practices available to you through this Policy.
• Individual Access — You have the right to access the personal information we hold about you and to challenge its accuracy.
• Challenging Compliance — You may address a challenge concerning our compliance to our Privacy Officer.
A.3 Consent
Under PIPEDA, consent for the collection and use of personal information may be express or implied depending on the sensitivity of the information and the circumstances. Express (explicit) consent is required for:
• Sensitive personal information (financial details, precise location)
• Any use of your information for purposes beyond those you would reasonably expect
• Commercial electronic messages under CASL
Implied consent may apply to routine uses of non-sensitive information that are necessary to operate the platform and that a reasonable person would expect (for example, using your email address to send a transaction receipt).
You may withdraw consent at any time, subject to legal or contractual restrictions. Contact our Privacy Officer or use the in-app settings.
A.4 Anti-Spam (CASL)
Canada's Anti-Spam Legislation (CASL) applies to all commercial electronic messages (CEMs) sent to Canadian recipients. Every CEM we send will:
• Clearly identify RushSavor as the sender
• Provide our full mailing address and a contact method
• Include a free and easy unsubscribe mechanism that takes effect within 10 business days
We will only send CEMs to Canadian recipients with valid express consent, which we record with a timestamp, consent mechanism, and the privacy policy version in force at the time. We maintain these records for a minimum of three years as required by CASL.
A.5 Cross-Border Transfers from Canada
Our infrastructure and some service providers are located in the United States. When we transfer personal information of Canadian residents to the United States, we ensure that contractual protections (data processing agreements) are in place requiring the receiving party to maintain privacy protections consistent with PIPEDA. We acknowledge that information transferred to the US may be accessible to US courts, law enforcement, or national security authorities.
A.6 Your Rights Under PIPEDA
In addition to the rights described in Section 6 of this Policy, Canadian residents have the right to:
• Request access to all personal information we hold about you, and receive it within 30 days
• Challenge the accuracy and completeness of your information and request correction
• Withdraw consent to the use of your information for any purpose at any time
• File a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you believe your privacy rights have been violated — www.priv.gc.ca — 1-800-282-1376
🇨🇦 PART B — QUEBEC: ADDITIONAL PROVISIONS (LOI 25 / LAW 25)
The following provisions apply specifically to residents of the Province of Quebec and are required by An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information (Law 25 / Loi 25), which is fully in force as of September 2024. Law 25 is the most comprehensive privacy legislation in North America and aligns Quebec privacy law with the standards of the EU's General Data Protection Regulation (GDPR).
B.1 Privacy Officer — Quebec
By default under Law 25, the person with the highest authority in the organization is responsible for the protection of personal information. RushSavor has designated this responsibility to:
• Stephanie Tessier, Chief Executive Officer, unless otherwise delegated in writing.
• Contact: privacy@rushsavor.com | 1554 Carling Avenue, Suite #M436, Ottawa, ON, K1Z 7M4
The name and contact information of our Privacy Officer is always publicly available on our website and in this Policy.
B.2 Explicit Opt-In Consent for Tracking
Under Law 25, any technology that tracks, profiles, or monitors individuals requires explicit prior opt-in consent. This is a stricter standard than federal PIPEDA. For Quebec residents:
• All non-essential cookies, tracking pixels, analytics SDKs, and profiling tools are disabled by default.
• A consent banner will appear on your first visit to our website and on first launch of our app requesting your explicit permission to enable non-essential tracking.
• You may withdraw consent at any time via Settings > Privacy in the app, or via the Cookie Settings link on our website.
• Withdrawal of consent is effective immediately and will not affect your ability to use the core platform.
B.3 Your Rights Under Law 25
Residents of Quebec have the following rights with respect to their personal information:
• Right to Access — Receive a copy of all personal information we hold about you within 30 days.
• Right to Correct — Request correction of inaccurate or incomplete information.
• Right to Delete — Request deletion or anonymisation of your personal information. Subject to legal retention requirements.
• Right to De-indexation — Request that we cease disseminating your personal information or de-index any hyperlink attached to your name that provides access to your information, where its dissemination causes you harm.
• Right to Data Portability — Receive your personal information in a structured, commonly used technological format and request that it be communicated to any person or body authorized by law to collect it.
• Right to Withdraw Consent — Withdraw consent to collection, use, or disclosure of your information at any time.
• Right to File a Complaint — File a complaint with the Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca — 1-888-528-7741.
• Private Right of Action — Under Law 25, you may bring a civil action against RushSavor for intentional violations or gross negligence in the protection of your personal information.
B.4 Data Retention and Destruction — Quebec
Law 25 requires that we destroy personal information when the purpose of its collection is accomplished, or anonymise it for use for other legitimate purposes. Our retention schedule (Section 5) reflects this obligation. In addition:
• Inactive consumer accounts are deleted or anonymised 2 years after the last login.
• Destruction is carried out using secure methods (data wiping, cryptographic erasure, physical destruction of storage media where applicable).
• We maintain a register of all data destruction activities.
You may request details of our data retention and destruction procedures by contacting our Privacy Officer.
B.5 Privacy Impact Assessments (PIAs)
Law 25 requires a Privacy Impact Assessment (PIA) before:
• Communicating personal information outside Quebec
• Acquiring, developing, or redesigning an information system or electronic service delivery system involving personal information
• Using personal information to profile individuals
We conduct PIAs for all applicable activities and make findings available to regulators as required. A PIA has been conducted or will be conducted before any Quebec resident data is transferred to the United States.
B.6 Privacy by Default
Law 25 requires that we configure our technology products and services with the highest level of confidentiality by default. In practice:
• No non-essential data collection occurs until you explicitly consent.
• Location tracking is off by default and activated only with your explicit permission.
• Marketing communications require express opt-in consent.
• Your account is private by default — no profile information is shared publicly.
B.7 Children (Under 14) — Quebec
We will not knowingly collect, use, or disclose personal information about any person under the age of 14 without the verified consent of that person's parent or legal guardian. If we discover that information has been collected from a person under 14 without parental consent, we will delete it immediately and notify the parent or guardian.
B.8 Language
This Privacy Policy is available in French upon request and will be provided within a reasonable time. A French version will be published on our website and in the app no later than the date of our first merchant or consumer activation in Quebec. Correspondence regarding privacy rights may be conducted in French.
AVIS EN FRANÇAIS
Cette politique de confidentialité est disponible en français sur demande. Veuillez écrire à privacy@rushsavor.com pour recevoir la version française. Une version française complète sera publiée avant le lancement des opérations au Québec.
This website uses cookies.
We use cookies to analyze website traffic and optimize your website experience. By accepting our use of cookies, your data will be aggregated with all other user data.