ShopItUp Canada — Privacy Policy

Effective date: 2026-09-16 · Last updated: 2026-10-11

1. Who we are

This Privacy Policy applies to the ShopItUp platform at shopitup.ca, including the marketplace, seller tools, subscriptions, Connected Channels (including Autopilot), and the ShopItUp browser extension (together, the "Platform").

The Platform is operated by 2837675 Alberta Inc., an Alberta corporation carrying on business as ShopItUp, with its registered office at 5-5034 49 Street, Olds, Alberta T4H 1H3 ("ShopItUp," "we," "us," "our").

ShopItUp Inc., a Delaware corporation, is a separate company that operates the ShopItUp platform for users in the United States under its own terms and privacy policy. ShopItUp Inc. is not a party to your use of the Platform. References to "ShopItUp," "we," or "us" in this Policy mean only 2837675 Alberta Inc.

The marketplace hosts independent sellers (each, a "Store"; sellers are also called "tenants"). Each Store is a separate business responsible for its own products, fulfillment, and handling of the personal information it receives (see Section 9).

This Policy explains how we collect, use, disclose, and protect personal information in accordance with the Personal Information Protection Act (Alberta) and the Personal Information Protection and Electronic Documents Act (Canada), as applicable.

2. Who this Policy covers

This Policy applies to:

Buyers and visitors who browse the marketplace, create an account, or place an order (Section 3);
Sellers, including individuals and sole proprietors, who apply for or operate a Store or subscribe to our seller tools (Section 4); and
Connected Channels users, meaning sellers who connect third-party platforms to the Platform (Section 5).

3. Information we collect from buyers and visitors

Order information: your name, email address, phone number (if provided), shipping address or pickup selection, the items you purchase, and your order history.
Account information: if you create an account, your name, email address, and password (stored in hashed form).
Payment information: payments are processed by Stripe (Section 8). We do not receive or store your full card number. We receive limited information from Stripe, such as card brand, the last four digits, payment status, and fraud-screening results.
Communications: messages you send to us or to Stores through the Platform, and records of support requests, returns, and refunds.
Usage and device information: IP address, browser and device type, pages viewed, actions taken, timestamps, and error diagnostics.
Cookies and similar technologies: see Section 13.

3.1 Shopping through an AI assistant or another app

You can shop ShopItUp through an AI assistant (such as Claude or ChatGPT) or another app that uses our Shopping API.

Without signing in: the app sends us what it needs to answer your request — what you are searching for (words, sizes, price range), the items you are interested in, and, to price an order, the shipping address it gives us. We use this only to answer that request and keep it with any checkout it creates. The app does not tell us who you are.
If you connect your ShopItUp account: you sign in on our website and choose what the app may see — your name and email address, your saved sizes, your saved shipping address, and your orders. We share only what you approved, only with that app, and only to answer your requests.
What we record: which app made each request (counted per app, not per person), the checkouts it created, and which app an order came through. We do not receive or keep your conversation with the assistant.
Paying: you always review and pay on ShopItUp's own checkout page. Apps never receive your payment details.
Disconnecting: you can disconnect an app at any time under Connected apps in your account settings. It loses access to your account immediately.
The app's own handling: what you tell an assistant, and what it does with information we return to it, is governed by that assistant's or app's own privacy policy.

4. Information we collect from sellers

Identity and contact information: name, business name, email address, phone number, and address.
Verification information: information needed to verify your identity and business, collected by us or by Stripe as required by law and by Stripe's policies.
Tax information: your GST/HST registration number, business number, or other taxpayer identification number (which, for individuals, may include a Social Insurance Number), as required by Canada's reporting rules for platform operators and applicable sales tax laws.
Payout information: bank account details are provided directly to Stripe. We receive only limited information needed to manage payouts.
Subscription and billing information: your plan, add-ons (such as Connected Channels), billing history, and payment status. Subscription payments are processed by Stripe, and we do not store your full card number.
Catalog and inventory information: the products, images, descriptions, prices, and listings you create, import, or manage on the Platform.
Store and transaction information: sales, fees, payouts, refunds, and disputes.
Intellectual property notices: notices of claimed copyright infringement relating to your listings, and related records (Section 8).

5. Connected Channels and Autopilot

Connected Channels let sellers link their own accounts on third-party platforms to the Platform so that we can sync listings and perform other actions they enable, including through our Autopilot feature. ShopItUp is not affiliated with, endorsed by, or partnered with any third-party platform unless we expressly say so.

5.1 How accounts are connected

Platform	How you connect	What we store
Poshmark, Depop	Our browser extension, with your consent	A session token from your logged-in browser
eBay	eBay sign-in (OAuth) that you authorize	An OAuth token
Shopify	An authorization you approve in Shopify (OAuth)	Your store domain and access token
Google Merchant Center	Google sign-in (OAuth) that you authorize	An OAuth token

We never ask for or store your passwords for connected platforms.

5.2 What the browser extension does

When you choose to connect a supported platform, the extension reads the session cookies for that platform's website (poshmark.com, poshmark.ca, and depop.com) from your browser and sends them securely to us.

The extension does not read:

cookies or content from other websites;
your browsing history; or
your passwords.

The extension requests only the "cookies" and "storage" permissions, and only for those domains.

5.3 What a session token allows

A session token gives the Platform the same access to your account on that platform as your logged-in browser, for as long as the session remains valid. Depending on the platform, this may include your listings, sales, offers, messages, and account settings.

We use this access only to perform the actions you enable, such as:

syncing listings, prices, and inventory;
sharing or relisting your own listings;
delisting items that have sold or that you have removed; and
publishing new listings you create on the Platform.

We do not use it for any other purpose.

5.4 How Autopilot performs actions

Autopilot performs enabled actions from our servers using your session token. When it does:

Network routing. We route requests to connected platforms through third-party network service providers, which may use IP addresses located in your region.
Verification challenges. If a connected platform presents a verification challenge (such as a CAPTCHA), we may use a third-party verification service to complete it. That service receives the challenge information, and may use human workers to complete it.

These providers receive your session token or request data only as needed to transmit requests, and are bound by confidentiality and security obligations. See Section 10 for where they are located.

5.5 Other people's information in your connected accounts

Your connected accounts may contain personal information about other people, such as your buyers' names, addresses, and messages. We access that information only as necessary to perform the actions you enable, and we process it on your behalf.

You are responsible for having a lawful basis to allow us to access it, as set out in the Seller Agreement.

5.6 Disconnecting

You can disconnect a platform at any time in your dashboard. When you do, we delete the stored token from our active systems within 7 days.

Disconnecting may not end your session on the third-party platform. To end that session, log out of the platform on all devices or change your password there.

We may suspend or discontinue any Connected Channel at any time, including if a third-party platform requests it.

5.7 Third-party platforms

When we act on a connected platform at your direction, that platform receives and processes information under its own terms and privacy policy. Third-party platforms may restrict automated activity or limit, suspend, or close accounts. See the Seller Agreement for details.

5.8 Google user data and Limited Use

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use the Google Merchant API only to sync your own product listings to your own Google Merchant Center account at your direction. Information received from Google APIs:

is not used for advertising;
is not sold;
is not transferred to third parties except as necessary to provide or improve this feature, for security, to comply with law, or as part of a merger, acquisition, or sale of assets;
is not routed through the network or verification providers described in Section 5.4; and
is not read by humans except with your consent, for security purposes, to comply with law, or where the data has been aggregated for internal operations.

6. How we use personal information

We use personal information to:

create and manage accounts, Stores, and subscriptions;
process orders and arrange shipping or pickup;
facilitate payments, payouts, and subscription billing through Stripe;
provide Connected Channels and Autopilot, and perform the actions you enable;
send order confirmations, receipts, and other service messages;
provide customer support and handle returns, refunds, and disputes;
verify seller identity and eligibility;
detect, prevent, and investigate fraud, security incidents, counterfeit goods, and violations of our terms;
operate, maintain, secure, and improve the Platform;
meet legal obligations, including tax collection and reporting, record keeping, and responding to lawful requests; and
forward copyright infringement notices as required by the Copyright Act (Canada).

We will not use personal information for a new purpose without identifying that purpose and, where required, obtaining your consent.

7. Consent

By using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Policy. We will ask for your express consent before connecting a third-party platform or installing the browser extension.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer (Section 18) or, for Connected Channels, by disconnecting the platform. If you withdraw consent, we may be unable to provide some or all of our services.

8. How we share personal information

We do not sell, rent, or trade personal information, and we do not use it for third-party advertising. We share personal information only as described below.

Stores: when you place an order, we share your name, shipping address or pickup selection, contact details needed for fulfillment, and the items you purchased with the Store you ordered from.
Connected platforms: at your direction, we send your listings and account actions to the third-party platforms you connect (Section 5).
Stripe: payments and subscriptions are processed by Stripe Payments Canada, Ltd. ("Stripe"). ShopItUp does not process card payments. Stripe collects and uses payment, identity, and device information as an independent organization for its own purposes, including fraud prevention and legal compliance, as described in Stripe's Privacy Policy at https://stripe.com/privacy.
Service providers: we use service providers for website hosting, email delivery, shipping labels, network routing, verification challenges, error monitoring, and customer support. We do not use a third-party web analytics tool on the ShopItUp marketplace. They may use personal information only to provide services to us and are bound by confidentiality and security obligations.
Tax authorities: we disclose seller and transaction information to the Canada Revenue Agency and provincial tax authorities where required by law, including under Canada's reporting rules for platform operators and applicable sales tax legislation.
Copyright notices: when we receive a notice of claimed infringement under the Copyright Act (Canada), we forward it to the affected seller and keep records that identify that seller, as the Act requires.
Legal requirements and protection: we may disclose personal information when required or permitted by law, such as to comply with a court order, subpoena, or lawful request from a government authority, or to protect the rights, property, or safety of ShopItUp, our users, or the public, including to investigate fraud.
Business transactions: we may disclose personal information to a prospective or actual purchaser, investor, or successor in connection with a sale, merger, financing, or reorganization of our business, subject to confidentiality obligations and applicable law.
With your consent: we may share personal information for other purposes with your consent.

ShopItUp Inc. We do not disclose personal information collected through the Platform to ShopItUp Inc.

9. Stores

Each Store is an independent business responsible for its own handling of the personal information it receives. Our agreement with Stores requires them to:

use buyer information only to fulfill orders, provide customer service, and comply with law;
protect buyer information with reasonable safeguards; and
not send commercial electronic messages to buyers without consent as required by Canada's Anti-Spam Legislation.

For questions about how a specific Store handles your information, contact that Store using the details on its storefront. ShopItUp remains responsible for personal information in its own custody or control, and you may direct any request about that information to our Privacy Officer.

10. Service providers outside Canada

We use service providers located outside Canada — principally in the United States, and also in Lithuania and elsewhere in the European Economic Area (the provider that routes requests to connected platforms) — to:

host the Platform;
process payments and subscription billing;
send transactional email;
generate shipping labels;
route requests to connected platforms;
complete verification challenges presented by connected platforms;
monitor errors and diagnose faults; and
generate AI listing suggestions (a provider in the United States).

Your personal information, including session tokens and information transmitted in connection with your connected accounts, may be collected, used, disclosed, and stored in those countries for these purposes. While there, it may be accessible to courts, law enforcement, and national security authorities under local law.

Two providers used for connected platforms, in more detail. The provider that routes requests to connected platforms (Section 5.4) is a Lithuanian company and processes within the European Economic Area. The provider that completes verification challenges is operated by a company registered in Bahrain, and does not publish where it processes data or where the people who complete challenges are located — a challenge may be completed by a worker in any country. That is why no country is named for it in the list above: its registered office is in Bahrain, but we cannot tell you that your information is processed there, because the provider does not say. We send that provider only what is needed to complete the challenge, not your account, order, or payment information.

We can tell you which providers we use at the time you ask; contact our Privacy Officer (Section 18).

For written information about our policies and practices regarding service providers outside Canada, or if you have questions about how they collect, use, disclose, or store personal information, contact our Privacy Officer (Section 18).

11. How long we keep personal information

We keep personal information only as long as needed for the purposes described in this Policy or as required by law:

Order, transaction, payout, subscription billing, and tax records: at least six years after the end of the tax year to which they relate, as required by Canadian tax law.
Account information: while your account is active, and for 24 months after closure, unless a longer period is required by law.
Connected Channel tokens: until you disconnect the platform, the token expires, or your account closes. Tokens are then deleted from our active systems within 7 days.
Connected apps (AI assistants and other apps): an app keeps access to your account until you disconnect it or your account closes. Its access expires after one hour and is renewed only while the connection stands; a connection unused for 30 days ends on its own. Checkouts an app creates are kept with the order records described above.
Catalog and inventory information: while your account is active, and for 30 days after closure so you can export it, unless a longer period is required by law.
Usage logs and diagnostics: up to 90 days, unless needed longer to investigate a security or fraud incident.
Support communications: up to 24 months after the matter is resolved.
Copyright notice records: at least six months after we forward the notice, or one year if the claimant starts court proceedings and notifies us, as required by the Copyright Act (Canada).
Rental tenancy records (added 2026-10-11): When a renter deletes their account we remove their profile; a landlord's record of a signed tenancy — the parties' names and contact details as signed, and the signed documents — stays with that landlord for their retention period (at least 7 years after the tenancy ends).

When personal information is no longer needed, we securely destroy it or make it anonymous. Backups. Backups are retained on a rolling schedule: daily backups for 16 days, weekly backups for 8 weeks, monthly backups for 4 months, and yearly backups for 2 years. Information you ask us to delete is removed from our active systems promptly, but a copy may remain in a backup until that backup ages out of the schedule, which can be up to two years. We do not use backups to restore deleted accounts or deleted information, and if we restore a backup for another reason we re-apply deletions to it.

12. Security

We use reasonable physical, organizational, and technical safeguards appropriate to the sensitivity of the information, including:

encryption in transit (HTTPS);
encryption at rest for session tokens and other connected-account credentials; and
access controls that limit access to what is needed to operate the Platform.

No system is completely secure, and we cannot guarantee absolute security.

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the appropriate privacy regulators as required by law. If a breach affects Connected Channel tokens, we will also tell you how to end the affected sessions on the third-party platform.

13. Cookies and similar technologies

We use:

Essential cookies: to keep your cart and session working, keep you signed in, and secure the Platform.
Payment and fraud-prevention technologies: Stripe places cookies and collects device information during checkout and billing to process payments and detect fraud.
Our own storefront analytics: we record basic page and order activity for the Store you are visiting. This runs only if you accept cookies.

Tools a Store chooses. A Store can add its own analytics or advertising tools to its storefront — Google Analytics, Google Ads, Microsoft Advertising (Bing), Pinterest, or Meta (Facebook). Where a Store has done so:

they load only if you accept cookies. If you decline on the cookie banner, none of them load.
they are the Store's tools, not ours. Those companies receive information about your visit and may combine it with information they already hold about you, under their own privacy policies.
ShopItUp runs no advertising tags of its own, and the ShopItUp marketplace pages carry none at all.

You can block or delete cookies through your browser settings, but the Platform may not function properly without essential cookies.

The browser extension's access to third-party platform cookies is described in Section 5.2.

14. Your rights

Subject to applicable law, you may:

Access the personal information we hold about you;
Correct inaccurate or incomplete information;
Export your catalog and account data in a commonly used format;
Withdraw consent, as described in Section 7; and
Request deletion of your personal information. We will delete it unless we are required or permitted by law to keep it, for example for tax records.

To make a request, use your account settings or contact our Privacy Officer (Section 18). We may need to verify your identity before responding. We will respond within 30 days, or within any extended period permitted by law, in which case we will tell you.

If you are not satisfied with our response, you may complain to:

the Office of the Information and Privacy Commissioner of Alberta (www.oipc.ab.ca); or
the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

15. Electronic messages

We send service messages such as order confirmations, receipts, subscription and billing notices, and account and security notices. We will send marketing messages only with your consent, and every marketing message will include a way to unsubscribe.

16. Age requirements

The Platform is not directed to children under 16, and we do not knowingly collect their personal information. You must be at least the age of majority in your province or territory to create an account, place an order, operate a Store, or subscribe to our services.

If you believe a child has provided us with personal information, contact our Privacy Officer and we will delete it.

17. Where the Platform is offered

The Platform is intended for users located in Canada. Users located in the United States should use the ShopItUp platform operated by ShopItUp Inc., which is governed by its own terms and privacy policy.

Quebec

Quebec's Act respecting the protection of personal information in the private sector ("Law 25") gives Quebec residents rights in addition to those in Section 14. If you live in Quebec, you may also:

ask us to stop disseminating your personal information, or to de-index a link to it, where the dissemination causes you injury;
ask for the personal information you gave us in a structured, commonly used technological format (portability); and
be told when a decision about you is based exclusively on automated processing, and ask a person to review it.

Decisions we make automatically. These checks apply to everyone who uses the Platform, and are set out here because Law 25 requires us to tell you about them. Some of them run without a person looking first:

Import checks. Automated checks screen the rows you import against our Prohibited and Restricted Items Policy. A rejected row is returned to you with the reason it was rejected.
Listing and image checks. Automated checks screen listings and images. A check can hold an item so it cannot be published or sold, before anyone has reviewed it. A held item goes to our team, and a person decides whether to release it. We email you when an item is held, with the reason, unless the law prevents us from telling you.
Payments. Our payment processor runs automated fraud checks and may decline a payment on its own. We cannot reverse the processor's decision, but you can ask us to look at what happened.

If a decision like this affects you, you can ask for a person to review it and give your point of view: use Feedback & support in your dashboard, or contact our Privacy Officer (Section 18).

The Privacy Officer named in Section 18 is the person responsible for the protection of personal information.

Language. A French-language version of this document is being prepared. In the meantime, this English version applies to the extent permitted by law. Une version française de ce document est en cours de préparation.

18. Contact our Privacy Officer

Questions, requests, and complaints about this Policy or our handling of personal information may be directed to:

Privacy Officer 2837675 Alberta Inc. (ShopItUp) 5-5034 49 Street, Olds, Alberta T4H 1H3 Email: admin@shopitup.ca

19. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice on the Platform before the changes take effect. If a change involves using personal information for a new purpose, we will obtain your consent where required by law.

20. Relationship to our terms

This Policy forms part of the ShopItUp Canada Terms of Service, Terms of Sale, and Seller Agreement, including the subscription terms in Section 10 of the Seller Agreement. It applies alongside our Shipping Policy, Prohibited and Restricted Items Policy, and Listing Reporting and Copyright Notice Policy. It is governed by the laws of the Province of Alberta and the federal laws of Canada that apply there.

Nothing in this Policy or our terms limits your right to complain to the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or any other privacy regulator with jurisdiction.

ShopItUp™ is a trademark of 2837675 Alberta Inc. Poshmark, Depop, eBay, Shopify, Google, Pinterest, Microsoft, and Meta are trademarks of their respective owners. ShopItUp is not affiliated with or endorsed by them.