Superpapers Inc. ("Superpapers", "we", "us", "our") is a corporation incorporated under the Canada Business Corporations Act, with its head office in the Province of Quebec, Canada. We operate the marketing website at superpapers.co and the software application at app.superpapers.co (together, the "Service").
We are committed to protecting personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector (the "Private Sector Act", as amended by Law 25) and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA").
This Privacy Policy explains what personal information we handle, why, who we share it with, where it goes, and the rights you have. Please read it together with our Terms of Service.
1. Two roles — please read this first
Superpapers handles personal information in two distinct roles, and your rights and our obligations differ depending on which applies:
(a) As the responsible party. For personal information about website visitors, prospective customers, our customers, and our customers' staff, Superpapers decides how and why the information is used. We are the party responsible for it under privacy law. Sections 3 through 14 of this Policy describe this information.
(b) As a service provider. When a customer connects their eBay and Shopify accounts to the Service, the Service processes personal information about that customer's own end-customers (for example, the names, addresses, and order details of people who buy cards from the store). For this information, the customer — the game store — is the responsible party, and Superpapers acts only as a service provider processing the information on the customer's behalf and on their instructions. Section 15 describes this. If you are an individual who bought something from a store that uses Superpapers, please direct privacy requests to that store.
2. Scope
This Policy applies to personal information collected through the marketing website (superpapers.co), the application (app.superpapers.co), our forms, our emails, and related communications. It does not apply to third-party websites or services we link to or integrate with, which have their own privacy policies.
3. Personal information we collect as the responsible party
3.1 From website visitors and prospective customers
- Contact and inquiry information you provide through contact forms, demo requests, or newsletter / mailing-list sign-ups: name, business name, email address, phone number, and the content of your message.
- Technical and usage information collected automatically: IP address, browser type, device type, operating system, pages viewed, referring page, and approximate location derived from IP address. See Section 6 (Cookies).
3.2 From customers and their authorized users (account holders)
- Account and identity information: name, business email address, phone number, job title, username, and password (stored in hashed form).
- Business information: business name, business address, the legal form of the business, and similar particulars.
- Billing information: billing contact, billing address, and the records needed to invoice you. Payment card details are collected and stored by our payment processor, not by Superpapers. We receive only limited information such as the card brand, last four digits, and transaction outcome.
- Records of your use of the Service: logins, configuration choices, support requests, and correspondence with us.
3.3 Information from third parties
When you connect a third-party account (such as eBay or Shopify) to the Service, we receive information from those platforms through their APIs as needed to provide the Service. Personal information about your end-customers received this way is handled under Section 15.
4. Why we use personal information (purposes)
We use personal information described in Section 3 to:
- provide, operate, maintain, and secure the Service;
- create and administer accounts and authenticate users;
- calculate and collect fees, including the Variable Platform Fee, and to invoice you;
- respond to inquiries, demo requests, and support requests;
- send service-related communications (for example, billing notices, security alerts, and changes to terms);
- send marketing communications and newsletters where you have consented, and from which you may withdraw at any time;
- understand and improve how the Service is used;
- detect, prevent, and investigate fraud, abuse, and security incidents; and
- comply with legal obligations and enforce our agreements.
We do not use personal information for purposes incompatible with those above without obtaining further consent.
5. Consent
We collect, use, and disclose personal information with your consent, which may be express or, where appropriate and permitted by law, implied by the circumstances (for example, providing your email address in order to receive a reply to your inquiry). For sensitive purposes and for marketing communications, we rely on express consent. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice; withdrawing consent necessary to provide the Service may mean we can no longer provide it.
6. Cookies and tracking technologies
The marketing website uses cookies and similar technologies. These technologies can identify your device and gather information about your activity on the site.
- Strictly necessary technologies are required for the site to function and for security.
- Analytics technologies help us understand site traffic and usage. We use Google Analytics (GA4), a service provided by Google LLC, which sets cookies and processes usage and device data, including IP-derived approximate location, on our behalf.
Your choices. Where required, we present a cookie banner allowing you to accept or decline non-essential cookies; non-essential cookies are not activated until you consent. You may also configure your browser to refuse or delete cookies, and you may opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. Declining non-essential cookies will not prevent you from using the site.
In accordance with the Private Sector Act, we inform you that the Service uses technology capable of identifying, locating, or profiling you (such as the analytics technologies above), and that the cookie banner is the means by which you may activate or deactivate the functions that allow such identification, location, or profiling.
7. How we share personal information
We do not sell personal information. We share it only as described below.
Service providers. We share personal information with third parties that perform services for us, under contracts that require them to protect the information and use it only for the purposes we specify. These include:
- Cloud hosting and infrastructure — Google Cloud Platform (primary region: Montreal, Canada);
- Payment processing — Stripe, for billing and collection of fees;
- Email delivery — our transactional and marketing email provider;
- Analytics — Google LLC (Google Analytics);
- AI processing — providers used to generate certain automated content and summaries within the Service (for example, Google and Anthropic). Content sent to these providers for processing is limited to what is necessary and is not used by them to train their models where their terms so permit.
Integrated platforms. When you connect eBay or Shopify, information is exchanged with those platforms as needed to operate the Service.
Legal and protective disclosures. We may disclose personal information where required by law, court order, or a valid request from a public authority, or where necessary to establish, exercise, or defend legal rights, or to protect the safety, rights, or property of any person.
Business transfers. If Superpapers is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality protections.
8. Transfers of personal information outside Quebec
Some of the service providers and platforms described in Section 7 store or process personal information outside the Province of Quebec, including in the United States. This includes our analytics provider, our AI processing providers, our email provider, our payment processor, and the integrated platforms (eBay, Shopify).
Before transferring personal information outside Quebec, we assess whether the information would receive adequate protection, having regard to the sensitivity of the information, the purposes of its use, the protections in place (including contractual protections), and the legal framework of the destination jurisdiction. Personal information transferred outside Quebec or Canada may be subject to the laws of the destination jurisdiction, including lawful access by foreign authorities. By using the Service you acknowledge these transfers. You may contact our Privacy Officer (Section 17) for more information about a specific transfer.
9. Retention
We keep personal information only as long as necessary for the purposes for which it was collected, or as required by law.
- Inquiry and prospect information: retained while we correspond with you and for a reasonable period afterward, then deleted or anonymized.
- Account and business records: retained for the duration of the account relationship.
- Billing and tax records: retained for the period required by applicable tax and accounting law (generally six years) after the relevant transaction.
- Security and access logs: retained for a limited period for security and troubleshooting.
When personal information is no longer needed, we destroy it or anonymize it in accordance with our retention practices.
10. Security
We take reasonable measures to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These include access controls, encryption in transit, hashed storage of passwords, hosting with a reputable cloud provider, and limiting access to personnel and providers who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Confidentiality incidents
If a confidentiality incident (a breach involving personal information) occurs, we will take reasonable steps to reduce the risk of injury and prevent recurrence. Where the incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the affected individuals as required by law, and we maintain a register of confidentiality incidents.
12. Your rights
Subject to the conditions and exceptions set out in applicable privacy law, you have the right to:
- Access the personal information we hold about you and obtain information about how it is used and to whom it has been disclosed;
- Rectify personal information that is inaccurate, incomplete, or out of date;
- Withdraw consent to the use or disclosure of your personal information;
- Data portability — receive the computerized personal information you have provided to us in a structured, commonly used technological format;
- De-indexing and cessation of dissemination — in certain circumstances, request that we cease disseminating your personal information or that a hyperlink to it be de-indexed; and
- Withdraw from marketing communications at any time, using the unsubscribe link in our emails or by contacting us.
To exercise these rights, contact our Privacy Officer (Section 17). We will respond within the timeframe required by law (generally 30 days). We may need to verify your identity before acting on a request. There is normally no charge, although a reasonable fee may apply for transcription, reproduction, or transmission in limited cases, of which we will inform you in advance.
13. Automated processing
The Service includes automated features, such as pricing suggestions and automatically generated summaries. These features process product and market data, not decisions about individuals. We do not use personal information to render a decision based exclusively on automated processing that produces legal effects or similarly significant effects on an individual. If this changes, we will update this Policy and inform affected individuals of their rights.
14. The Service is not intended for children
The Service is a business tool offered to commercial customers. It is not directed to individuals under the age of majority, and we do not knowingly collect their personal information through the Service.
15. Personal information processed on behalf of our customers
When a customer connects eBay, Shopify, or other accounts to the Service, the Service processes personal information about that customer's end-customers (for example, buyer names, shipping addresses, contact details, and order and purchase history).
For this information:
- the customer (the game store) is the party responsible for the information and determines the purposes for which it is processed;
- Superpapers acts only as a service provider, processing the information solely to provide the Service, on the customer's instructions, and as set out in our Terms of Service;
- we do not use this information for our own purposes, and we do not sell it;
- we apply confidentiality and security measures and require our sub-processors to do the same; and
- if you are an end-customer of a store and wish to exercise privacy rights over your information, please contact the store, which is responsible for it. If you contact us, we will refer your request to the relevant customer.
Customers are responsible for having a lawful basis and appropriate notices and consents in place for the personal information they process through the Service.
16. Changes to this Policy
We may update this Policy from time to time. The "Last updated" date above reflects the most recent version. If we make material changes, we will provide reasonable notice (for example, by email or a notice within the Service) before the changes take effect. Your continued use of the Service after the effective date of an update constitutes acceptance of the updated Policy.
17. Privacy Officer and how to contact us
We have designated a Privacy Officer responsible for ensuring compliance with this Policy and applicable privacy law:
Privacy Officer: Gabriel BonneauEmail:Entity: Superpapers Inc., Province of Quebec, Canada
Please contact the Privacy Officer with any question, request, or concern regarding your personal information.
18. Complaints
If you are not satisfied with how we have handled your personal information or a privacy request, you may file a complaint with the appropriate regulator:
- Commission d'accès à l'information du Québec (CAI) — for matters governed by Quebec's Private Sector Act;
- Office of the Privacy Commissioner of Canada (OPC) — for matters governed by PIPEDA.
We ask that you contact our Privacy Officer first so that we have an opportunity to address your concern directly.
19. Language
This Policy is provided in English at your request and for your convenience. A French-language version is available and, in the event of any inconsistency, the version required by applicable Quebec law governs.