Privacy policy

FORESTLY — PRIVACY POLICY

Effective date: Nov 3, 2026 (03/11/2026) Last updated: Nov 3, 2026 (03/11/2026) Operator: [Forestly] Business address: [London, Ontario, Canada] Privacy contact: [privacy@forestly.org]

1. Introduction

Welcome to Forestly.

Forestly ("Forestly," "we," "us," or "our") operates a digital platform designed to help people discover local businesses, restaurants, shops, services, entertainment, community events, and employment opportunities.

We respect your privacy and are committed to protecting personal information in accordance with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), where applicable.

This Privacy Policy explains what information we collect, why we collect it, how it may be used or disclosed, how long we retain it, and the choices available to you.

Our central commitments:

• We do not sell identifiable user profiles, personal contact details, individual browsing histories, precise location histories, or job application materials.
• We may create and commercially license aggregated market insights only with appropriate privacy protections and, where required, your separate consent.
• We do not provide businesses with the identities of individual users who merely view or interact with their listings.
• We do not make optional commercial analytics or marketing consent a requirement for using Forestly's core discovery features.
• We provide mechanisms for accessing, correcting, and requesting deletion of your personal information.

2. Scope of This Policy

This Policy applies when you:

• Visit or use the Forestly website or mobile applications.
• Create an account or business profile.
• Search for, watch, save, or interact with listings and videos.
• Browse events or employment opportunities.
• Contact Forestly, subscribe to communications, or purchase services.
• Represent a business, employer, advertiser, or event organizer using Forestly.

This Policy does not govern independently operated external websites, employers, event organizers, payment services, or other third parties that process your information for their own purposes.

3. Information We Collect

3.1 Information you provide

Depending on the features you use, this may include:

• Name or chosen display name.
• Email address and optional contact information.
• Account authentication credentials or authentication identifiers.
• City or preferred search location.
• Business names, addresses, categories, opening hours, and contact details.
• Photos, videos, reviews, descriptions, and other submitted content.
• Support requests, complaints, and communications.
• Billing and transaction details associated with paid services.

Payment information may be handled by an authorized payment-processing provider. Forestly will not collect or store full payment-card numbers directly unless we have separately established appropriate security and payment-processing arrangements.

3.2 Information collected during platform use

When you interact with Forestly, we may collect:

• Pages and listings viewed.
• Search terms and selected categories.
• Video views, playback duration, and interactions.
• Businesses and events saved or favourited.
• Clicks on websites, maps, contact options, and advertisements.
• Dates, times, and general frequency of interactions.
• Device type, browser, operating system, IP address, and technical logs.
• Cookie or similar identifiers, subject to applicable consent requirements.

We use information reasonably necessary to provide requested features, protect the platform, and maintain its performance.

Additional optional analytics and advertising activities are subject to the choices described in Section 5.

3.3 Location information

Forestly may use a location you manually select or an approximate area inferred from technical information, such as an IP address, to display relevant results.

We will request permission before accessing precise device location when required. You may disable precise location access through your device settings and use manual location searches instead.

We do not sell individual precise location histories.

3.4 Information from businesses and third parties

We may obtain business information from business representatives, authorized partners, and lawful publicly available sources.

We may also receive limited information from service providers necessary to support transactions, security, or platform operation.

We will not assume that publicly available personal information may be collected or reused without restriction.

3.5 Sensitive information

Forestly is not designed to collect sensitive personal information such as government identification numbers, detailed medical information, financial account credentials, religious beliefs, or political affiliations for advertising purposes.

Please avoid placing such information in public profiles, reviews, or communications unless specifically necessary for a clearly disclosed service.

We will not deliberately use sensitive personal information or sensitive inferences for commercial market reports or behavioural advertising.

4. How We Use Information

We use personal information for identified and appropriate purposes, including:

Providing Forestly services: Maintaining accounts, displaying business listings, remembering preferences, processing requested interactions, and operating search and discovery features.

Personalizing discovery: Using selected locations, categories, and relevant in-app interactions to improve recommendations, where appropriately disclosed and permitted.

Communication: Responding to support requests, account inquiries, payments, safety concerns, and important service updates.

Security and fraud prevention: Detecting unauthorized access, false business listings, fraudulent employment advertisements, abuse, and technical threats.

Payments and administration: Managing purchases, billing, tax records, refunds, and contractual obligations.

Internal improvement: Measuring platform performance and understanding which features function effectively.

Optional commercial insights: Where the required separate consent has been obtained, using eligible interaction information to develop privacy-protected, aggregated reports for business customers.

Optional advertising and marketing: Delivering personalized advertising or promotional communications where permitted by law and your applicable choices.

We do not use your information for materially new purposes without providing any additional notice or consent required by law.

5. Analytics, Advertising, and Commercial Data Insights

5.1 Internal platform analytics

Forestly may measure basic activity, such as total listing visits, navigation errors, and service performance, to operate, secure, and improve the platform.

We distinguish this operational activity from optional tracking, personalized advertising, and commercial data products.

5.2 Commercial market insights

Forestly may offer businesses and organizations reports about broader market trends.

Examples include:

• Categories of restaurants receiving increased interest.
• Popular types of entertainment in a city.
• General trends in local business discovery.
• Aggregated engagement with promotional content.
• Broad consumer-interest trends within sufficiently large geographic or demographic groups.

We will not provide buyers with individual-level browsing records, identifiable user profiles, precise location trails, or lists of people associated with particular searches.

Where we use identifiable interaction information for the purpose of creating market insights sold or licensed to third parties, we will obtain separate, meaningful consent as required by applicable law.

Where information cannot be adequately anonymized or aggregated to reduce identification risks to an acceptable level, it will not be included in externally supplied reports.

We will apply appropriate safeguards, including minimum reporting thresholds, suppression of small groups, and restrictions on attempts to re-identify individuals.

Commercial insight customers must not attempt to identify individuals, combine reports with other information to do so, or use the reports for discriminatory or unlawful purposes.

5.3 Business performance dashboards

Businesses may receive aggregated information about interactions with their own Forestly listings, such as:

• Number of profile views.
• Video views.
• Website or contact-button clicks.
• General engagement totals.

These dashboards will not reveal the identity of an individual merely because that person viewed or saved a business.

If a user expressly contacts a business or chooses to share information with it, the business may receive the information necessary for that interaction.

5.4 Personalized advertising

Forestly may display contextual or sponsored advertising.

If we introduce advertising that tracks users across websites or applications, uses optional profiling, or discloses personal information to advertising partners for their independent purposes, we will provide appropriate prior notice, consent choices, and withdrawal mechanisms.

We will not treat agreement to this Privacy Policy alone as authorization for all such activities.

5.5 Your analytics choices

Where optional tracking or commercial data use requires consent, Forestly will provide separate, understandable controls.

These may include choices for:

• Optional product analytics.
• Use of eligible interaction information for aggregated commercial market reports.
• Personalized advertising or third-party advertising tracking.
• Promotional emails and communications.

Declining optional purposes will not prevent you from using Forestly's essential discovery functions.

You may withdraw consent through [https://forestly.org/privacy] or by contacting our Privacy Officer.

Withdrawal will apply prospectively, subject to applicable legal requirements and limitations concerning information previously processed lawfully.

6. Cookies and Similar Technologies

Forestly may use cookies and comparable technologies for:

• Essential functionality, authentication, and security.
• Remembering preferences.
• Optional performance analytics.
• Optional advertising and personalization.

Essential technologies required to operate requested services may remain active.

Where consent is required, non-essential tracking technologies will not be activated until the appropriate consent is obtained.

You may change applicable preferences through [https://forestly.org/privacy].

A supplementary cookie notice will identify actual technologies, providers, purposes, and retention periods used by Forestly.

7. Employment Information and Job Applications

Forestly may display employment opportunities submitted by third-party businesses or employers.

Under Forestly's initial direct-application model, selecting an option to email or visit an employer redirects you to an external email service or application website.

Information that you send directly to an employer is received by that employer and handled according to the employer's own privacy practices.

Forestly does not automatically receive or store the contents of applications sent outside our platform merely because you followed a Forestly link.

We will not sell individual employment applications, résumés, or applicant contact details.

If Forestly later introduces hosted applications, résumé storage, employer messaging, or applicant-matching services, we will provide additional privacy disclosures and required choices before collecting or sharing the associated information.

Employers receiving personal information through Forestly are independently responsible for complying with applicable employment, human rights, and privacy laws.

8. Information Sharing and Disclosure

We may disclose information to the following categories of recipients where appropriate:

Service providers: Hosting, infrastructure, authentication, customer support, analytics, security, email delivery, and payment providers operating under appropriate contractual protections.

Businesses and employers: Information you intentionally submit to or share with a business, such as an inquiry or contact request.

Advertising and analytics partners: Only information and access permitted by applicable privacy law and relevant consent choices, with aggregate reporting preferred.

Government authorities and legal recipients: Where required or otherwise permitted by law.

Corporate transaction participants: Where information must lawfully be disclosed as part of a merger, acquisition, financing, or business restructuring, subject to applicable protections.

Service providers may process information only for authorized purposes, unless their separately disclosed role and lawful permissions provide otherwise.

Forestly remains accountable for personal information under its control, including information transferred to service providers for processing.

9. Public Content and Visibility

Business listings, public reviews, uploaded promotional content, and other information designated as public may be visible to other users and search engines.

Your personal email address, private account information, and non-public activity history will not be displayed publicly by default.

Information you deliberately publish may be copied or accessed by others. Forestly cannot guarantee removal of copies independently retained by third parties.

10. Marketing Communications

Forestly may send essential service messages, including security notices, transaction confirmations, and requested account communications.

Commercial electronic messages will comply with Canada's Anti-Spam Legislation (CASL), where applicable.

We will obtain consent where required, identify the sender, provide required contact information, and include a functioning unsubscribe mechanism.

You may unsubscribe from promotional communications without closing your account.

11. Data Storage and International Processing

Forestly's primary service providers and storage locations are: • Cloudflare, Inc. (USA): hosts the website and API (Workers), the database (D1), résumé files (KV) and first-party analytics. Cloudflare serves from its global network, so data may be processed in several countries. D1 stores data in the region Cloudflare picks for the database. • Resend (USA): sends account, verification and application emails. • GitHub, Inc. (USA): stores approved business images in the forestly-media repo. • Meta / Instagram (USA): reel embeds, loaded only when a user taps play. • Cloudflare Turnstile: bot protection on forms and sign-up. It falls under Cloudflare above.

Personal information may be processed outside Canada where operationally necessary and legally permitted.

In such circumstances, information may be subject to lawful access by authorities in the relevant jurisdiction.

We will use appropriate contractual, organizational, and technical protections for international processing and provide any additional notices required by applicable law.

12. Information Security

We maintain safeguards appropriate to the sensitivity of the personal information under our control.

These safeguards will include documented administrative, technical, and physical security measures, such as Information Security and Data Protection

Forestly is committed to protecting the personal information entrusted to us through reasonable administrative, technical, and physical security measures appropriate to the sensitivity of the information.

Our security program is designed to include the following safeguards:

• Account Security: Secure authentication, password hashing, and additional verification for sensitive account activities.
• Data Encryption: Encryption of personal information during transmission using HTTPS/TLS, with encryption at rest where appropriate.
• Access Controls: Role-based permissions restricting access to personal information to authorized personnel and service providers.
• Secure Data Storage: Protected databases and hosting infrastructure with appropriate security configurations.
• Backups and Recovery: Secure backups and recovery procedures to reduce the risk of accidental data loss.
• Security Monitoring: Logging, monitoring, and investigation of suspicious activities and potential unauthorized access.
• Business Verification: Verification procedures designed to prevent unauthorized individuals from claiming or modifying business listings.
• Incident Response: Procedures for investigating security incidents and providing notifications when required by applicable law.
• Data Minimization: Collecting and retaining only personal information reasonably necessary for identified purposes.

We periodically assess our security practices and update them as reasonably necessary to address evolving risks.

Although Forestly takes reasonable precautions to safeguard personal information, no method of electronic transmission or storage can be guaranteed to be completely secure.

In the event of a security breach, Forestly will take appropriate investigative and remedial action and comply with applicable notification and recordkeeping requirements under Canadian privacy legislation.

Access to personal information will be limited to people and service providers who require it for authorized activities.

No electronic service can guarantee absolute security.

Where a security breach occurs, Forestly will investigate, maintain required records, and notify affected individuals and regulators where required by applicable law.

13. Data Retention

Forestly retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, prevent fraud, and maintain the security of our platform.

Our operational retention schedule is as follows:

Information Category| Retention Period Account information| For the duration of the account's activity, with deletion ordinarily completed within 30 days of account closure, unless continued retention is legally required or justified. Identifiable usage records| Up to 90 days after collection, after which the records are deleted or appropriately anonymized. Technical logs| Up to 90 days after collection for troubleshooting and performance monitoring. Security logs| Up to 12 months for fraud detection, security investigations, and account protection. Business records and transactions| Generally six years from the end of the last applicable tax year, or longer where required by law. Consent and compliance records| For as long as Forestly relies on the consent or record, followed by an appropriate documented retention period based on applicable legal obligations. Support communications| Up to two years after the support request is resolved, unless longer retention is necessary for legal or security purposes. Backup data| Normally deleted or overwritten within 90 days according to scheduled backup rotation procedures. Security breach records| At least 24 months after Forestly determines that a breach occurred, or longer where legally required.

Account Deletion

Users may request deletion of their Forestly accounts and associated personal information. Upon receiving a valid deletion request, Forestly will ordinarily complete deletion of eligible information from active systems within 30 days.

Certain information may be retained where reasonably necessary to meet legal obligations, maintain financial records, investigate fraud, resolve disputes, or protect the platform.

Anonymized Information

Forestly may retain information that has been appropriately anonymized so that individuals are no longer reasonably identifiable.

Such information may be used for statistical analysis, business intelligence, and aggregated market reporting, provided its continued use complies with applicable law and Forestly's Privacy Policy.

Backup Systems

Personal information removed from active systems may remain temporarily in protected backups until the applicable backup-retention period expires.

Restored backups will be subject to applicable deletion requests and retention controls.

Legal and Regulatory Exceptions

Forestly may retain specific information longer where required or permitted by applicable law, including legal proceedings, tax obligations, regulatory investigations, and security incidents.

Once personal information is no longer required, Forestly will securely delete, destroy, or appropriately anonymize it using procedures designed to prevent unauthorized recovery or access.

Upon expiry of the applicable retention period, information will be deleted or appropriately anonymized, unless further retention is legally required or permitted.

We will not retain identifiable interaction histories indefinitely merely because they may have future commercial value.

14. Your Privacy Rights

Subject to applicable law, you may request to:

• Access personal information held about you.
• Correct inaccurate or incomplete information.
• Withdraw consent for optional activities.
• Request deletion of information no longer required for lawful purposes.
• Obtain information about our collection, use, and disclosure practices.
• Challenge our compliance with applicable privacy law.

To submit a request, contact [https://forestly.org/privacy].

We may take reasonable steps to verify your identity before responding.

We will respond within the time required by applicable law and explain any lawful limitation on a request.

You may also submit a complaint to the Office of the Privacy Commissioner of Canada where it has jurisdiction.

15. Children and Age Restrictions

Forestly is designed to help people of all ages discover local businesses, restaurants, entertainment, community events, activities, and employment opportunities.

We welcome children and teenagers to use Forestly, subject to age-appropriate safeguards and applicable privacy laws.

Children Under 13

Children under the age of 13 may browse age-appropriate public content on Forestly.

Where creating an account or accessing a feature requires the collection, use, or disclosure of a child's personal information beyond legally permitted exceptions, Forestly will obtain verifiable parental or guardian consent before enabling that feature.

Parents and legal guardians may request access to, correction of, or deletion of their child's personal information, subject to applicable law.

Teenagers Aged 13–17

Teenagers may create and use Forestly accounts where appropriate meaningful consent can be obtained in accordance with applicable law.

Forestly will provide clear, age-appropriate privacy explanations and seek parental or guardian involvement where legally required or appropriate to the sensitivity of the activity.

Protection of Minors' Information

For users under 18, Forestly will apply enhanced privacy protections:

• We will not sell identifiable personal information belonging to minors.
• We will not use minors' personal information for targeted or behavioural advertising.
• We will not include identifiable or linkable information about minors in commercial market-insight products.
• Personal profiles will be private by default.
• Precise location collection and public location sharing will be disabled by default.
• We will limit the collection of personal information to what is reasonably necessary to provide permitted services.
• We will provide appropriate account deletion, privacy, and reporting mechanisms.

Paid Services and Business Accounts

Children may browse business listings, events, and age-appropriate employment opportunities.

Business ownership verification, paid advertising accounts, and commercial subscription agreements are restricted to adults or legally authorized representatives with the necessary contractual authority.

Parental Rights and Contact

Parents and guardians may contact Forestly at [forestly.org/privacy] with questions or requests concerning their child's personal information.

If we discover that personal information has been collected from a child without the consent required by law, we will take appropriate steps to restrict further processing and delete the information or obtain valid authorization where legally permitted.

Forestly will maintain reasonable measures designed to protect children's privacy and safety and will review these protections as applicable laws and our services evolve.

16. Automated Recommendations and Artificial Intelligence

Forestly may use automated tools to organize search results, recommend businesses, detect suspicious listings, or assist with platform operations.

Automated recommendations do not represent guarantees of quality, suitability, employment, or eligibility.

Forestly's initial service does not make hiring decisions for employers.

If we introduce materially different AI-assisted processing of personal information, we will assess its privacy implications and provide required disclosures and choices.

17. Third-Party Services

Forestly may link to third-party websites, businesses, ticketing providers, maps, social networks, and external application services.

Those services operate under their own terms and privacy practices.

We encourage users to review their notices before supplying personal information.

18. Updates to This Policy

We may update this Policy to reflect changes in our services, applicable laws, security practices, or information-handling activities.

We will publish the revised Policy with an updated effective date.

For material changes, particularly those involving new uses or disclosures of personal information, we will provide notice and obtain additional consent where required.

19. Contact and Privacy Officer

Forestly Privacy Officer [Forestly] [Forestlysupport@gmail.com] Website: [forestly.org]

Users may contact the Privacy Officer regarding questions, complaints, consent withdrawal, access requests, or the handling of their personal information.