Privacy Policy

1. Who is responsible for your information

The data controller is MM Creatives, a sole proprietorship based in Ontario, Canada, trading as Bartender Stories. Our privacy contact is bartenderstories1@gmail.com. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for visitors in the European Economic Area, the UK and Switzerland, the General Data Protection Regulation (GDPR) and equivalent local laws.

We have not appointed a Data Protection Officer because our processing does not meet the thresholds that require one. Privacy questions and requests go directly to the contact above.

2. Scope of this policy

This policy applies to bartender-stories.com and to accounts, profiles, published content, CVs, uploads and messages handled through the service. It does not apply to third-party websites, social networks or services we link to, which have their own privacy policies.

3. What we collect

We collect the following categories of information:

• Account details: your name, username, email address and a hashed version of your password. We never store your password in plain text.
• Profile details you choose to add: avatar, tagline, biography, location, website and social media links.
• Content you publish: stories, cocktail recipes, ingredient entries, articles and CVs. A CV may include employment history, education, skills, languages, certifications and contact details you decide to include.
• Uploaded files: images you upload for your avatar, content, CV or profile.
• Technical and security data: IP address, browser and device information, session identifiers, CSRF tokens, timestamps, failed login counts and account lock information.
• Communications: emails and messages you send us, password reset requests, reports and moderation correspondence.
• Preferences: language, volume unit and your cookie consent choice, stored in your browser.
• Analytics data, only if you accept analytics: pages viewed, approximate location derived from IP, device and browser type, referral source, and interactions with the site.
• Advertising data, only if you accept optional cookies: cookie and device identifiers, approximate location, browser and device information, and ad impressions or interactions collected by Google AdSense.
• Payment and billing data, if you buy a paid feature in future: handled by our payment processor. We receive confirmation, amounts and limited billing details but never your full card number.

We do not intentionally collect special categories of data such as health information or precise geolocation. Please do not publish them. If you include sensitive information in your profile, content or CV, you do so voluntarily and it becomes public if that field is public.

4. Why we use your information and our legal bases

We use personal information to:

• create and manage your account and provide the service (performance of a contract);
• publish the content, profile and CV you choose to make public (performance of a contract or your consent, depending on the visibility setting);
• keep the service secure, prevent fraud, spam and abuse, and enforce our terms (our legitimate interests and, where applicable, legal obligations);
• moderate content, handle reports and respond to legal requests (our legitimate interests and legal obligations);
• respond to your questions, privacy requests and support messages (our legitimate interests and performance of a contract);
• measure and improve the service through analytics, only with your consent;
• display and measure the optional AdSense banner, only with your consent;
• comply with tax, accounting and other legal obligations if paid features are introduced (legal obligation);
• send service messages such as password resets and security notices (performance of a contract);
• send marketing emails only if you opt in, with an unsubscribe link in every message (consent under Canadian anti-spam law and, where applicable, GDPR).

Where we rely on legitimate interests, we balance those interests against your rights and expectations, and you may object as described in section 10.

5. Cookies and similar technologies

We use a small number of cookies and browser storage entries. Analytics cookies are set only after you accept them in our consent banner. The Cookie Policy lists every cookie and storage key we use, its purpose and its lifetime.

6. Who we share information with

We share personal information only as needed:

• Hosting provider: Hostinger, which hosts the site, database and uploaded files and may process technical logs on our behalf.
• Email delivery providers: our SMTP mailbox provider and, if configured, Resend, to deliver password reset and service emails.
• Google Analytics: only if you consent to analytics, to produce aggregated statistics about site usage.
• Google AdSense: only if you accept optional cookies, to display and measure the small banner at the foot of the home page. Google may set cookies and act as an independent controller for advertising data; see Google’s privacy policy.
• Payment processor: if paid features are introduced, to process payments and handle refunds.
• Professional advisers, insurers and auditors, where necessary and under confidentiality obligations.
• Authorities, courts or other parties: where required by law, to respond to lawful requests, to protect our rights, property or safety, or to investigate fraud or abuse.
• A successor organisation: if we sell or transfer the business or its assets, subject to equivalent privacy protections.

We do not sell your personal information. We do not share it for cross-context behavioural advertising, except through Google advertising services with your consent where required.

7. International transfers

Our service providers may process personal information in Canada, the European Union, the United Kingdom and the United States. Where information collected in the EEA or UK is transferred outside those regions, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, the UK Addendum, and contractual confidentiality and security commitments.

Canada does not currently benefit from a general GDPR adequacy decision, so transfers from the EEA to Canada rely on those safeguards. You may request a copy of the relevant safeguards by contacting us.

8. How long we keep information

• Account and profile data: while your account is active, and for up to 30 days after deletion while it is removed from backups.
• Published content: until you delete it or your account, subject to copies held in caches, search engines and backups, and to legal retention requirements.
• Sessions: 30 days from sign-in, unless you sign out or change your password.
• Password reset tokens: 2 hours, and they can be used only once.
• Server and security logs: normally no longer than 30 days, unless needed to investigate an incident.
• Analytics data: 14 months in Google Analytics, after which it is deleted or aggregated.
• Reports, moderation and legal records: as long as needed to handle the matter and to comply with legal obligations.
• Tax and accounting records: 7 years, if paid features are introduced.

When information is no longer needed, we delete it or anonymise it. Some information may remain in backups for a limited period and in copies made by other people or search engines, which we cannot control.

9. Security

We protect personal information with technical and organisational measures including TLS encryption in transit, hashed passwords, httpOnly session cookies, access controls, login lockouts and restricted server access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach creates a risk to your rights, we will notify you and the relevant authorities as required by law.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your account and personal information, subject to legal retention requirements;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing that already took place;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not make such decisions);
• complain to a supervisory authority.

To exercise any right, email bartenderstories1@gmail.com from the address linked to your account. We may need to verify your identity before acting. We respond within 30 days, or one month for GDPR requests where an extension is permitted.

You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you are in the EEA, you can complain to your local supervisory authority, for example the Garante per la protezione dei dati personali in Italy; in the UK, the Information Commissioner’s Office.

11. Deleting your account and content

You can delete individual items from your dashboard and delete your entire account from your account settings. Deleting your account removes your profile and the content we hold that belongs to you, except where we must keep records for legal, tax or security reasons, or where content has been copied or cached by third parties.

If you cannot sign in, email us and we will help you delete the account, subject to identity verification.

12. Children

The service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that a minor has created an account, we will delete the account and associated information. If you believe a minor is using the service, contact us.

13. Marketing messages

We do not currently send marketing emails. If we do, we will ask for your consent in accordance with Canada’s Anti-Spam Legislation and applicable EU rules, identify ourselves in every message, and include a working unsubscribe link. Withdrawing consent does not stop service messages such as password resets, security notices or responses to your requests.

14. Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects. Automated security measures, such as temporary login lockouts after repeated failed attempts, are used only to protect accounts and are not used to evaluate you.

15. Changes to this policy

We may update this policy to reflect changes in our practices, technology or the law. The current version is always on this page with its date. For material changes we will notify registered users by email or with a prominent notice on the site before the change takes effect.

16. Contact us

Privacy questions and requests: bartenderstories1@gmail.com.

Postal requests can be sent to MM Creatives, Ontario, Canada; please email first so we can confirm the correct mailing address and handle your request promptly.