Privacy Policy
The Local · Effective 1 July 2026
This Privacy Policy (the "Policy") explains how personal information is collected, used, disclosed, and protected in connection with The Local mobile application (the "App") and the loyalty and rewards program offered through it (the "Program"). Please read it carefully. Your continued use of the App constitutes acceptance of the version of this Policy then in effect, which supersedes all prior versions.
1. Who we are
The App is provided and operated by Linkify Solutions Inc. ("Linkify", "we", "us", or "our"), a company based in Ontario, Canada, on behalf of The Local by Masrawy Inc. (the "Café"). Linkify is the organization accountable for the personal information collected through the App and is responsible for its handling in accordance with Canada's *Personal Information Protection and Electronic Documents Act* ("PIPEDA"), Quebec's *Act respecting the protection of personal information in the private sector* ("Law 25"), and other applicable privacy laws.
2. Scope
This Policy applies to personal information collected through the App and its supporting servers. It does not govern personal information you provide directly to the Café in store or that the Café processes through its own point-of-sale system, which is handled by the Café and its point-of-sale provider under their own practices, except to the extent described in this Policy. The App does not process payments; purchases are completed in store.
3. Definitions
- "Personal information" means information about an identifiable individual, as defined by applicable privacy law.
- "Member" / "you" means an individual who creates or uses a rewards account in the App.
- "Service provider" / "subprocessor" means a third party that processes personal information on our behalf under contract.
- "Program" means the loyalty and rewards program described in our Terms of Service.
4. Personal information we collect
We collect only the personal information reasonably necessary to operate the App and the Program, from the following sources and categories:
(a) Information you provide. Your first name, email address, and mobile phone number; and, if you choose, your date of birth and preferred language. When you contact us for support, we collect the information in your communication.
(b) Authentication information. We authenticate you using a one-time passcode sent to your email. We do not use passwords, and the App does not offer third-party or social-media login.
(c) Loyalty and account information. Your member number, points earned and redeemed, rewards claimed, and the purchase information associated with your member QR code when it is scanned at the Café's point-of-sale. This is processed through the Café's point-of-sale and customer loyalty provider, Clover.
(d) Approximate location. If you grant permission, we use your device's approximate location, only while you are using the App, to identify the nearest branch. Location data is used solely to answer that request and is not stored. You may decline or withdraw this permission at any time; the App remains usable without it.
(e) Notification and wallet identifiers. If you enable notifications, a device push token. If you add your member card to Apple Wallet or Google Wallet, a wallet pass containing your member identifier and a rotating barcode, together with the device tokens needed to keep the pass current.
(f) Technical and device information. Information needed to operate and secure the App, such as device type and model, operating system version, application version, language preference, IP address, session information, and diagnostic logs.
(g) Update-service identifiers. To deliver application updates, a per-installation identifier and, where you are signed in, your account identifier are transmitted to our self-hosted update service.
5. How we use your information
We use personal information for the following purposes:
a) to create, administer, and secure your rewards account and member card; b) to authenticate you by one-time passcode; c) to calculate, display, and enable redemption of points and rewards; d) to provide App features such as the nearest branch, menu, promotions, and events; e) to generate and maintain wallet passes, including rotating barcodes that help prevent fraudulent reuse; f) to send transactional communications, such as one-time passcodes and account or loyalty notices; g) to operate, maintain, troubleshoot, secure, and improve the App and the Program, including error and crash diagnostics; h) to detect, prevent, and address fraud, abuse, and security incidents; and i) to comply with our legal obligations.
6. Consent
We collect, use, and disclose your personal information with your consent, except where applicable law permits or requires otherwise. By providing your information and using the App, you consent to the practices described in this Policy. Depending on the sensitivity of the information and the circumstances, consent may be express or implied. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by adjusting your device or App settings or by contacting us; withdrawing consent may limit your ability to use certain features or the Program.
7. Cookies and similar technologies
The App is a native mobile application and does not use web cookies or web-based tracking pixels. It uses on-device storage (such as a secure token store and local caches) strictly to provide App functionality, and the update-service identifiers described in Section 4(g). We do not use these technologies to build advertising profiles or to track you across other apps or websites.
8. Advertising, tracking, and analytics
We do not display advertising in the App. We do not use your personal information for third-party advertising or to track you across other applications or websites, and the App does not integrate advertising networks, data brokers, or third-party analytics software. Accordingly, the App does not present an App Tracking Transparency prompt, and we do not collect an advertising identifier.
9. Error and crash diagnostics
To keep the App reliable, we use a self-hosted error and crash reporting tool (GlitchTip), operated by Linkify on our own infrastructure. When the App encounters an error or crash, it may transmit technical diagnostic information — such as the error type and stack trace, application version, device model, operating-system version, and the sequence of non-sensitive events leading up to the error — to help us diagnose and fix problems. We configure this tooling to minimize personal information, and we do not use it for advertising or tracking. Because it is self-hosted, this diagnostic data is not shared with any third-party analytics provider.
10. How we disclose your information
We disclose personal information only as necessary for the purposes described in this Policy, and only to the following categories of recipients, each permitted to use the information solely to perform its function on our behalf or as required by law:
- The Café (The Local by Masrawy Inc.) — so that it may administer the Program and recognize you in store.
- Clover — the Café's point-of-sale and customer loyalty system, which receives your name, email address, and phone number and associates your in-store purchases and loyalty activity.
- Apple and Google — for App distribution, push notification delivery (APNs/FCM), and wallet passes.
- Cloudflare — for delivery of our transactional email; your email address and message content pass through Cloudflare's email service, which our self-hosted email system uses to transmit messages.
- Oracle Cloud Infrastructure — our cloud hosting provider, for the secure storage and operation of our servers.
We do not sell your personal information. We may also disclose personal information where required or permitted by law — including to regulators, law enforcement, or governmental authorities — or in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, subject to appropriate protections.
11. Transfers outside your province and Canada
Some of our service providers store or process personal information outside of your province of residence and outside of Canada, including in the United States. Where this occurs, the information may be subject to the laws of those jurisdictions, including lawful access by their courts, law enforcement, and national-security authorities. We take reasonable steps, including contractual safeguards, to ensure your personal information receives a comparable level of protection wherever it is processed. If you are a Quebec resident, we confirm that your personal information may be communicated outside Quebec as described here.
12. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing of your personal information. Points and rewards are administered according to the published rules of the Program.
13. Security safeguards
We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure — including encryption in transit, restricted access, one-time-passcode authentication, and rotating wallet barcodes to deter pass fraud. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Data breach notification
If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will assess the incident and notify affected individuals and the appropriate regulators — including the Office of the Privacy Commissioner of Canada and, for Quebec residents, the Commission d'accès à l'information — as required by applicable law, and we will maintain records of such incidents.
15. Retention and deletion
We retain your personal information for as long as your account remains active and as necessary to provide the Program, and thereafter only as required to meet our legal obligations.
You may delete your account at any time within the App (Profile → Delete Account). When you request deletion, we deactivate your account immediately and permanently delete your personal information from our systems within 30 days, except where retention is required by law. During this period you may sign in to restore your account; if you do not, the deletion becomes permanent. We do not automatically delete accounts on the basis of inactivity.
Uninstalling the App does not delete your account, because we are not notified when an application is removed from a device. To delete your account and associated personal information, please use the in-App deletion feature.
Certain business records maintained by the Café in its own point-of-sale system (Clover) are controlled and retained by the Café, as a separate organization, in accordance with the Café's business, accounting, and legal obligations, and are not within our control. When you delete your account, we remove the association between you and any records held on our systems.
16. Aggregated and de-identified information
We may create and use aggregated or de-identified information that does not identify you (for example, counts and statistics about App usage or Program performance). Such information is not personal information and may be used and retained for any lawful purpose.
17. Your rights and choices
Subject to applicable law, you have the right to:
a) access the personal information we hold about you and obtain information about how it is used and disclosed; b) correct inaccurate or incomplete personal information; c) withdraw consent to our collection, use, or disclosure of your personal information, or to notifications or location access, at any time; d) delete your account and personal information, as described in Section 15; e) data portability — where required by applicable law, receive the computerized personal information you have provided to us in a structured, commonly used technological format; and f) make a complaint about our handling of your personal information.
To exercise any of these rights, contact us using the details in Section 24. We will respond within the time required by applicable law (generally within 30 days under PIPEDA). We may need to verify your identity before acting on a request.
18. How to update your information
You can review and update your name, email, phone number, birthday, and language preference in the App at any time (in your profile settings). For other changes, contact us.
19. Marketing communications
We currently send only transactional messages (such as one-time passcodes and account or loyalty notices), which are not marketing. If we introduce commercial electronic messages (such as offers, events, or news) in the future, we will send them only with your consent, will identify ourselves as the sender, and will include a functioning unsubscribe mechanism that we honour promptly (within the time required by Canada's Anti-Spam Legislation, "CASL"). You can also manage notification preferences in the App and your device settings.
20. Children
The App is not directed to children under the age of 13, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 13, we will take steps to delete it.
21. Third-party links and services
The App may link to or interoperate with third-party services (such as Apple Wallet, Google Wallet, map applications, or the Café's website). Those services are governed by their own terms and privacy policies, and we are not responsible for their practices.
22. Accessibility and languages
We aim to provide this Policy in clear, plain language. It is available in English; a copy in an accessible format is available on request. Where we serve users in a given language or jurisdiction, we will make this Policy available as required by applicable law.
23. Quebec residents (Law 25)
If you reside in Quebec, the following applies in addition to the rest of this Policy:
- Person responsible for the protection of personal information (Privacy Officer): the individual identified in Section 24 is responsible for our compliance with Law 25.
- Consent and purposes: we identify the purposes for which we collect personal information at or before the time of collection and obtain consent as required.
- Cross-border communication: as noted in Section 11, your personal information may be communicated and processed outside Quebec, subject to appropriate safeguards.
- Automated decisions: as noted in Section 12, we do not make decisions about you based exclusively on automated processing.
- Additional rights: in addition to the rights in Section 17, you may, where applicable, request that we cease disseminating your personal information or de-index information where its dissemination contravenes the law or a court order, and you may receive information you provided to us in a portable format.
24. Complaints and how to contact us
If you have questions, requests, or complaints about this Policy or your personal information, please contact our Privacy Officer:
Privacy Officer, Linkify Solutions Inc. — operator of The Local rewards app Email: info-thelocal@linkifysolutions.com Mail: 2275 Britannia Rd W, Units 19 & 20, Mississauga, Ontario, L5M 2G6, Canada
If we are unable to resolve your concern, you may escalate to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). Residents of British Columbia and Alberta may contact their respective provincial privacy commissioners.
25. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be posted here with an updated effective date and, where appropriate, communicated within the App; where required by law, we will obtain renewed consent.