Effective: March 27, 2026
What we collect
We collect data when you create an account, make purchases, use the marketplace, participate in communities, manage your collection, and contribute canonical data to the platform.
- Account data — email, username, date of birth, password hash, avatar, profile info
- Purchase data — order history, payment method (via Stripe, we never see your full card number), shipping addresses
- Marketplace data — listings, transactions, seller performance, dispute history
- Community data — posts, votes, comments, reports, moderation actions
- Collection data — items you own, wishlist, condition notes, purchase prices
- Canonical data — product info, character data, fandom contributions you make to the catalog
- Device and usage data — IP address, browser type, pages visited, search queries, interaction patterns
How we use it
- Running the platform — processing orders, managing accounts, delivering features
- Personalization — recommendations, search ranking, content you see
- Fraud detection — identifying suspicious patterns, protecting buyers and sellers
- Reputation scoring — building trust tiers for marketplace participants
- Gamification — tracking XP, badges, streaks, quests, leaderboards
- Communications — order confirmations, security alerts, optional marketing (you control this)
Machine learning and automated processing
We use machine learning for product recommendations, search relevance, content tagging, fraud detection, and trend analysis. Where possible, data is aggregated and anonymized before processing. Automated decisions that significantly affect your account (like fraud flags) are always reviewed by a human.
Who we share with
We don't sell your data. Period.
- Stripe — payment processing (they're both processor and controller for fraud prevention)
- Marketplace participants — limited data necessary for transactions (shipping address to sellers after purchase)
- Service providers — hosting (Vercel), database (Neon), search (Typesense), bot protection (Vercel BotID)
- Law enforcement — only when legally required, with valid legal process
- Community moderators — limited to content they moderate (posts, reports)
How long we keep it
- Account data — for the lifetime of your account plus a reasonable wind-down period
- Transaction data — as required by tax law (typically 7 years)
- Canonical data — indefinitely (it becomes part of the platform's knowledge base)
- Usage data — aggregated after 24 months
Data security
Encryption in transit and at rest. Multi-factor authentication available. Role-based access controls internally. Regular security audits. No system is 100% secure, but we take this seriously.
Your rights
Under PIPEDA and Quebec Law 25, you have the right to:
- Access your personal data
- Correct inaccurate information
- Request deletion of your data
- Data portability (receive your data in a usable format)
- Withdraw consent for non-essential processing
- File a complaint with the Privacy Commissioner of Canada
Children's privacy
This platform is not directed at children under the age of majority. We don't knowingly collect data from minors without parental consent. If you believe a minor has created an account, contact us immediately.
International transfers
Your data may be stored and processed outside of Canada (our infrastructure uses Vercel and Neon, both US-based). Appropriate safeguards are in place to protect your data regardless of where it's processed.
Contact
privacy@tokyofishmarket.com — Tokyofishmarket, Montreal, Quebec, Canada