Legal & Policies

Privacy Policy

Last updated: September 28, 2026

These documents cover orders delivered in Canada. FirstBy does not take orders for United States yet, so they do not apply there.

1. Who is responsible

Bolrach Technologies Limited, of Edmonton, Alberta, runs FirstBy and is responsible for the personal information described here. Our Privacy Officer answers for how it is handled. Write to them at privacy@firstby.com, or through the Help Center by choosing a privacy request. We follow Canada's Personal Information Protection and Electronic Documents Act and, for people in Quebec, the Act respecting the protection of personal information in the private sector.

2. What we collect

• When you sign up: your first, middle and last name, sex, date of birth, email address and a password, which we keep only as a salted hash. The date of birth confirms you are old enough to buy; the rest identifies your account.
• When you buy: the addresses and phone numbers you deliver to, and a record of each order with its amounts and whether payment succeeded. Card details go straight to our payment provider; we receive only a token and the last digits.
• When you sell: your store details, and the identity and business checks run through our verification provider, Authvio, or the documents you upload for review. Those documents are kept in private storage that only reviewing staff can open, one link at a time.
• When you use the site: messages, reviews and questions you post; your language and currency settings; and a technical log of each request, such as the IP address and browser, kept for security and to fix errors.
• Searches: the words searched, counted per day with no link to who searched. Anything that looks like an email address or a phone number is never stored, and the counts are deleted after 90 days.

3. Why we use it

To run your account and your orders; to let stores deliver what you bought; to take payment and handle refunds; to collect and report sales tax; to verify stores before they sell; to prevent fraud and abuse; to answer you when you contact us; and, only if you agree, to send you offers. You can turn marketing email and in-app offers off at any time on your privacy page or from the link in any such email.

4. Who we share it with

• The store you buy from receives your name, delivery address and phone number, to send the order.
• Carriers receive what they need to deliver the parcel.
• Our payment provider handles payments and refunds.
• Authvio verifies the identity of sellers and, where you use it to sign in, your account.
• Service providers that host our systems, store files and send our emails, under contracts that limit them to our instructions.
• Tax authorities and courts or police, where the law requires it.

We do not sell personal information, and we do not show you advertising based on tracking across other sites.

5. Where it is kept

Some of our service providers may process information outside your province or outside Canada. Before information leaves Quebec or Canada, we assess whether it will be protected adequately and we require the provider, by contract, to protect it to the standard of Canadian law.

6. How long we keep it

We keep account information while your account is open. Order and payment records are kept for as long as tax law requires, which in Canada is six years. When you close your account, you have 14 days to change your mind; after that we remove or anonymise your personal information, except the records the law obliges us to keep.

7. Your rights

You can see and download the information we hold about you from your privacy page, correct your details in your profile, withdraw consent to marketing, and close your account. You can also ask us, at privacy@firstby.com or through the Help Center, for access, correction or deletion, or to learn how a decision about you was made. We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

8. Security and incidents

We protect information with encryption in transit and by limiting access to the staff whose work needs it. If a breach creates a real risk of serious harm to you, we will tell you and the regulator as the law requires. More detail is on our Security page.

9. Changes

We will post any change to this policy here with its date, and tell you by email before a change that affects how we use your information takes effect.