Privacy policy

IrooniMap is a free, bilingual directory of Iranian businesses that started in Toronto. This policy applies to the IrooniMap website, its Telegram bot and the emails we send.

We wrote it around the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). Our aim is that every sentence makes sense to an ordinary reader.

We collect only what we need to provide the service:

• Account: your email address (to sign in with a one-time code) and the name you choose to enter.
• Saved places: businesses you save or follow, and lists you create.
• Messages: messages you send to a business through IrooniMap (name, email or phone, and the message) and messages you send us through the contact or removal forms.
• Newsletter: email address, language, interests and your consent record (when and where you signed up, and when you confirmed).
• Business owners: information and documents you send to verify ownership, and content you publish on your business page.
• Payments: order number, amount, tax and payment status. Card details are held by our payment processor (Stripe) and never reach us.
• Images: photos you upload to a business page or your profile.

To learn which pages are useful and to give business owners their stats, we record page views and taps on buttons such as call, directions and website.

This uses an anonymous ID kept only in that browser tab (sessionStorage) and cleared when you close it. It is not a cookie, isn't linked to your account and doesn't follow you across other sites. We use no third-party advertising tools or tracking pixels.

Search terms are logged without any link to your account so we can improve search results.

• Sign-in cookie (irm_session): set only when you sign in, and needed to keep you signed in. It's not readable by scripts (httpOnly).
• Display mode: your light or dark mode choice is stored only in your own browser (localStorage).
• Maps: map images load from OpenFreeMap. Like any website, that service sees your IP address in order to send the map images.

Every uploaded image is re-processed and saved in a fresh format. Hidden file data (EXIF), including camera model and the location where the photo was taken, is removed in the process.

• Signing you in and keeping your saved places and settings.
• Delivering your message to the business you chose.
• Sending the newsletter, only after you've confirmed your subscription.
• Issuing payment receipts and keeping financial records.
• Preventing spam and abuse. For this we keep IP addresses briefly, only to limit the number of requests.
• Improving search and pages with anonymous, aggregate statistics.

• We don't sell or rent your personal information, or use it to build advertising profiles.
• We don't display emails that were only found in other directories on business pages.
• We show a business owner's name only if they published it themselves.
• We don't record personal information in technical logs.

The first business listings were compiled from public directories and information businesses have published themselves (such as their websites and social media pages). Page descriptions are written from those facts; text from other sources is not republished.

Any business owner can claim their page and correct it. If a page shouldn't be on IrooniMap or an address should be hidden, use the removal or correction form.

• The business you message: receives your name, contact details and message so it can reply.
• Service providers: server hosting, email delivery and payment processing (Stripe). They only access what they need to do their job.
• Legal requirements: when the law or a valid court order requires it.

Newsletter sign-up is double opt-in: after you enter your email we send a confirmation link, and you receive nothing until you click it. We keep when and where you signed up and when you confirmed as your consent record.

Every newsletter includes a one-click unsubscribe link. You can withdraw your consent at any time.

• Access and export: download a copy of your data from your account settings.
• Correction: change your name, email and settings at any time.
• Deletion: delete your account from the same page. A deleted account's data is purged from our systems within 30 days.
• Withdrawing consent: unsubscribe from the newsletter or notifications whenever you want.
• Complaints: if you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

• One-time sign-in codes: 10 minutes.
• Sign-in sessions: 60 days, or until you sign out.
• Raw analytics events: about 13 months. After that only anonymous aggregate counts remain.
• Rate-limit records (including IP addresses): a few hours at most.
• Messages you send to businesses or to us: 24 months.
• Deleted accounts: purged within 30 days.
• Payment records: as long as Canadian tax law requires (usually six years).
• Newsletter consent records: as long as needed to prove consent, even after you unsubscribe. No email is sent after you unsubscribe.

Connections to IrooniMap are encrypted (HTTPS). Sign-in codes and sessions are stored hashed, never in plain form. Only people who need data to run the service can access it.

No system is perfectly safe. If a breach creates a real risk of significant harm to you, we'll notify you and the Privacy Commissioner as the law requires.

IrooniMap isn't designed for children under 13, and we don't knowingly collect their personal information.

If this policy changes, we update the date at the top of the page. For significant changes, we'll let you know by email or a notice on the site.

For any question or request about personal information, use the contact form and choose “Privacy and personal data”. IrooniMap's privacy lead reviews it and usually replies within a few business days.