Your Privacy, Our Responsibility

Your Toronto City ("we", "us", or "our") operates the website at yourtorontocity.com — an independent visitor guide for the FIFA World Cup 2026 in Toronto. This Privacy Policy explains what personal information we collect, how we use it, and your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law.

We are based in Toronto, Ontario, Canada. By using our website or submitting a business listing inquiry, you agree to the practices described in this policy.

We collect information in two ways:

Information you provide directly

• Business listing inquiries — when you submit a "Get Featured" application we collect your name, business name, email address, phone number, website URL, and any message you include.
• Contact form submissions — your name, email address, and the contents of your message.
• Community account registration — if you create a community account we collect a username, email address, and hashed password.
• Payment information — when you purchase a listing, payment is processed securely by Stripe. We do not collect or store your card number, CVV, or bank details. See Section 4 for details.

Information collected automatically

• Analytics data — we use Google Analytics (GA4) to collect anonymised data about pages visited, session duration, device type, and general geographic region. This data does not identify you personally.
• Cookies — our site sets cookies necessary for analytics and basic site function. See Section 5 for more detail.
• Server logs — our hosting provider (Vercel) may log IP addresses, browser type, and request timestamps for security and performance purposes.

We use the information we collect for the following purposes:

• To review and respond to business listing applications
• To manage and publish approved featured listings on the site
• To process payments for listing packages via Stripe
• To send transactional emails (listing confirmation, invoice, updates about your listing)
• To respond to contact form enquiries and support requests
• To detect and prevent fraud or abuse
• To improve the website based on aggregated, anonymised analytics data

We will only send you marketing communications if you have explicitly opted in. You may opt out at any time by emailing us at hello@yourtorontocity.com.

All payments on Your Toronto City are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. When you enter payment details on our site, that information is transmitted directly and securely to Stripe — it never passes through or is stored on our servers.

We receive only a payment confirmation token and basic transaction metadata (amount, currency, listing package selected) from Stripe. We do not store, process, or have access to your:

• Full card number
• Card verification value (CVV / CVC)
• Bank account details

Stripe's own handling of your payment data is governed by the Stripe Privacy Policy. We encourage you to review it.

Our website uses the following types of cookies:

Essential cookies

Required for the site to function — for example, maintaining your community login session. These cannot be disabled without breaking site functionality.

Analytics cookies

We use Google Analytics 4 to understand how visitors use the site. GA4 uses cookies to collect anonymised data such as pages viewed, referral sources, and session length. This data is aggregated and does not identify individual users.

You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on or by adjusting your browser's cookie settings.

Most browsers allow you to refuse or delete cookies at any time. Doing so may affect some features of the site but will not prevent you from accessing content.

We do not sell your personal information to third parties. We do not trade, rent, or exchange your data for commercial or marketing purposes.

We share data only in the following limited circumstances:

• Stripe — to process payments (see Section 4)
• Google Analytics — aggregated, anonymised usage data only
• Vercel — our hosting provider may process technical data (IP addresses, request logs) as part of delivering the website
• MongoDB Atlas — our database provider stores form submissions and community account data on encrypted servers
• Legal requirements — if required by law, court order, or regulatory authority

All third-party processors we use are contractually required to protect your data and use it only for the purposes we specify.

We retain personal information only for as long as necessary:

• Business listing inquiries — retained for 12 months after the listing period ends (July 2026), then deleted
• Contact form submissions — retained for 6 months, then deleted
• Community accounts — retained until you request deletion or the account is inactive for 24 months
• Payment records — Stripe retains transaction records for tax and legal compliance; we retain only the minimum metadata required for our records
• Analytics data — Google Analytics data is retained for 14 months per our GA4 configuration

You may request early deletion of your data at any time — see Section 9.

As a resident of Canada (or anyone whose data we process), you have the following rights under PIPEDA:

• Right to access — you may request a copy of the personal information we hold about you
• Right to correction — you may ask us to correct inaccurate or incomplete information
• Right to withdrawal of consent — you may withdraw consent for non-essential uses at any time (note: this may affect our ability to provide certain services)
• Right to deletion — you may request that we delete your personal information, subject to legal retention obligations
• Right to complain — if you believe we have handled your data improperly, you may file a complaint with the Office of the Privacy Commissioner of Canada

If you are located in the European Economic Area or the United Kingdom, you may also have additional rights under the GDPR or UK GDPR. Please contact us and we will work to accommodate your request.

To exercise any of your rights, request deletion of your personal data, or ask questions about this policy, please contact us:

We will respond to all privacy requests within 30 days in accordance with PIPEDA. For complex requests, we may extend this by an additional 30 days with notice.

Please include "Privacy Request" in the subject line and describe the action you are requesting (access, correction, deletion, etc.). We may ask you to verify your identity before processing the request.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of the site after changes are posted constitutes your acceptance of the updated policy.