Privacy Policy
Version 1.1 · Effective 2026-08-04 · Controller: Red Taverns Labs Inc. · Privacy contact: ron@taverns.red
This Privacy Policy describes how Red Taverns ("we", "us", "our") collects, uses, and protects personal information in connection with our software products, including Red Vote and other commercially available Red Taverns products. We aim to handle your data carefully, transparently, and in alignment with Canada's PIPEDA and Quebec's Law 25.
1. Who is responsible
Red Taverns is the operating name of Red Taverns Labs Inc., a Canadian corporation incorporated federally and registered in Ontario, based in Ottawa, Ontario. As the data controller for personal information collected through our services, Red Taverns Labs Inc. is responsible for compliance with PIPEDA, Quebec Law 25, and other applicable privacy laws.
The contact for privacy questions, access requests, and complaints is Ronald Servant at ron@taverns.red.
Red Taverns Labs Inc. assumed data-controller responsibility on 4 August 2026 from the sole proprietorship of Ronald Servant, under which Red Taverns previously operated. The personal information we hold, the purposes for which we collect and use it, and your rights in respect of it are unchanged by that transfer.
2. What we collect
2.1 Account & subscription data
- Name, email address, organization name (e.g., District 61) of the account creator and operators.
- Authentication information managed by our identity provider (Clerk).
- Subscription, billing, and tax-related information processed by Paddle (see Section 4).
2.2 Service-delivery data (uploaded by you)
- District Council Lists, club rosters, and member records you upload (names, emails, club affiliation, officer roles).
- Voting metadata: ballots cast, allocations, results, audit trails. Individual voter identity is bound to ballot only as required for authentication and audit; we do not publish voter-level results.
2.3 Operational data (auto-collected)
- IP address, user-agent, and timestamps for security and abuse-prevention.
- Application logs and error reports (via Sentry) for debugging.
- Aggregate usage analytics via Google Analytics 4 on the public marketing site only — not on the application itself. Every page of taverns.red, including this one, loads Google Analytics 4 with IP anonymization; we use it only to count visits and see which pages are read.
3. How we use it
- To deliver the service. Authenticate you, run elections, deliver ballots, calculate results, generate audit trails.
- To support you. Respond to questions, troubleshoot issues, and document incidents.
- To bill you via Paddle (see Section 4).
- To improve the service. Aggregate usage patterns inform product priorities. We do not sell personal information to third parties.
- To meet legal obligations. Respond to lawful requests, enforce our Terms, and detect abuse.
4. Third-party processors
The service relies on the following third parties. Each is contractually bound to protect customer data and use it only to provide their service:
| Processor | Purpose | Data residency |
|---|---|---|
| Paddle.com Market Limited | Merchant of Record — payments, taxes, billing | EU/UK; complies with applicable cross-border transfer rules |
| Supabase | Database (Postgres) and realtime subscriptions | Canadian region (ca-central-1) where supported |
| Google Cloud Platform | Application hosting (Cloud Run) | Canadian region (northamerica-northeast1) |
| Clerk | Authentication and session management | US-based; SOC 2 Type II |
| Resend | Transactional email delivery (notifications, ballots) | US-based |
| Sentry | Application error tracking | US-based; PII redaction enabled |
| Google Analytics 4 | Aggregate marketing-site analytics (taverns.red only — not the application) | US-based; IP anonymization on |
5. Data residency & cross-border transfers
We host application data in Canadian regions where feasible (Supabase ca-central-1; GCP northamerica-northeast1). Some processors (Paddle, Clerk, Resend, Sentry) operate from outside Canada; data they process is transferred under their respective standard contractual clauses or other lawful transfer mechanisms.
If you have specific data-residency requirements (e.g., a Quebec-based district subject to Law 25 storage-location considerations), contact us before subscribing — we can document our processor footprint in detail.
6. Retention
- Active subscription: we retain your data for as long as your subscription is active.
- After cancellation: we retain data in active systems for 90 days to support reactivation, then delete or anonymize. Final-results audit trails may be retained longer if you request a copy or for our own incident-response logs (de-identified).
- Backups: encrypted backups are retained for up to 90 days for disaster recovery.
- Billing records: kept by Paddle as required by tax and accounting law (typically 6–7 years).
7. Your rights
You have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your data (subject to legal retention requirements such as billing records held by Paddle).
- Export your data in a portable format (CSV/JSON).
- Withdraw consent for any processing based on consent (this may end the service).
- Lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) if you believe your rights have been violated.
To exercise any of these rights, contact ron@taverns.red. We will respond within 30 days.
8. Cookies & similar technologies
The application uses essential cookies for authentication and security; these cannot be turned off without breaking the service. The marketing site (taverns.red) uses Google Analytics 4 with IP anonymization for aggregate usage reporting.
We do not use advertising cookies, cross-site tracking, or remarketing pixels.
9. Security
We use industry-standard practices: TLS in transit, encryption at rest, least-privilege access controls, secret management via Google Cloud Secret Manager, error tracking with PII redaction, and routine dependency updates. Authentication is handled by Clerk (SOC 2 Type II). Hosting is on Google Cloud Run.
If we discover a breach affecting your data, we will notify you within the timeframes required by PIPEDA and Quebec Law 25 (typically without undue delay).
10. Children
The service is not directed at children under 13 (Canada) / 14 (Quebec). We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can delete it.
11. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be notified to active subscribers by email at least 30 days before they take effect.
12. Contact
Privacy questions, access requests, or complaints: ron@taverns.red.