Map.ca’s Privacy Policy explains in plain language what personal information the platform handles. It is anchored in two non-negotiable principles from the Constitution: principle 5 (Consent must be meaningful) and principle 6 (Collect less, protect more). Together they set the bar: if Map.ca cannot justify why a field is collected, that field is not collected.
Under PIPEDA, organizations operating in Canada are generally required to obtain meaningful consent for collecting, using, and disclosing personal information, and people must understand what they are consenting to. PIPEDA’s fair information principles — accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance — are treated by Map.ca as floor, not ceiling. Quebec Law 25 applies where Map.ca serves Quebec residents.
What Map.ca holds, in plain terms: account identifiers needed to sign in, Pin content owners choose to publish, optional contact and service information, civic reports and their moderation status, and operational logs needed to keep the system safe and accountable. What Map.ca does not hold: behavioural tracking profiles, advertising identifiers, secret location histories, or bundled consents that hide one purpose inside another.
People can see what is held about them, correct what is wrong, withdraw consent for non-essential uses, and request deletion subject to the URL permanence rules set by the Data Retention and Deletion Policy. The Privacy Policy is reviewed every six months — short cycle, on purpose.
Requirements
- Get meaningful consent before collecting personal information.
- Document the purpose of every personal data field at design time.
- Set a retention clock on every collected field before it ships.
- Honour access, correction, and deletion requests within the timelines set by PIPEDA.
- Disclose every third party that processes Map.ca personal data and the country it processes in.
Prohibitions
- Do not bundle unrelated consents into a single accept-all dialog.
- Do not use dark patterns to steer people toward sharing more than they need to.
- Do not track behaviour across the site for advertising profiling.
- Do not retain personal data past its documented retention period.