Privacy Policy

• We collect what GrailRoute needs to work: your account details, what you add (wishlists, listings, messages) and how you use show features.
• We don't sell your personal information, we don't show ads, and we don't use advertising or analytics trackers.
• Location is only used when you allow it, and we don't store your precise coordinates with your account.
• Some information is visible to other users by design — your public profile, a vendor's listings, messages you send — and this policy says exactly what.
• You can see, correct, download or delete your information. Deleting your account removes it, with a few exceptions explained below.

GrailRoute Inc., a company based in Quebec, Canada, is responsible for the personal information collected through GrailRoute (the website and our apps).

The person in charge of the protection of personal information is the President of GrailRoute Inc.. You can reach them at info@grailroute.com (please write "Privacy" in the subject line).

We follow Quebec's Act respecting the protection of personal information in the private sector and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Information you give us:

• Account: your name or business name, email address and password (stored only as a one-way hash, never in readable form), and your age group and acceptance of these policies.
• Profile, if you add them: username, photo or logo, bio, phone number, portfolio link and the categories you collect.
• What you create: wishlists, shows you save or say you are attending, follows, inventory listings and their photos, giveaways and entries, vendor applications (tables wanted, electrical needs, preferences), shows you organize, messages and chat, reports and blocks, and Resolution Center cases.
• Tickets: the name and email given at checkout, even when buying without an account, and your ticket's check-in at the door.

Information created when you use GrailRoute:

• Show activity: checking in at a show and the method used (location or code), and — when you're signed in — actions such as viewing a listing, tapping a booth or adding a stop to your route, used to show organizers and vendors how their shows and booths are doing. Organizers and vendors see counts, not who did what.
• Searches you run, kept to improve search results; they are separated from your account when you delete it.
• Notifications we send you, and, if you turn them on, a push-notification address supplied by your browser or device.
• Technical information our servers receive with every request, such as IP address, browser type and the time of the request, kept in server logs for security and troubleshooting.

Location: only when you allow it on your device, to find shows near you, confirm a check-in or point you to a booth. Nearby-chat suggestions use a position rounded to about a kilometre and do not store it. We don't keep your precise coordinates with your account. You can turn location off at any time in your device settings and search by city or postal code instead.

Information from others: an organizer may add you as show staff; other users may send you messages or file a report about an account or content.

• To run your account and the features you use: search, wishlists, alerts, floor maps, tickets, check-in, chat and messages.
• To connect collectors, vendors and organizers around a show — for example, telling you when a vendor at a show you're attending has a card on your wishlist.
• To send messages you need (account, tickets, show changes) and alerts you've chosen. You can turn alerts and push notifications off in your profile.
• To keep GrailRoute safe: preventing fraud and abuse, reviewing reports, enforcing our Terms and Community Guidelines.
• To improve GrailRoute, using information that is aggregated or separated from your identity wherever possible.
• To meet our legal obligations.

We use your information only for these purposes, or for others you consent to or that the law permits. We do not make decisions about you based solely on automated processing.

• Your public profile: name or business name, username, photo, bio and what you choose to make public (such as a portfolio).
• If you are a vendor: your listings, prices, photos and booth at each show.
• If you organize a show: the show's details and your name as organizer.
• Messages: what you post in a show's chat room is visible to signed-in users; private messages are visible to the people in the conversation; the show's organizer can moderate its rooms.
• Attending a show: if you mark yourself as attending, the vendors confirmed at that show can see your wishlist for that show together with your display name, so they can bring what you're looking for. You can hide individual wishlist items from a show, or not mark yourself as attending.
• Tickets and applications: the organizer of a show sees the name and email on tickets for their show and the details of vendor applications to it.

We don't sell or rent personal information. We share it only as follows:

• Our hosting provider, which runs the servers GrailRoute and our email system operate on.
• Google Maps Platform, when you view a map of shows or type a venue address: your browser loads Google's map service, which receives your IP address and what you type in the address box.
• OpenStreetMap's Nominatim service, which turns a postal code or city you search for into a location; it receives that search text from our server, not your identity.
• Your browser's or device's push service (for example Google, Apple or Mozilla), if you turn on push notifications, to deliver them.
• Payment processors such as Stripe, if a payment, refund or dispute on GrailRoute goes through them.
• Card-data providers (such as JustTCG) receive card searches from our server so we can show card information; no personal information is sent to them.
• Authorities, when the law requires it, or to protect someone's safety or our rights.
• A buyer or successor if GrailRoute is sold or merged, under the same protections, and with notice to you.

Our service providers may only use your information to provide their service to us and must protect it.

Some of our service providers — and possibly our servers — are located outside Quebec, including elsewhere in Canada and in the United States. Before your information is communicated outside Quebec we assess whether it will be adequately protected, as Quebec law requires. Information held outside Quebec may be accessible to authorities there under local laws.

• Your account information and content, for as long as you keep your account.
• When you delete your account, your profile, wishlists, listings, follows, check-ins, notifications, chat messages and private conversations are deleted immediately. Your searches and listing views are kept without any link to you.
• Some records are kept, without your account, where they belong to someone else or the law or safety requires it: ticket orders (they are an organizer's financial records — the name and email on the ticket stay with the order), Resolution Center cases, and reports made about an account, which are kept for up to two years to protect other users. Reports you filed are kept without saying who filed them.
• Server logs are kept for a short period for security, then deleted. Backups are overwritten on a regular cycle.

Connections to GrailRoute are encrypted (HTTPS), passwords are stored only as one-way hashes, access to personal information inside GrailRoute is limited to people who need it, and administrative actions are logged. No system is perfect: if a confidentiality incident creates a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the people affected, as the law requires.

Whether a young collector uses GrailRoute is up to their parent or guardian. For a child under 14, the parent or guardian must consent to the collection and use of the child's personal information and should supervise the account. People under 18 can't become vendors, list items for sale, organize a show or act as show staff.

A parent or guardian can ask to see, correct or delete their child's information at any time by writing to info@grailroute.com.

You have the right to:

• know what personal information we hold about you and get a copy of it;
• have it corrected if it's inaccurate, incomplete or ambiguous;
• receive the information you gave us in a structured, commonly used technological format, or have it sent to someone else;
• withdraw your consent to a use of your information (some features may then stop working);
• have your information deleted, or have it stop being disseminated or linked to your name where the law allows;
• be told about the source of information we hold about you and who has access to it.

Much of this you can do yourself in your profile — including deleting your account. For anything else, write to info@grailroute.com. We'll answer within 30 days and may need to confirm your identity first.

If you're not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

GrailRoute uses one cookie: a session cookie that keeps you signed in. It is strictly necessary and is deleted when you sign out or it expires.

We also save a few preferences in your browser's storage on your own device — for example, whether the chat box is open, whether you dismissed the install prompt, and a recent location you allowed, so you aren't asked again on every page. They are not used to track you and you can clear them in your browser settings.

We don't use advertising cookies, third-party analytics, tracking pixels or cross-site tracking.

If we change this policy in a way that matters, we'll tell you by email and on GrailRoute before the change takes effect, and ask for your consent again where the law requires it. The date at the top shows when it last changed.

Person in charge of the protection of personal information — President, GrailRoute Inc., Quebec, Canada — info@grailroute.com