FindItBay
FINDITBAY PRIVACY POLICY
Version 1.8
1. WHO WE ARE AND WHAT THIS POLICY COVERS
Finditbay operates finditbay.com, a research-based editorial and affiliate website based in British Columbia, Canada. In this policy, “Finditbay,” “we,” “us” and “our” refer to Finditbay as the operator of the Site. We are responsible for deciding how personal information collected through our Site is used, subject to the roles of independent third parties described below.
This policy explains information handling on our Site and through our communications and available interactive features. It does not govern independent merchants, affiliate networks or other websites after you leave our Site. We do not currently sell products, process purchase payments or fulfill merchant orders.
Our present editorial market is Canada and the United States. We do not currently direct our offering or marketing to people in the European Economic Area (EEA) or United Kingdom (UK). This statement does not remove any legal rights or determine, by itself, which privacy laws apply.
Our Privacy Officer can be reached at [email protected]. Contact information appears in section 18.
2. INFORMATION WE COLLECT
This website version does not offer a newsletter signup form or public comment/review submission. The descriptions of those activities below apply to any existing records or if the corresponding feature is offered with an appropriate notice.
Information you provide. We receive your name or chosen display name, email address, message and attachments when you contact us; your email address and any optional preferences when you subscribe; and your submission, display name and associated moderation information when you comment or review. Newsletter consent and unsubscribe records may include the notice version, date, method and subscription status. Do not send unnecessary sensitive or confidential information.
Public contributions. A comment or review submitted for publication, together with its display name and any information you include, may be publicly visible and searchable. Your contact email is not part of the public submission unless you put it in the content yourself. We may process information needed to detect spam, moderate submissions and respond to complaints. Private correspondence and chatbot messages are not treated as public contributions.
Technical information. Our hosting and security systems receive information necessary to deliver and protect the Site, such as an IP address, requested address, timestamp, response status and browser or device information. These systems are distinct from optional analytics and advertising. We minimize logs and restrict their use to operational, security and other justified purposes.
Optional analytics and advertising information. Subject to section 5, configured tools may collect online identifiers, device and browser information, approximate location, pages and content viewed, navigation, referral information, interactions and performance information. Section 4 explains these tools and the limits we apply.
Affiliate information. Affiliate networks may provide reports of clicks, qualifying actions, commissions and associated campaign or transaction references. The information depends on the network. We do not receive your payment-card details from an ordinary merchant purchase. Do not assume every affiliate report is anonymous.
We do not currently need your date of birth, government identification, payment details, family subscription details, social-login account or health information to read our articles. We will provide a relevant notice before introducing a feature that requires materially different information. An inquiry or a submission is not automatic agreement to marketing or AI training.
3. WHY WE USE INFORMATION
We use information for the purposes appropriate to the interaction: delivering and securing the Site; responding to inquiries; sending requested newsletters; operating and moderating available interactive features; recording privacy and communication choices; investigating misuse and rights complaints; and meeting applicable legal obligations.
Where permitted by your choices and applicable law, we use analytics to understand content engagement and site performance, and advertising measurement to understand the effectiveness of our Pinterest activity. We use affiliate reports to administer commissions and evaluate referral activity. We do not treat a general permission to use the Site as consent to every one of these purposes.
We do not use comments, private messages or chatbot conversations for unrelated general-purpose AI model training without a separately explained, valid legal basis and any consent required by law. Information collected for one purpose is not automatically available for unrelated advertising.
4. ANALYTICS, PINTEREST AND AFFILIATE TRACKING
Google Analytics. Google Analytics is currently disabled. Disabling collection does not necessarily delete information previously collected or cookies previously stored. If we enable Google Analytics again, we will first update the relevant notices and controls and obtain any required permission. Advertising features, Google Signals, user-provided data and cross-service audience matching are not authorized merely by analytics permission. Google may process information on servers outside Canada.
Matomo. Matomo is currently enabled. We use self-hosted Matomo on infrastructure we manage, subject to the privacy choices described in section 5. Depending on the enabled settings and your choices, it can process: - Technical and session information: masked IP address, approximate location derived from IP information, browser/version, operating system, device type, screen size, language, visit times and session duration; timezone or device-brand information where configured. - Navigation and engagement information: page addresses and titles, entry and exit pages, referring sources, downloads, outgoing links and content interactions where those measurements are enabled. - Site search and performance information: searches and result interactions, page-load measurements, server timings and web performance metrics where specifically configured.
These are categories of possible configured measurement, not a statement that every Matomo feature is always active. IP masking and pseudonymous identifiers do not necessarily make information anonymous. Persistent visitor identifiers, user IDs, cross-device tracking, session recordings and form-content capture require a separate assessment; we do not enable them as part of our basic analytics configuration. We do not send private messages, comment bodies, chatbot prompts, email addresses or other contact details to Matomo. Search terms and URL parameters can contain personal information and must be removed or filtered before any optional measurement.
Pinterest Tag. Pinterest Tag is currently enabled, subject to the privacy choices described in section 5. Our client-side Pinterest Tag can transmit browser, device and online identifier information, page addresses and configured events to Pinterest for advertising measurement and potentially advertising personalization. This can constitute targeted advertising or legally defined sale or sharing, depending on the processing and applicable law. We treat it as optional advertising processing. Enhanced matching and contact-data uploads are not part of our stated current configuration.
Our basic Pinterest configuration enables only PageVisit on approved public article pages after advertising permission. Other possible events, such as Search, SignUp, Subscribe, Lead, ViewCategory, ViewContent and WatchVideo, are not automatically active. We enable an additional event only after confirming its purpose, supported event mapping and privacy-safe payload. We do not send email addresses, phone numbers, raw search queries, submitted content or sensitive URL parameters as event data. Video measurement is not active merely because it appears in this policy.
Affiliate links. We participate in Amazon Associates and Benable and may add other disclosed programs. An affiliate link can contain a referral identifier and can redirect through a network. Clicking it takes you to another service, which may receive your IP address, browser information, referral information and its own cookies under its own policy. Our controls govern processing we initiate on our Site; they cannot promise to prevent independent processing on another website after you choose to visit it. We assess affiliate widgets, scripts and redirects separately from ordinary links and do not treat them as automatically essential.
5. COOKIES, CONSENT AND ADVERTISING CHOICES
Necessary processing supports delivery, security and remembering your privacy choice. Optional analytics and advertising are off until the applicable permission has been recorded. Reading or scrolling the Site, closing a notice, or accepting the Terms does not provide that permission.
Use “Privacy choices” to accept optional analytics and advertising, reject both, or choose either separately where offered. Rejection is as accessible as acceptance. You can change your decision at any time through the same control. Refusing optional processing does not prevent access to ordinary editorial content.
Our privacy controls use first-party browser storage to remember a non-unique choice, its version and the time it was made. Positive permission for optional tracking expires after no more than 180 days. We retain a minimal sale-or-sharing opt-out record in that browser until you explicitly change it or browser storage is cleared; it does not automatically expire with positive permission. We do not prompt you to opt back in for at least 12 calendar months after an opt-out, or for longer where applicable law requires. Clearing storage or changing browsers may require a new choice, and GPC continues to be honored when received. These records are not advertising identifiers. A material change may require new permission; it does not override an existing opt-out.
For our present Canada/U.S. launch, optional tracking and interactive services are restricted outside those supported markets. Where our trusted server identifies an EEA/UK visit, another unsupported region, or cannot establish a supported region, optional analytics and advertising remain disabled regardless of an older stored preference. This is a precautionary service configuration, not a claim that geography can be identified perfectly or that privacy law no longer applies. VPNs and other network conditions can affect region estimates. We do not request precise device location for this purpose.
We honor Global Privacy Control (GPC) as a request to disable the advertising/sale-or-sharing processing we control, including when an earlier preference allowed it. You can also reject advertising manually. A GPC signal does not automatically subscribe you to, or withdraw you from, email communications. Traditional Do Not Track signals are different from GPC; our privacy controls do not treat them as a substitute for these controls.
When you withdraw permission, we stop initiating the relevant processing and reload the page to stop the loaded optional scripts. Withdrawal does not undo information already transmitted. Our code cannot remove every third-party cookie or delete information held by an independent provider. You may additionally use browser controls or contact us about an applicable deletion right. Browser settings alone are not a replacement for our consent obligations.
Our cookie information must identify the actual tools, purposes, providers and storage durations in operation.
6. GUIDE ASSISTANT INFORMATION
Our automated guide assistant is available where the feature is enabled. Its interface explains that answers are selected article excerpts or scripted quick answers and identifies the source. A generative language model is not part of this release.
The guide assistant selects relevant excerpts from Finditbay's own guides, seasonal pages and scripted FAQ knowledge base and links to the source. It does not use an external model service or generate new product claims. The application runs on our managed VPS in California, United States. It does not access another website's content or private conversations.
Questions and replies are processed temporarily to answer your request. The application does not save conversation transcripts or use them for model training. The browser displays the conversation in page memory; Clear conversation or leaving the page removes that display. Operational application logs do not record message bodies. A short-lived, necessary first-party session cookie and a request token protect interactive requests; temporary, keyed rate-limit identifiers are held in memory for abuse prevention.
Do not submit passwords, payment details, government identifiers, sensitive personal information or information about another person. An input warning does not remove our obligations if such information is received. There is no autonomous purchasing, account access or authority to make commitments for you. If we later introduce saved histories, human conversation review, training or an outside AI service, we will explain the change before it begins and obtain any necessary consent. Accepting the Terms is not permission for unrelated training.
7. NEWSLETTERS AND OTHER COMMUNICATIONS
This website version has no newsletter signup form. Existing newsletter subscriptions, if any, remain separate from the guide assistant and push notifications. Newsletters are optional and require an affirmative subscription. We use your email address and chosen preferences to deliver requested communications and retain appropriate evidence of subscription. Our mailing-list service provider is Mailchimp and may include other providers in the future.
Every marketing email provides an unsubscribe method. You may also write to [email protected]. We process withdrawal within the applicable legal deadline and retain only the limited suppression and compliance information needed to respect it or meet another lawful obligation. Unsubscribing does not stop necessary non-promotional replies or legal notices.
Email open pixels and individual click measurement are not automatically necessary to deliver a newsletter. Before enabling them, we explain the measurement and obtain any required permission. Submitting a comment, contacting us or using a chatbot does not subscribe you.
Web-push notifications are a separate, optional marketing channel available on supported browsers in Canada and the United States. On our Install & notifications page, choose the notification checkbox and then enable notifications; your browser also asks permission. Installing Finditbay or allowing analytics/advertising does not subscribe you. New notification subscriptions remain off when Global Privacy Control is enabled. Existing notifications can be withdrawn separately using Unsubscribe on that page or browser/device settings.
We store the browser's delivery endpoint and encryption keys encrypted at rest, together with the subscription date, expiry and notice version. A browser-held management token lets you control that subscription without an email address. The browser's push provider (such as Apple, Google, Microsoft or Mozilla) receives the endpoint and technical delivery information; message contents are encrypted for the browser. These providers may process information outside Canada under their own service terms. Notifications may be visible on your device's lock screen.
Subscriptions expire after 180 days unless you explicitly subscribe again. Unsubscribing removes the active server delivery record; expired records are removed daily and endpoints reported invalid by the provider are removed on delivery. Aggregate campaign records are retained for 30 days. The push application does not make historical subscription backups in this release; infrastructure snapshots, if used, require separate retention controls. Unsubscribing cannot recall notifications already accepted for delivery. We do not operate SMS or telephone marketing in this release.
8. WHO RECEIVES INFORMATION
Cloudflare provides DNS, web proxying and security services. Our protected preview uses Cloudflare Access, which can involve authentication information and cookies. Cloudflare performance measurement has been used on the protected preview to collect performance and related page information. Its operation is subject to applicable notices and choices. Mail routing and delivery use Cloudflare and Google services, and messages may also be stored in the email client on our administrator’s device. These services and device copies are included in our information-handling responsibilities.
Information may be handled by service providers supporting hosting, domain and email infrastructure, security, backups, newsletter delivery and enabled features, to the extent needed for their functions. We assess the service, limit access and use suitable contractual and operational safeguards. A vendor's general claim of compliance does not replace our responsibility for its use.
Analytics and advertising providers receive information when their tools are permitted to operate. Affiliate networks and merchants receive information through their own services when you follow their links. Some third parties act independently for their own purposes; their policies and roles must be assessed, not assumed to be identical to a processor acting only on our instructions.
We may disclose information when required or authorized by law, to respond to valid legal process, protect lawful interests or address security and fraud, subject to applicable limits. In a proposed or completed business transfer, information may be disclosed under appropriate confidentiality and use restrictions and with required notices or consent.
We do not currently describe Google Floodlight, uploaded customer audiences, data brokerage, social-login services or sponsor access to subscriber lists as active Finditbay practices. Introducing one would require a fresh assessment and appropriate notices and choices. Public UGC is accessible to other visitors; private correspondence is not made public merely because we receive it.
9. TARGETED ADVERTISING, “SALE” AND “SHARING”
We do not sell a mailing list for money. However, disclosing online identifiers or browsing information to an advertising provider can meet a law's definition of “sale,” “sharing” for cross-context behavioral advertising, or targeted advertising even without a cash payment. Pinterest Tag processing may fall within these definitions. We do not rely on the ordinary meaning of “sell” to deny an applicable opt-out right.
Select “Privacy choices / Do not sell or share my personal information” and turn advertising off, reject optional processing, or use GPC. These controls are offered as a practical baseline regardless of whether a particular state statute applies to our business. We do not charge a fee or deny ordinary editorial access because you exercise an applicable privacy right.
If a law requires an additional notice at collection, sensitive-information limitation, authorized-agent process, appeal process or reporting of prior practices, we will provide it as applicable. This policy does not assert that we meet every U.S. state's statutory coverage threshold or that small business size exempts us from every privacy law.
10. STORAGE AND INTERNATIONAL PROCESSING
Finditbay is based in British Columbia. Our website VPS is hosted in California, United States. Our domain, website, email and related infrastructure involve multiple providers, including providers in the United States. Messages may be stored on servers we administer in that infrastructure. Self-management does not make U.S.-hosted storage Canadian storage. Providers or authorized personnel may process information in additional countries depending on the selected service.
Information processed abroad may be subject to that country's laws and lawful access by public authorities. We assess the purposes, sensitivity, locations and contractual protections of transfers. Where applicable, we use a legally valid transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, together with any required assessment and supplementary measures. A provider's certification is relevant only if it is valid, applicable to the recipient and processing, and sufficient for the transfer concerned.
11. HOW LONG WE KEEP INFORMATION
We keep personal information only for as long as reasonably necessary for its identified purpose and any applicable legal requirement. Retention differs by record type; “for legal purposes” is not a reason to keep every record indefinitely.
- Inquiries and correspondence: while responding and for a proportionate period needed for follow-up, dispute handling or a specific legal requirement.
- Newsletter information: while subscribed, followed by limited unsubscribe/suppression and consent records where necessary to respect choices and demonstrate compliance.
- Public contributions: while published and useful for their editorial purpose; removed content and moderation records only for a justified limited period.
- Security and server logs: a short documented operational period, extended only for a specific incident or legal hold.
- Analytics and advertising information: according to the enabled tool's documented retention setting and applicable deletion controls; another provider may have its own legally permitted retention.
- Chatbot messages: transient request processing; no application transcript archive.
- Push subscriptions: up to 180 days, or earlier withdrawal/invalid-endpoint cleanup; aggregate campaign records for 30 days.
- Privacy preferences: positive optional-tracking permission lasts up to 180 days. An advertising opt-out does not automatically expire; changing choices or clearing browser storage affects the locally remembered record.
Restricted backups expire through a documented rotation. A specific legal hold may temporarily delay deletion of relevant records. When information is no longer needed, we delete it or irreversibly anonymize it where appropriate. We do not describe merely pseudonymized information as anonymous.
12. SECURITY AND INCIDENTS
We use safeguards appropriate to the sensitivity and risks of the information, including limited access, secure configuration and protected communications where implemented. No system is completely secure. We assess suspected incidents, take proportionate response measures, and notify individuals or authorities when applicable law requires it. We do not ask you to waive our legal security obligations.
13. CONSENT, GDPR AND OTHER LEGAL BASES
Canadian privacy law may require consent, subject to applicable exceptions, and other accountability obligations. We distinguish information needed for a requested service from optional purposes, explain meaningful choices, and do not treat continued browsing as blanket consent.
Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies, we must identify a lawful basis for each purpose. Depending on the circumstances, this may be consent for optional tracking or marketing where required; steps you request or performance of a contract where objectively necessary; compliance with a relevant legal obligation; or legitimate interests such as proportionate security, administration and handling inquiries, after considering your rights and reasonable expectations. We do not use “legitimate interests” to bypass a separate legal requirement for device-storage or marketing consent.
You may withdraw consent at any time without affecting processing lawfully undertaken before withdrawal. We do not use the Site to make solely automated decisions producing legal or similarly significant effects about you. Ordinary content suggestions are not a substitute for an assessment if a future feature introduces such decision-making.
14. YOUR RIGHTS AND REQUESTS
Depending on the law applicable to you and the processing, you may request access to and a copy of personal information; correction; deletion; restriction; portability; information about use or disclosure; or withdrawal of consent. You may have a right to object to particular processing, including direct marketing, and rights concerning targeted advertising, sale or sharing. Conditions and exceptions differ between jurisdictions.
Contact the Privacy Officer at [email protected]. Describe your request and the interaction involved. Do not email identity documents unless we explain a necessary, proportionate and secure verification method. We verify identity or an agent's authority only to the extent appropriate for the request. General browser opt-out signals do not require you to open an account or disclose extra identifying information.
We respond within the deadline applicable to your request and explain an applicable extension, refusal or exception. If your law provides an appeal, reply with “Privacy appeal” so a review can be arranged. We explain the available regulator complaint route where required. You may complain directly to a competent regulator without first obtaining our permission.
Canadian residents may contact the relevant federal or provincial privacy commissioner. Where GDPR or UK GDPR applies, you may complain to a competent EEA supervisory authority or the UK Information Commissioner's Office. Quebec residents may have additional access, rectification, portability and other rights under applicable Quebec law. U.S. residents may have rights under their applicable state laws, including authorized-agent and appeal rights where provided. Rights do not depend solely on the language in which you contact us.
We do not require a waiver of mandatory rights, retaliate against a lawful request, or promise deletion where a specific lawful retention exception applies. We explain relevant limits, including independent copies of previously public contributions.
15. CHILDREN
Our content and interactive features are intended for adults. We do not knowingly solicit children's personal information for these features or knowingly sell or share it for targeted advertising. If you believe a child has provided information, contact us so we can assess and take appropriate action. An age statement alone does not replace duties that apply if we learn of child users or change our audience.
16. EXTERNAL WEBSITES AND FUTURE FEATURES
External links lead to services with separate practices. Future embedded video, sponsorships, accounts, SMS or additional affiliate services require assessment before launch. PWA installation and optional push messaging are described in section 7. This policy does not supply advance consent for them. We explain material new processing at the relevant point and update this policy and controls as necessary.
17. CHANGES TO THIS POLICY
We update the revision date when this policy changes. We provide prominent notice of material changes and obtain new consent where required before applying a new purpose. Changes do not retroactively authorize previous processing or remove accrued rights.
18. CONTACT AND LOCAL REPRESENTATIVES
Finditbay — Privacy Officer Privacy requests and general contact: [email protected] Business inquiries: [email protected]
No EEA or UK Article 27 representative has currently been designated. We assess whether GDPR or UK GDPR applies to our activities and whether a representative is required. If an appointment becomes necessary, we will make the representative's contact details available.
19. PROVIDER AND REGULATOR RESOURCES
Google privacy: https://policies.google.com/privacy Matomo privacy information: https://matomo.org/privacy-policy/ Pinterest privacy: https://policy.pinterest.com/en/privacy-policy Amazon privacy: https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ Benable privacy: https://benable.com/privacy Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/ Office of the Information and Privacy Commissioner for British Columbia: https://www.oipc.bc.ca/ Commission d'accès à l'information du Québec: https://www.cai.gouv.qc.ca/ European Data Protection Board: https://www.edpb.europa.eu/ UK Information Commissioner's Office: https://ico.org.uk/
Last updated: