1. WHO WE ARE
9570-1454 Québec inc., doing business as Nubia Hub ("Nubia," "we," "us," "our"), is the entity responsible for the personal information collected through:
- The website www.nubiahub.ca;
- The Nubia Hub mobile application (iOS and Android); and
- Any other product, feature, or service that links to this Privacy Policy (collectively, the "Services").
Privacy Officer. We have designated our Chief Executive Officer as our Privacy Officer in accordance with section 3.1 of the Act respecting the protection of personal information in the private sector (Quebec) (the "Quebec Privacy Act," also known as "Loi 25"). You can reach our Privacy Officer at:
9570-1454 Québec inc. 4388 Saint-Denis, suite 200, H2J2L1 Montreal, Quebec, Canada
This Privacy Policy is incorporated into and forms part of the Customer Terms of Service and the Pro Agreement.
2. SCOPE
This Privacy Policy applies to personal information we collect from:
- Customers who use the Services to discover and book beauty services;
- Pros (independent beauty professionals, salons, and businesses) who list services and accept Bookings;
- People whose details a Pro adds to the Services as one of the Pro's own clients (Section 3.4);
- Visitors to our website; and
- Anyone who contacts us.
It does not apply to information collected by Pros independently of the Services (e.g., information you give a Pro directly, off-platform), or by third-party services we link to or integrate with (which have their own privacy policies).
3. PERSONAL INFORMATION WE COLLECT
We collect only the information we need to provide the Services. The categories below explain what we collect and where it comes from.
3.1 Information you give us
| Category | Examples |
|---|---|
| Identity and contact | Name, email, phone number, language preference, date of birth (Pros only, for tax-reporting compliance) |
| Account credentials | Encrypted password (we never see your plaintext password), authentication tokens |
| Profile | Profile photo, biography, preferences, hair type or other characteristics you choose to share |
| Service listings (Pros) | Services offered, prices, availability, business address, business registration / NEQ, GST/QST numbers, staff list |
| Tax information (Pros) | Legal name, address, tax identification numbers (SIN, business number, GST/QST), date of birth or business registration date — collected to comply with Canadian platform tax-reporting rules |
| Booking content | Service selected, date and time, location, notes you add to a booking, in-app messages between Customers and Pros |
| Photos and images | Profile pictures, portfolio images (Pros), photos you upload to support reviews or appointments, photos you submit to AI features (Section 7) |
| Reviews and ratings | Star rating, written review, photos you choose to attach |
| Payment details | Card brand and last four digits (we do not store the full card number — Stripe does) |
| Address | Mobile-service address, billing address |
| Communications with us | Emails, support requests, dispute submissions |
| Marketing preferences | Whether you opted in to non-essential communications |
3.2 Information collected automatically when you use the Services
| Category | Examples |
|---|---|
| Device and technical | Device model, operating system, app version, language and time-zone settings, crash logs, performance metrics |
| Usage | Screens viewed, taps, search queries, features used, session duration |
| Approximate location | Derived from IP address; used for nearby-Pro discovery and fraud prevention |
| Precise location | Only with your OS-level permission; used to find Pros near you, to show your mobile-service appointment address, or to support map features |
| Push notification tokens | If you allow notifications |
3.3 Information we receive from third parties
| Source | Examples |
|---|---|
| Stripe (payment processor) | Confirmation that a payment succeeded, last four digits and brand of the card used, refund and chargeback events, KYC status (for Pros) |
| Identity / authentication providers | If you sign in with Apple or Google, the basic profile data those providers share with us (name, email, profile picture) |
| Other Customers and Pros | Information they share that involves you, for example a Pro adding a Customer note to a Booking, recording a no-show, or blocking you from booking with them |
We do not purchase personal information from data brokers.
3.4 Clients added by Pros
A Pro can add their own clients to the Services, for example by importing a client list or entering a walk-in client's details. For this information, the Pro decides what to add and remains responsible for it; we hold and process it on the Pro's behalf, only to provide the Services to that Pro. These clients remain the Pro's clients. If you are one of them, you can contact the Pro, or our Privacy Officer at legal@nubiahub.ca, to access or correct your information.
4. WHY WE COLLECT IT (PURPOSES)
We use your personal information for the following purposes:
- Operating the Services — creating and managing your account, listing services, processing Bookings, sending booking confirmations, managing cancellations and refunds, displaying tax receipts.
- Payments — processing Customer payments, paying Pros, calculating fees, managing tips, handling refunds and chargebacks, complying with anti-fraud and anti-money-laundering rules.
- Communications — transactional messages (booking confirmations, reminders, account-security alerts, password resets, dispute notices). With your separate, express consent, we may also send marketing or promotional communications. You can opt out of marketing at any time.
- AI-powered features — generating hair-scan suggestions, translating Pros' listings and profiles, and screening comments before they are published (Section 7).
- Customer support and dispute resolution — answering questions, resolving issues, handling Customer↔Pro disputes.
- Trust, safety, and fraud prevention — detecting fraudulent payments, abusive accounts, fake reviews, harassment, spam, and other harmful activity; screening comments for harmful content (Section 7); letting Pros record no-shows and block Customers from booking with them (Section 5.1); verifying Pros and their information.
- Improving the Services — analyzing how users interact with the Services to improve features, fix bugs, and develop new functionality. Where possible, we use aggregated or anonymized data for this.
- Legal compliance — complying with applicable law, including Canadian platform tax-reporting rules (Bill C-47), tax remittance, anti-spam law (CASL), privacy law (Loi 25 / PIPEDA), and lawful requests from authorities.
- Business operations — corporate accounting, audits, insurance, dispute resolution, and protecting our legal rights.
We will not use your personal information for purposes materially different from those above without informing you and, where required, obtaining your consent.
5. HOW WE SHARE PERSONAL INFORMATION
We share personal information only where it is necessary to operate the Services or where required by law. We do not sell personal information.
5.1 With Pros (when you are a Customer)
When you book a service, we share with the Pro the information they need to deliver it: your name, the service booked, date and time, location (your address for mobile services or the salon for in-salon services), and any notes you added. We may also share your phone number so the Pro can reach you about the appointment. Pros are contractually required to use this information only to deliver the booked service and not to market to you off-platform without your separate CASL-compliant consent (see Section 18 of the Pro Agreement).
No-shows and blocks. A Pro can record that you did not show up for an appointment, and can block you from booking with them. These records stay with that Pro: they are visible to the Pro and its staff, and to you (you may see a reminder of your no-shows when you book with that Pro). They are not shared with other Pros.
5.2 With Customers (when you are a Pro)
The Pros we publish on the Services have public-facing profiles (business name, services, location, photos, reviews). Customers see this. Your personal banking information, tax IDs, and other sensitive information are not shared with Customers.
5.3 With service providers
We rely on trusted service providers to operate the Services. They access only the information they need and only for the purposes we direct.
- Stripe Payments Canada, Ltd. — payment processing, KYC for Pros, payouts, refunds, chargebacks. Stripe operates under its own privacy practices.
- Cloud hosting and infrastructure providers — to host the application, databases, and backups.
- Communications providers — to send transactional email and push notifications.
- Analytics and crash-reporting providers — to help us understand product use and fix errors. We aim to use anonymized or pseudonymized data here where practical.
- Customer support tooling — to manage support tickets and disputes.
- Third-party AI service providers — to power hair-scan analysis, comment moderation, and automatic translation (Section 7).
- Professional advisors — accountants, lawyers, auditors, insurers under confidentiality obligations.
Where service providers are located outside Quebec, the cross-border-transfer rules in Section 6 apply.
5.4 With the Canada Revenue Agency (Pros only)
Under Canadian platform tax-reporting rules, we are required to report annually to the Canada Revenue Agency (and to any other tax authority where the law requires it) the consideration paid through the Services to each in-scope Pro, together with the identifying information we collect for that purpose. We will provide Pros with a copy of the report each year.
5.5 For legal reasons
We may share personal information when we reasonably believe it is necessary to:
- Comply with a law, regulation, court order, subpoena, or other legal process;
- Respond to lawful requests from public authorities (including law enforcement, fiscal authorities, and regulators);
- Enforce our agreements (Customer Terms of Service, Pro Agreement);
- Protect the rights, property, or safety of Nubia, our users, or the public;
- Detect, prevent, or address fraud, security, or technical issues.
5.6 Business transfer
If Nubia is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will require the recipient to honour the commitments in this Privacy Policy or notify you of any material changes to how your information is used.
5.7 With your consent
We share personal information for any other purpose with your consent.
6. CROSS-BORDER TRANSFERS
Your personal information may be processed and stored in Canada and the United States.
Some of our service providers (including hosting infrastructure, payment processing, communications, AI providers, and analytics) operate servers in those jurisdictions. The legal protections that apply to personal information in the United States may differ from those in Quebec, and U.S. authorities may, in certain circumstances, have access to personal information stored on U.S. servers under U.S. law.
In line with Loi 25, before transferring personal information outside Quebec, we conduct a privacy impact assessment taking into account:
- The sensitivity of the information;
- The purposes of use;
- The protective measures (including contractual safeguards) applied to the information; and
- The legal framework of the destination jurisdiction.
We use contractual safeguards with our service providers (typically standard data protection clauses) to ensure the information receives a level of protection equivalent to that required by Quebec law.
7. AI-POWERED FEATURES
The Services include the following AI-powered features:
- Hair-scan analysis — suggests your hair type from a photo you submit.
- Comment moderation — before a comment is published in the gallery, its text is checked automatically to detect harmful content (such as harassment, hate, violence, or sexual content). A flagged comment is not published, and we keep a record of it to prevent abuse. If you think a comment was blocked by mistake, contact us at info@nubiahub.ca.
- Automatic translation — the text of Pros' listings and profiles (for example, service and product descriptions) can be translated automatically between French and English.
For these features:
- The content (a photo or text) is transmitted to a third-party AI service provider, which may process it on servers outside Quebec, including in the United States;
- The provider returns a result (a hair-type suggestion, a moderation decision, or a translation) and we use it as described above;
- We do not retain photos used solely for AI hair-scan analysis beyond what is needed to generate the result. Photos are not stored in our database or used to train AI models;
- AI suggestions and translations are informational only; hair-type suggestions are not professional advice or diagnosis;
- Hair-scan analysis is optional. You can use the Services without it.
We may add or change AI providers from time to time. Material changes to how we process personal information through AI features will be communicated as part of updates to this Privacy Policy.
When we make a decision about you based exclusively on automated processing of your personal information, we will, in line with Loi 25:
- Inform you that the decision was made by automated means, at the latest when we inform you of the decision;
- On request, tell you what personal information was used and the reasons, principal factors, and parameters that led to the decision;
- Allow you to have that information corrected, submit observations, and request a review by a person.
Comment moderation (above) is such a decision: when a comment is not published, the App tells you at that moment. To exercise these rights, contact our Privacy Officer at legal@nubiahub.ca. We do not use automated decision-making for any other decision about you. If we add such use in the future, we will update this Policy.
8. COOKIES AND SIMILAR TECHNOLOGIES
The Services use cookies, mobile SDKs, and similar technologies for purposes including:
- Strictly necessary — keeping you signed in, remembering your language preference, securing the session;
- Analytics — measuring product usage and performance;
- Crash and error reporting — diagnosing problems.
Strictly necessary technologies operate by default. Where we use non-essential analytics or marketing technologies, we will obtain your consent in line with applicable law and you can withdraw it through the in-app settings or your device's privacy settings.
The mobile App may also use operating-system-level identifiers (e.g., Apple's IDFA, Android's Advertising ID). On iOS, we follow Apple's App Tracking Transparency framework and request permission before any tracking across other apps and websites.
9. YOUR RIGHTS
Subject to applicable law, you have the following rights regarding your personal information.
9.1 Right of access
You can ask us to confirm whether we hold personal information about you and to receive a copy.
9.2 Right of rectification
You can ask us to correct inaccurate, incomplete, or out-of-date personal information. Most Customer-facing fields can be edited directly in the App.
9.3 Right to deletion (right to be forgotten)
You can ask us to delete personal information that is no longer necessary for the purposes for which it was collected, where consent is the only legal basis and you have withdrawn it, or in other cases provided by law. We may retain information where required by law (for example, tax records for 7 years), to defend a legal claim, or for fraud prevention.
9.4 Right to data portability (computerized personal information)
You can ask us to provide certain personal information you provided to us in a structured, commonly used technological format, or to transmit it directly to another organization where technically feasible.
9.5 Right to deindexing or re-indexing
You can ask us to cease disseminating personal information or to deindex any hyperlink that gives access to it where its dissemination causes you serious injury that is not justified by the public interest.
9.6 Right to withdraw consent
Where we rely on your consent to process personal information, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
9.7 Right to object to automated decision-making
See Section 7.
9.8 How to exercise your rights
Contact our Privacy Officer at legal@nubiahub.ca with your request. To protect you, we may need to verify your identity before acting on a request. We will respond within 30 days. Where the request is complex or numerous, we may extend the response period and inform you.
The first request in any given context is free. Where requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, in line with applicable law.
9.9 Right to complain
If you are dissatisfied with how we handle your personal information, you have the right to lodge a complaint with:
- The Commission d'accès à l'information du Québec (CAI) — for Quebec residents (cai.gouv.qc.ca); and/or
- The Office of the Privacy Commissioner of Canada (OPC) — for federal matters (priv.gc.ca).
We encourage you to contact our Privacy Officer first so we can try to resolve your concern.
10. RETENTION
We keep personal information only for as long as necessary for the purposes set out in this Privacy Policy or as required by law. Indicative retention periods:
| Category | Retention |
|---|---|
| Account information | While your account is active and for a reasonable period after closure to handle disputes, fraud, and legal claims |
| Booking records, transactions, payment data | 7 years to comply with Canadian tax law and accounting obligations |
| Pro tax-reporting records | 7 years from the end of the relevant tax year |
| Customer Support records | Up to 3 years after closure of the matter |
| Marketing-consent records | At least 3 years after withdrawal of consent (CASL recordkeeping) |
| Cookie / analytics data | Per the lifetime of the cookie; aggregated metrics retained longer in anonymized form |
| AI hair-scan input photos | Not retained beyond the time required to return a result |
| Records of comments blocked by moderation | Until your account is deleted |
| Server logs and security logs | Up to 12 months |
When personal information is no longer needed and is not subject to a legal retention obligation, we destroy or anonymize it.
11. SECURITY
We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, role-based permissions, audit logging, and separation of production data. Payment card information is handled by Stripe under PCI-DSS standards.
No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security. If you suspect unauthorized access to your account, contact us immediately at info@nubiahub.ca.
12. CONFIDENTIALITY INCIDENTS (DATA BREACHES)
If we experience a confidentiality incident that poses a risk of serious injury to you, we will, in line with Loi 25 and PIPEDA:
- Take reasonable measures to reduce the risk;
- Notify the Commission d'accès à l'information (CAI) and any affected individuals as soon as practicable;
- Where required, notify the Office of the Privacy Commissioner of Canada;
- Maintain a register of incidents.
If you believe your information has been compromised, contact our Privacy Officer at legal@nubiahub.ca.
13. CHILDREN AND MINORS
The Services are intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18 who registers for an account.
A Customer aged 18 or older may book a service for a minor in their care. In that case, the adult is the contracting party and is responsible for any personal information about the minor that they provide. Adults must not upload photos of minors without legal authority.
Under Loi 25, personal information of a minor under 14 years of age can only be collected with the consent of a person having parental authority, except when the collection is clearly for the minor's benefit. Because we do not knowingly collect from minors and adults are the contracting parties for minors in their care, we do not generally collect personal information of minors under 14. If we discover that we have, we will delete it promptly.
14. MARKETING COMMUNICATIONS
We send transactional communications (booking confirmations, reminders, account-security alerts, dispute notices) because they are necessary to deliver the Services you have asked for. These are not commercial electronic messages under Canada's Anti-Spam Legislation (CASL) and do not require separate consent.
We send marketing or promotional communications only with your separate, express opt-in consent, captured outside the Terms of Service (typically via a non-pre-checked toggle in your account settings or signup flow). You can withdraw consent at any time through your account settings, by clicking unsubscribe links in our emails, or by emailing info@nubiahub.ca.
We do not send SMS messages.
15. THIRD-PARTY LINKS AND CONTENT
The Services may contain links to third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before sharing information with them.
16. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. The "Last updated" date is revised when changes take effect.
For material changes (such as new categories of personal information, new purposes that materially expand how we use your information, new recipients, or changes to your rights), we will provide advance notice by email and/or in-app notice and, where required, obtain your renewed consent.
17. LANGUAGE
This Privacy Policy is made available in French and English. The French version is the authoritative version. In the event of any conflict or inconsistency between the French and English versions, the French version prevails.
La présente Politique de confidentialité est disponible en français et en anglais. La version française est la version qui fait foi. En cas de divergence entre les versions française et anglaise, la version française prévaut.
18. CONTACT
Privacy Officer / Loi 25 / privacy questions and rights requests: legal@nubiahub.ca
General customer support: info@nubiahub.ca
Mailing address: 9570-1454 Québec inc. 4388 Saint-Denis, suite 200, H2J2L1 Montreal, Quebec, Canada