Privacy Policy

1. Who we are

SubSell – Rachat & Liquidation iPhone ("SubSell", "we") is an independent phone buyback, resale and recycling shop located at 757 Rue Beaubien East, Montreal, QC H2S 1S8, Canada. Phone: 438-258-7895. Email: carol@subselltrade.ca.

This policy explains what personal data we collect via subselltrade.ca, how we use it, and your rights under Quebec Law 25 and the federal PIPEDA.

2. What data do we collect?

We only collect what's necessary to deliver our services:

• Quote and request forms: your name, phone, email, the device (model, capacity, approximate condition and, if you give them, battery health and IMEI), the offer you say applies to you, if any, and any notes you supply.
• Photos of your device (optional): if you add photos to a sell request, they are used only to give you your exact price. Your browser re-encodes each photo before sending it and our server rebuilds it, which removes its embedded data (location included). Photos are hosted by Netlify, the site's host, on servers in the United States, so outside Quebec. Their links, which cannot be guessed, are sent to our team by email and by a WhatsApp alert; anyone holding one of those links can view the photo until it is deleted. They are deleted automatically within 30 days (section 8), and a photo you remove from the form is deleted right away.
• 24h price reservations: the same fields above, plus an expiry timestamp.
• Measurement cookies: pseudonymous identifiers used by Google Analytics 4 (loaded by Google Tag Manager) and by the Google Ads tag to count visits, calls, messages, directions and requests, and to know which ad brought you to us. They are active from your first page and turned off if you click "Decline" in the banner: Google Analytics then runs without cookies and the Google Ads tag is not loaded. Personalized advertising (remarketing) and Microsoft Clarity only start after you accept. See section 6.
• Ad conversion measurement (with your consent): when you send a price request or tell us you are coming to see a phone, and only if you accepted through the consent banner, an irreversible fingerprint (SHA-256) of your email and phone number may be shared with Google so your request can be matched to the ad that brought you to us. Google never receives your email or phone number in the clear. Without your acceptance, no fingerprint is shared.
• Functional cookies: your consent choice and preferred language. Neither of those two holds a personal identifier.
• Prefill on your device: so you don't have to retype everything, your browser keeps your name, phone and email locally after a request is sent (30 days maximum), plus any form in progress in the open tab — model, capacity, condition, IMEI and notes, for up to 12h or until the tab closes. These copies stay on your device, are never transmitted, and the "Not you? Clear" link under the form removes them immediately. See section 6.
• Communication consent: you provide us with explicit consent (via checkbox) to receive transactional messages by email and SMS from SubSell about your quote or your request. Consent is recorded with a timestamp. You can withdraw this consent by replying STOP to any SMS or by emailing us at carol@subselltrade.ca.

3. SMS Communications and Messaging Policy

SubSell uses SMS services through a certified provider (Twilio) to communicate with you about your quotes and requests. This section describes our SMS program in accordance with Canadian carrier requirements (Bell, Rogers, Telus, and others).

Message types

You will only receive transactional messages related to your request, including:

• Confirmation of your request, with your quote or your model's starting price when there is one, our address and our hours
• A reply about your request when it needs one, such as the price of a model with no posted price
• A single follow-up email per request (never a text), usually on the evening of your request (or the next evening, for a request made late in the day): could you come by, do you have a question? You answer in one click if you want to. Our team may also write that follow-up itself, within 30 days, instead of the evening one.

We do not send marketing messages without separate explicit consent: the deals we email from the site go only to people who clicked "Yes, sign me up" (offers after a visit need your yes at the counter, below). The follow-up email and our deals carry an unsubscribe link (one click, then "Unsubscribe"); your email app may also show its own "Unsubscribe" button. This unsubscribe covers the site's emails; the messages after a shop visit stop separately (below).

After a visit to the shop, if you agreed at the counter, you may also receive up to 5 emails and 2 texts over two weeks (a thank-you, tips, our offers, a request for a Google review) and, later on, an occasional offer. Replying STOP to a text or writing to us ends them.

Message frequency

You will typically receive 1 to 3 messages per request. No bulk sending, no spam.

Sample message

"Hi Marc! For a like-new iPhone 15 Pro 256GB, SubSell pays up to [price] cash (or up to [value] as a trade-in toward another phone). Exact price in-store or at subselltrade.ca. 757 Rue Beaubien East, Montreal · 438-258-7895 · Open 7 days 9AM-9PM"

Message rates

Standard message and data rates may apply based on your plan with your mobile carrier. SubSell does not charge any fees for these messages.

How to opt out (STOP)

You can opt out at any time by replying STOP to any SubSell SMS. You will receive a confirmation message and will no longer receive any SMS from us. You can also email carol@subselltrade.ca to opt out.

Help (HELP)

Reply HELP to any SMS to receive our support contact info: phone 438-258-7895 and email carol@subselltrade.ca.

SMS data sharing

Your SMS information is never shared, sold, or rented to third parties for marketing purposes. Data is used exclusively to fulfill your request and is securely stored at Supabase (encrypted at rest and in transit). The only technical partner involved is Twilio (our SMS messaging provider), which acts solely as a data processor.

Consent and compliance

Your consent to receive SMS is explicit and obtained via an unchecked checkbox on our forms. Consent is timestamped and retained in accordance with CASL (Canadian Anti-Spam Legislation) and Quebec Law 25.

4. How do we use your data?

• To contact you about your quote or your request.
• To honour the locked price for 24 hours.
• To keep the legal record required for any electronics resale in Quebec.
• To improve our site (anonymized analytics).
• To send you, only if you explicitly request it, an offer or a bonus for your next visit.

We never sell your data. We share it only with: (a) Supabase (database hosting, encrypted at rest and in transit), (b) Google (audience and ad conversion measurement, turned off if you decline), (c) Netlify (hosting of the site, of the optional photos of a sell request and of the data behind our follow-up emails, section 8), (d) Resend (sending the confirmation emails, the follow-up email and promotions to subscribers), (e) Twilio (sending the confirmation texts) and (f) CallMeBot (a WhatsApp alert telling our team about a new request, photo links included). Some of these providers process data outside Quebec, notably in the United States.

5. Your rights under Quebec Law 25

Law 25 grants several rights over your personal data. You can at any time:

• Right of access: request the list of all data we hold about you.
• Right of rectification: correct any inaccurate data.
• Right of deletion: request full deletion of your record (subject to legal retention requirements).
• Right of portability: receive a copy of your data in a machine-readable format.
• Right to withdraw consent: decline measurement cookies or revoke your advertising consent at any time via the "Cookie preferences" link in the footer.

To exercise these rights, write to carol@subselltrade.ca. We respond within 30 days.

6. Cookies in use

Measurement cookies (Google Analytics, Google Ads) are active from your first page to count visits and requests; the banner's "Decline" button turns them off. Personalized advertising, the fingerprint of your contact details and Microsoft Clarity only start after your explicit acceptance.

7. Data security

All data is transmitted over HTTPS (TLS 1.3) and stored in Supabase with encryption at rest (AES-256), except the optional photos of a sell request (section 2) and the data behind our follow-up emails (records, reply links, answers, subscriptions and unsubscribes, section 8), hosted at Netlify. Admin dashboard access is protected by email/password authentication via Supabase Auth. No data is kept in clear on the shop's local computer.

8. Data retention

By default we retain data for 24 months after your last interaction. Transaction records must by law be retained for 7 years for tax and second-hand-electronics regulations. After these periods data is irreversibly deleted from our systems and Supabase.

The prefill copies described in sections 2 and 6 are not in our systems: they stay in your browser's local storage, on your device, and are never transmitted to us. They expire on their own (30 days for your contact details, 12h or the tab closing for a form in progress) and you can remove them at any time with the "Not you? Clear" link under the form, or by clearing site data in your browser.

The data behind our follow-up emails is hosted at Netlify. The follow-up records hold your name, your email, the type, devices, condition and prices of your request (and, where it applies, the offer you mentioned and your choice between cash and trade-in), and a fingerprint of the network the request came from, which changes every day (to block abuse): they are deleted after 30 days. The reply and unsubscribe links in our emails work for 400 days, then are deleted along with what they hold (your name, your email, the device and the type of your request). Your one-tap answers and the history of what we sent (with the device concerned) are tied to a fingerprint of your email address (a code computed from it), not to the address itself, and erased after 400 days. If you subscribe to our promotions, the proof of your subscription (date, name, address, browser, the wording you accepted) is kept while the subscription is active. If you unsubscribe, we keep the fingerprint of your address, so we send you no more follow-ups or promotions (if you subscribe again later, only the promotions resume), and the date and wording of your past subscription, without your address, your name or your browser; your follow-up records and the links already sent are deleted on schedule (30 and 400 days).

Photos you add to a sell request are deleted automatically within 30 days of being sent. Write to us to have them deleted sooner.

9. Changes to this policy

Material changes will be announced on this page with an updated date. If a change affects your rights we will notify you by email.