BAYO.Social Privacy Policy
Effective Date: November 18, 2025
Last Updated: November 18, 2025
At BAYO.Social, we recognize that backing up your social network profile is an act of deep trust. Because our company is headquartered in Montreal, Quebec, your privacy is protected under the strictest laws in North America, including Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Our commitment is to transparency, explicit user consent, and security measures suitable for handling your most sensitive archived digital content.
1. Our Designated Privacy Officer (PO)
Under Quebec law, the organization must designate a Privacy Officer responsible for compliance and handling all user inquiries and requests.
Title: Privacy Officer
Organization: BAYO.Social
2. What Information We Collect and Why
We commit to the principle of Data Minimization, collecting only the information strictly necessary to provide our core archival and backup service.
A. Information You Provide Directly
This data is required for setting up and managing your account:
Identification: Name, email address, phone number, and mailing address.
Account Access: Encrypted login credentials.
Financial Data: Payment information (used by our secure payment processor for billing).
B. Social Network Profile Data (The Backup Content)
This data is the core purpose of our service, collected only after you grant us explicit, informed, and granular consent. It constitutes the full copy of your selected social media profile, which may include:
Content and Interactions: Posts, status updates, photos, videos, public activity logs, and private communications.
Personal Characteristics: Contacts, usage data, and location information.
Important Note on Sensitive Information: Due to the nature of social media content, the data you archive may inherently contain Sensitive Personal Information (SPI), such as details about your health, religious beliefs, racial or ethnic origin, or precise geolocation, if you previously shared this information on the source network. We treat all backed-up content with the highest level of security suitable for SPI.
C. Technical and Operational Data
We collect limited technical data (e.g., IP address, device identifiers, service usage logs) solely for the purposes of troubleshooting, security, system maintenance, and measuring the performance of our service.
3. Consent and How We Use Your Data
A. Explicit and Granular Consent
Under Law 25, we require explicit, informed, and opt-in consent before we collect, use, or disclose your personal information, including the use of non-essential tracking technologies.
We provide a granular consent interface during the setup process, allowing you to select or deselect specific categories of data (e.g., backing up photos but excluding private messages), ensuring your consent precisely matches the data we process.
B. Purpose Limitation
Your archived personal data is used only for the primary stated purpose: providing the archival and backup service.
We do not use your backed-up social data for secondary commercial activities, such as user profiling, behavioral advertising, market research, or training generalized Artificial Intelligence (AI) models, unless we obtain new, separate, explicit consent for that specific purpose.
4. Your Privacy Rights (Data Subject Rights)
As a user of BAYO.Social, you have comprehensive rights over your data, reflecting the standards of Law 25 and GDPR. To exercise any of these rights, please contact our Privacy Officer (see Section 1). We will respond to all statutory requests within approximately 30 days.
| Your Right | Description |
| Right to Access & Rectification | You have the right to request a copy of the personal information we hold about you and to challenge the accuracy or completeness of that data, requesting corrections where necessary. |
| Right to Data Portability | You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data directly to another organization or service of your choice, where technically feasible. |
| Right to Erasure (Right to be Forgotten) | You can request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected, or when you withdraw your consent. |
| Right to Object/Restriction | You can object to the processing of your data based on legitimate interests, or request that we restrict the processing of your data while an issue (such as accuracy) is being investigated. |
A Note on Erasure in Backup Systems:
When you request deletion or withdrawal of consent, your data is immediately and irreversibly removed from all active and accessible production systems (Logical Deletion). Your data may remain secured within our disaster recovery archives and backup systems until that specific backup cycle is automatically overwritten. During this limited period, your data is cryptographically "placed beyond use," meaning it is secured, inaccessible, and will not be processed, restored, or used for any operational purpose other than necessary system-wide restoration.
5. Data Security, Storage, and Transfers
A. Security Measures
We maintain robust Technical and Organizational Measures to protect your data. These safeguards include:
Encryption: Using state-of-the-art encryption to secure your data both when it is stored (at rest) and when it is being transmitted (in transit).
Access Controls: Strict access limitations based on the principle of least privilege, ensuring only essential personnel can access data required for their specific duties.
B. Data Retention and Destruction
We retain your personal information only for the duration necessary to fulfill the purposes for which it was collected, or to satisfy legal or compliance obligations. Your core backup data is retained for the duration of your active account. Upon termination, data is destroyed or irreversibly anonymized according to our scheduled destruction protocols.
C. Cross-Border Data Transfers
Since BAYO.Social’s services may use cloud infrastructure outside of Quebec, we are required to conduct a thorough assessment before any data is transferred internationally.
Assessment: We assess the jurisdiction to ensure the personal information receives a level of protection equivalent to that provided under Quebec Law 25.
Contracts: We enter into formal, written agreements with all receiving third parties (e.g., cloud providers) that legally bind them to strict confidentiality, purpose limitation, and destruction mandates.
Notification: You will be informed when your information is transferred outside of Quebec.
6. Children's Privacy
We are committed to protecting the privacy of minors. If a user is under 14 years old, we require the express permission of a parent or guardian to process their personal information. If we discover that a user's data was collected without the required parental consent, we will promptly delete the associated profile and data.
Furthermore, any individual who provided consent to use the service while they were a minor has the right to request the subsequent erasure of that data, regardless of their current age.
7. Incident Response and Breach Notification
In the event of a security breach that poses a real risk of significant harm to individuals (PIPEDA) or a risk of serious injury (Law 25), we will immediately notify:
The Commission d’accès à l’information (CAI) of Quebec.
The Privacy Commissioner of Canada (OPC).
All affected individuals, detailing the breach, the steps we are taking, and measures they should take to protect themselves.
We maintain rigorous records of all breaches, regardless of the level of harm, to ensure accountability and verification of compliance.
8. Changes to this Privacy Policy
We may update this Privacy Policy periodically. We will formally notify you of any material changes and maintain a clear version history on our website. We encourage you to review this policy regularly to stay informed about how we are protecting your information.
9. Contact Information
For all inquiries, requests regarding your Data Subject Rights, complaints, or disputes related to this policy, please contact our designated Privacy Officer: