Legal

Privacy Policy

Effective November 1, 2026. Last updated October 27, 2026.

This policy explains how Top Dish Inc. ("Top Dish", "we") collects, uses and shares personal information through the Passes by Top Dish app, our website at topdish.ca and our emails and texts. We follow Alberta's Personal Information Protection Act (PIPA) and, where it applies, Canada's federal privacy law (PIPEDA).

1. What we collect

Account. Name, email, sign-in details (including Apple or Google sign-in), and your birthday. You confirm you're 13 or older when you sign up. If you share your birth year, we also use it to keep anyone under 18 out of ad audiences (section 3). We may use your birthday for birthday offers, if we run them.
Mobile number (optional). In the app, used to text you sign-in codes if you turn them on. On our website and in the app, used for launch news and reminders only if you opt in to texts.
Your preferences (optional). Your usual coffee and milk, the Calgary areas you visit, and how you heard about us. We use these to show you relevant cafés and to understand which of our ads and posts work.
Purchases. The Passes you buy, the price paid, billing status, and for printed Passes the shipping address. Square and Stripe handle your card; we never see the full number.
Pass activity. Redemptions (café, date and time), reviews and ratings.
Gifts. A recipient's name, email or mailing address and the note entered by the buyer. For Passes given by a business, the giver's name, logo, photo and message.
Information others give us about you. If someone buys you a gift, or your employer or café manager signs you up for a Corporate Pass or Industry Pass, they give us your name and email, and for Industry Passes the café you work at.
Location (optional). Your phone's location, only while you're using the app and only if you allow it. It's used to show the cafés closest to you on the map and in the café list. We don't track you in the background, we never use your location for advertising, and we don't share it with cafés.
Notifications (optional). A push notification token, if you allow notifications, so we can tell you about new cafés in your areas and remind you before a Pass ends.
Website. Your email (and mobile number, if you give it) if you sign up for launch news, our emails or texts, with a record of when you agreed and the wording you saw. What's in your cart is saved in your own browser so it's still there when you come back. We also collect pages viewed and similar usage data through cookies and similar tools (section 4).
Forms. What you send through our Corporate Pass quote form (name, company, work email, team size) or café partner form (name, café, email, neighbourhood).
Device and usage. Device type, operating system, app version, screens used and crash reports.
Messages. Emails and messages you send us, including on Instagram (your handle and message), and whether our emails are opened or clicked.

2. How we use it

We use personal information to:

provide the Services and your Passes, including delivering gifts and printed Passes
process payments
send service messages: receipts, Pass delivery, sign-in codes, expiry and subscription notices
keep accounts secure and prevent misuse
answer questions and quote requests
improve the app and website, and measure our marketing
meet legal and accounting obligations

With your consent, we also send promotional emails and texts about Passes, new cafés and offers (section 6).

3. Who we share it with

We don't sell your personal information.

Cafés see anonymized totals on their partner dashboards, such as how many redemptions they had, and the ratings and reviews left for them. They don't get your contact details or location. Staff see your redemption screen, which shows your Pass and when you swiped, when you show it to them.
Organizations that provide Corporate Passes, Industry Passes or partner rates see totals only, such as how many of their people redeemed this month, not what you did. They may confirm to us that you're eligible.
Service providers handle information for us under contract, only to provide their service:
- Square and Stripe (payments)
- Google Cloud and Firebase (app hosting, data storage, sign-in, analytics and notifications)
- Google Analytics (website and app analytics)
- Resend (email)
- our website hosting provider
- Apple and Google (sign-in, app stores and maps)
- Manychat and Meta (Instagram messages)
- a text-message provider (sign-in codes and, if you opt in, marketing texts)
- the postal or courier service that delivers printed Passes
Advertising and measurement. We may use advertising tools such as the Meta Pixel to measure our ads and to show ads to people who visited our website. We may also share a securely scrambled (hashed) email list with an ad platform to reach existing customers or similar people. We only include customers who agreed to our marketing emails, never anyone we know is under 18, and we never use location for ads. To keep your email out of these lists, email hello@topdish.ca with the subject line "Ads".
Legal and business reasons. We share information when the law requires it, to protect people's safety or our rights, or as part of a sale or merger of our business under equivalent privacy protections.

4. Cookies and similar tools

Our website uses your browser's storage to remember your cart and choices, and cookies or similar tools for analytics and, if we run them, ads. You can clear or block these in your browser settings; the site still works, though your cart won't be saved. You can also limit ad tracking in your phone's or browser's ad settings.

5. Storage outside Canada

Our app data is hosted on Google Cloud in the United States. Several of our service providers, including Square, Stripe, Resend, Google Analytics, Manychat and Meta, may also store or process information in the United States or other countries. While it's there, it may be subject to those countries' laws, including access by their authorities. We choose providers that protect information to a standard comparable to Canadian law. To ask about our policies for service providers outside Canada, contact our Privacy Officer (section 12).

6. Your marketing choices

Emails. We send promotional emails only if you've agreed to receive them, or where the law allows it, such as within two years of a purchase. If you signed up on our website only to hear when the Pass goes on sale, we'll send you launch emails only, not our regular news.
Texts. We text you marketing messages only if you opted in. Reply STOP at any time.
Unsubscribing. Every promotional email has an unsubscribe link, and we act on it within 10 business days.
Left-in-cart reminders. Only if you ticked the box to receive our emails or texts: if you leave a Pass in your cart, we may send a reminder email after about 1 hour and again after 3 days, and one text after about 24 hours. They stop as soon as you buy or unsubscribe.
Gift recipients and people signed up by their employer or café aren't added to our marketing unless they opt in themselves.
Push notifications and location can be turned on or off in your phone's settings at any time.

We'll still send service messages about your account, Passes, orders and subscriptions.

7. Keeping it secure

We use reasonable technical, administrative and physical safeguards, including encryption in transit and access limited to the people who need it. No system is completely secure. If a breach creates a real risk of significant harm to you, we'll notify you and Alberta's Information and Privacy Commissioner without unreasonable delay, as the law requires.

8. How long we keep it

Account and activity information: while your account is active. We delete your personal information, or anonymize it so it can no longer identify you, no later than 24 months after you delete your account or after 24 months with no activity.
Email-only sign-ups: until you unsubscribe, or 24 months after you last opened or clicked one of our emails.
Payment and tax records: 6 years, to meet tax and accounting rules.
Anonymized data: we keep anonymized, combined data (such as how many redemptions a café had each month) to run café dashboards and improve the Services. It doesn't identify you.

9. Your rights

You can ask to:

see the personal information we hold about you
correct anything inaccurate
delete your account and personal information, in the app or by email (except records we must keep by law); see how to delete your account
withdraw consent to optional uses, such as marketing, location or your preferences

We'll respond within 30 days. If you're not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

10. Young people

You must be 13 or older to use the Services. We don't knowingly collect personal information from children under 13. If we learn we have, we'll delete it.

11. Changes to this policy

We'll post updates here and change the date at the top. For significant changes, we'll tell you by email or in the app at least 30 days before they take effect. If a change means we'll use your information for a new purpose, we'll ask for your consent where the law requires it.

12. Contact us

Our Privacy Officer is responsible for how we handle personal information. Email hello@topdish.ca with the subject line "Privacy", call (403) 827-1747, or write to Privacy Officer, Top Dish Inc., c/o WeWork, 700 2 Street SW, Floor 19, Calgary, Alberta T2P 2W2.