This document has not been adopted as final policy. Operator identity, designated privacy contact, provider arrangements and retention decisions require confirmation. Registration does not record acceptance of this draft.
1. Who is responsible
MBList is Canadian owned, operated, and hosted. The exact legal organisation responsible for personal information and its designated privacy contact have not yet been verified for this review draft. The Contact MBList form is an existing enquiry channel; it is not presented as a verified privacy officer’s direct address.
Developed by Netvibes Infotech Ltd., Surrey, British Columbia. This credit identifies the developer and does not establish that the developer is the legal operator or organisation responsible for your personal information.
2. Information collected
Accounts use an email address, login identity and protected password credentials. Optional profile information includes a display name and avatar. Saved businesses, saved events and notification preferences are associated with your account. The current local configuration supports email registration and verification; Google sign-in exists in the application but is not configured locally.
Business forms collect profile information such as name, address, contact details, website, categories, services, hours, service areas, attributes and public images. Claims and access requests additionally collect the representative’s name, role, email, phone, chosen verification method, optional evidence and submission status. Claim draft data and upload references can be retained before final submission.
Reviews include a rating, text, date, account relationship, possible business reply and moderation records. Articles include title, content, category, images, genuine author, associated business, publishing status and guideline acceptance version/time. Deals contain offer descriptions, pricing, terms, dates, images, submitter and pricing-accuracy confirmation. Reports and moderation feedback are retained with these records. Event information is imported from Ticketmaster.
Contact enquiries collect your name, email, reason, message, optional business/page context and account link when signed in. Delivery status and staff notes are stored. Technical requests reveal an IP address and browser details to the application, infrastructure and relevant providers; security and rate-limit mechanisms use this information. Do not include unnecessary sensitive information in searches or public submissions.
Optional search analytics collect redacted search text, selected category/city, approximate coordinates, result positions/counts, device category, action type, timestamps and a daily pseudonymous visitor hash. The analytics tables do not store a raw IP address, email, user ID or session ID. That does not mean every server or provider log is free of identifying information. There is no MBList checkout storing card numbers or payment references.
3. Sources of information
Information comes from you, approved business representatives, people who review or report content, source websites requested through the optional website lookup, configured business imports/public licence sources, Ticketmaster event imports and technical interactions with the service.
Imported or publicly available information can still include personal information. Its public availability is not treated as unrestricted permission for every reuse. Contact MBList to raise a concern about a source, inaccurate record or inappropriate disclosure.
4. Why information is used
Account and authentication information operates sign-in, email verification, password recovery and your profile. Saved items and preferences provide the account features you request. Representative details and evidence help staff assess claims and assign appropriate management access; approved business information operates the public directory.
Content and submission records support publication, display, reports, moderation and feedback. Guidelines acceptance and, when adopted terms are presented, Terms acceptance records evidence the version and time of an affirmative submission. Support messages and contact details are used to respond to your enquiry and route it to the relevant team.
Technical request information supports delivery, fault diagnosis, abuse prevention and access controls. Optional analytics, only after your choice, help MBList and eligible business managers understand aggregate discovery and interactions. Website lookup and geocoding help prepare or locate the business details you request. These purposes do not authorise unrelated future uses or automatic marketing enrolment.
5. What becomes public
Approved business pages display business contact/location details, descriptions, services, hours, selected attributes and approved public images. Published articles display the article, excerpt, images, genuine author byline and dates. Public reviews display rating, text, date and the displayed member identity, including an avatar where used; business replies can also be public. Active deals and imported event/venue details appear on public pages.
Profile display names may fall back to a real name, first name, email prefix or login name when no display name is provided. Choose a suitable display name in account settings before posting if you prefer to avoid exposing a personal identifier. Public pages can be indexed or cached by search engines and referenced by other services.
Claim evidence, representative verification details, passwords, saved-item lists, support messages, reports and staff notes are not intended for public publication. Claim evidence is accessed through the staff-protected download route, and direct proof-media URLs are blocked by application and deployment rules. Do not upload evidence as a public business or article image. Removal from MBList does not immediately remove external caches or previously distributed copies.
6. Cookies and similar storage
Essential storage includes the session cookie used for sign-in and claim drafts and the CSRF cookie used to protect forms. The configured session-cookie lifetime is two weeks and the CSRF-cookie lifetime is one year; browser settings, logout and session cleanup can affect availability. Blocking essential cookies may prevent account or submission features from working.
The privacy-preference cookie records whether you allow optional first-party analytics. It lasts up to six months and contains a choice/version rather than your name. Optional search/click analytics and their browser script remain off until you choose Allow analytics. Essential only keeps optional analytics off. You can revisit Privacy preferences from the footer, change your choice or clear browser storage. Changing the choice stops future optional collection; it does not automatically erase earlier records.
When analytics is allowed, sessionStorage holds signed per-business search tokens for the current browser tab so clicks can be related to the search that showed a result. Dashboard localStorage can remember collapsed navigation and layout preferences. Some legacy listing surfaces remember theme/map presentation preferences locally. These preferences are not advertising identifiers.
No Google Analytics, Meta pixel, ad-network tracking script or marketing cookie integration was found in the active templates. External fonts/icons, maps, provider-hosted images and videos still make provider requests and may involve their own technical storage. The analytics choice controls MBList’s optional analytics, not every separate provider’s service; use provider/browser controls and avoid opening optional provider features if you do not want those requests.
7. Location and maps
A selected city or typed area tells MBList where to search; it is different from your current device position. Browser coordinates are requested only after you intentionally choose a location feature, such as sorting results by nearest. Your browser asks for permission and you may decline it.
Coordinates are used in the search request and may appear in the page URL, browser history and infrastructure request logs. MBList’s optional analytics rounds coordinates to two decimal places, approximately a kilometre, rather than storing the precise position in analytics rows. A fixed retention schedule for infrastructure logs has not been established in the inspected project.
Google map display sends technical requests and map information to Google; address lookup/geocoding can send typed business addresses or requested locations. Directions links pass destination details to the external provider. MBList does not continuously track your movement or provide live navigation. Revoke location permission using your browser settings if you no longer want to provide device coordinates.
8. Sharing and service providers
Necessary providers can receive information needed to deliver a requested feature: hosting/storage infrastructure handles application records and uploads; the configured SMTP service handles message recipients, subjects and bodies for verification, password recovery, enquiry receipts, claims and moderation notices. The local SMTP host is Gmail. Access by staff is controlled by account roles and purpose-specific permissions.
When you send an enquiry to a listed business, the message, name, reply email and optional phone number are shared with its enabled enquiry recipient and are available to its authorised managers in the enquiry inbox. This differs from a general Contact MBList request routed to the platform team. Choose the intended recipient before submitting.
Google receives map and geocoding requests. Ticketmaster supplies imported event data and receives requests when you follow its links; the background import does not send your MBList account to Ticketmaster. External business sites and provider-hosted images, fonts/icons, YouTube or Vimeo receive browser requests when those resources are used. Google identity exchange applies only where sign-in is configured and intentionally selected; the integration does not store OAuth access tokens.
The optional Fetch details website feature retrieves the public website you supply. With the currently configured OpenAI integration, extracted URL, title, metadata, website text/structured data and business classification options are sent to OpenAI for suggestions. Private claim evidence, account passwords and support messages are not part of that extraction request. The request sets store=false, but that setting alone is not a guarantee about all provider retention, training or processing locations. Review suggestions before saving; you may enter business details manually without using this feature.
First-party analytics is held in MBList’s database; eligible verified business managers see aggregate reports and low-volume search terms are grouped. Staff have broader authorised administrative access. Disclosure may also be required by applicable law or reasonably necessary to address fraud, safety or a legal claim. No data-sale or advertising-audience export mechanism was found in the application; commercial arrangements outside the code must be confirmed before an absolute statement about selling information is made.
9. Hosting and international processing
The owner states that MBList’s application is hosted in Canada. Canadian hosting does not establish that all email, Google, OpenAI, external-resource or backup processing takes place in Canada. Provider contracts, processing regions and backup locations have not been verified in the inspected configuration.
External providers may process information outside Canada, where it may be subject to local laws and lawful access. The responsible organisation should assess those arrangements and remain accountable for information entrusted to service providers. We do not claim that every third party uses exclusively Canadian facilities.
10. Consent and communications
Read the notices associated with the feature you use and provide information appropriate to that purpose. You can decline optional analytics, avoid website-assisted extraction, choose not to provide browser location, and use account settings to change saved items and available preferences. Contact MBList about withdrawing consent to other handling, subject to applicable legal or contractual limits; withdrawal can affect a service that needs the information.
Account verification, password recovery, requested enquiry receipts and claim/moderation updates serve operational purposes. Registration, a listing submission or contacting support does not subscribe you to promotional email. The stored reply/event notification preferences are currently preferences for future senders; those notification systems are not operational and are not described as a working marketing subscription.
No active newsletter or promotional-email enrolment/unsubscribe workflow was found. Any future marketing programme needs a separate affirmative choice, sender identification and a working unsubscribe method. Privacy notice acknowledgement is not blanket permission for every data use, and Blog Posting Guidelines acceptance remains separate.
11. Retention and deletion
Information is retained for the purpose for which it is needed, including account operation, claim verification, publication, support, security, disputes and applicable legal obligations. Most account, claim, enquiry, content, audit and infrastructure records currently have no general automatic retention/deletion schedule in the application. Those schedules and backup disposal periods require operator review rather than an invented promise of immediate erasure.
Raw analytics events, impressions and clicks have a configured 90-day cutoff implemented by the purge command. Deletion depends on running that scheduled command; daily aggregated reports are retained without a configured expiry. The scheduler/deployment examples are not evidence that every production environment runs the job successfully.
Account closure removes the user, profile/avatar, saved items, email identities and authentication connections. Reviews remain without the user link and are displayed as from a former member; their text may still identify someone. Public business listings are reassigned and remain available. Claim and management-link records retain representative contact details and evidence while losing the user link; contact, moderation and audit records may remain. Authored blog records cascade on account deletion, but uploaded blog files do not have a general cascade cleanup job. Delete a review separately before closing your account if you want its text removed.
Draft deletion and staff removal are different: staff-removed content and reports may remain privately for review or evidence. Backup copies, stored uploads and external caches need separate handling. Contact MBList about a specific record so the request can be assessed with applicable retention requirements.
12. Security
The application uses password hashing, authenticated account access, role and business-ownership checks, CSRF protection, rate limits and content/upload validation. Article HTML is sanitised before storage and display. Website lookup restricts destinations to reduce unsafe server requests, and staff evidence downloads use private/no-store response headers.
These safeguards reduce risks but do not guarantee perfect security. Hosting access, transport security, backup encryption, provider arrangements and operational audits must be verified in the deployment environment; this notice does not claim certifications or completed audits. Do not send passwords or unnecessary identity documents through public forms.
13. Access, correction and complaints
Use Contact MBList to request access to information about you, correction of inaccurate information, withdrawal of consent, review of public disclosure or deletion where appropriate. Identify the relevant account, listing or content link and the request; avoid including unnecessary sensitive documents. The team may need proportionate verification of identity or authority before providing another person’s records or changing a business.
Requests are assessed under applicable law and may be subject to limited exceptions, necessary retention or protection of other people’s information. Canadian privacy rights are not presented as an unconditional right to erase every record or a universal data-portability entitlement. You can also edit your available account/profile information and delete your own reviews through the dashboard.
If an issue is unresolved, the Office of the Information and Privacy Commissioner for British Columbia receives concerns within its jurisdiction. The Office of the Privacy Commissioner of Canada provides information and complaint routes for matters covered by federal private-sector privacy law. The verified responsible organisation and designated direct privacy contact must be established before this draft is adopted.
14. Children and policy updates
MBList’s current registration form does not collect a birth date or enforce a fixed minimum age. An account eligibility policy and a process for situations where a person cannot give meaningful consent need operator review. We do not invent an age threshold or represent that children’s access controls already exist.
Contact MBList if you believe a child’s information has been submitted inappropriately. Provide the relevant page or account context without unnecessarily repeating sensitive information.
This draft has a fixed revision date and version. A final adopted policy will show an effective date, and material changes should be communicated appropriately. New purposes or disclosures may require a fresh consent choice before use; an old Terms or guidelines acceptance does not automatically cover them.
MBList is Canadian owned, operated, and hosted.
Developed by Netvibes Infotech Ltd., Surrey, British Columbia.