Keporia is a sole proprietorship of Md Abid Hasan, based in St. John's, Newfoundland and Labrador, Canada. This policy covers two things: this website, keporia.ca, and the loyalty-card service we run for our clients at card.keporia.ca. It is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and to be readable by a person. If anything here is unclear, email abid@keporia.ca and you will get a straight answer.
The short version
- This website sets no cookies, runs no analytics, and loads nothing from a third party — not even fonts. Nobody is tracked here.
- The only information this website collects is what you type into the contact form, and it is used only to reply to you.
- On the loyalty cards we run, a customer gives a first name and nothing else. That, their card balance and their visit history are kept on servers in Toronto and never leave Canada.
- We do not sell, rent or share personal information with anyone, ever, beyond the companies we need to deliver the service (named below).
- You can ask to see, correct or delete anything we hold about you. Deletion is one action on our side and usually happens the same day.
1. This website (keporia.ca)
What we collect
Contact form. If you send the form on our contact page we receive what you typed: your name, your business name, your email address, your phone number if you chose to give it, the kind of business you run, how many locations, your message, and — if you came from the pricing calculator — which plan and monthly figure you were looking at. We use this to reply to you and, if you go ahead, to set up your card. We do not add you to any list.
Server logs. Our website host keeps ordinary web-server logs (the address your request came from, the page requested, the time, and your browser's description of itself) for a short period, for security and to keep the site running. We do not analyse these logs to profile visitors and we run no analytics software of any kind.
Nothing else. No cookies, no tracking pixels, no social-media buttons that report back, no embedded videos, no chat widgets, no A/B testing. The fonts on this page are served from keporia.ca itself, so your browser never contacts Google or anyone else to display it.
Who handles it
The website and the contact form are hosted by Netlify, Inc. (San Francisco, USA). Form submissions are stored by Netlify in the United States, where they are subject to US law, until we delete them. Nothing you send through the form is sensitive by nature — it is business contact information — but if you would rather not have it pass through a US server, email us directly instead and it stays between your mail provider and ours.
How long we keep it
Form submissions and the email conversation that follows are kept while we are talking and, if you become a client, for the life of the engagement and seven years afterwards for tax and accounting records, as Canadian law requires. If we never work together, we delete the submission within twelve months. Ask sooner and it goes sooner.
2. The loyalty-card service (card.keporia.ca)
When a café, restaurant, salon or other business (a "client") runs a Keporia loyalty card, their customers add a card to Apple Wallet or Google Wallet and earn stamps at the counter. Under PIPEDA the client is the organisation responsible for its customers' information; Keporia processes it on the client's behalf, under a written agreement, and only to run the programme. This section tells customers what that involves.
What a customer gives us
- A first name — the only thing the sign-up page asks for. No surname, no email address, no phone number, no birthday, no payment details.
- Whether they agreed to receive offers through the card, recorded with the time and the exact wording they saw. This is optional; the card works without it.
- If they joined by scanning a friend's card, the friend's member number, so the friend gets credit for the referral.
What the service creates as it runs
- A member number (printed on the card), the current stamp count, and a log of stamps, redemptions and corrections with the time and the door where they happened.
- A random identifier stored in the customer's browser so the sign-up page recognises their card (see Cookies).
- For Apple Wallet: the technical identifiers Apple's update service needs — a per-pass authentication token and, once the card is in a wallet, the device's anonymous registration identifier and push token. These let the card update itself and let a client send an offer to the card. They do not identify the person and are not location data.
- For Google Wallet: a pass object under the client's programme, holding the same first name, member number and balance.
What we do not do
- We do not track a customer's location. A card can carry the shop's address so that the phone itself shows the card when nearby; that decision is made entirely on the phone, by Apple or Google, and nothing about the customer's whereabouts is ever sent to Keporia or to the client.
- We do not build profiles, we do not combine one client's customers with another's, and we do not sell or share customer information with anyone.
- We send no email and no text messages. The only way a client can reach a customer is a message shown by the wallet card itself, which the customer can switch off in their phone's settings or end by removing the card.
Where it lives and who can reach it
Customer information is stored on servers operated by Fly.io, Inc. in Toronto, Ontario. It is encrypted in transit and at rest, backed up daily, and does not leave Canada. Apple Inc. and Google LLC deliver the card to the wallet and see what is on the card (first name, member number, balance) under their own privacy policies. The client can see their own customers' first names, member numbers and balances through a dashboard; no client can see another client's customers. Keporia's operator can see the same, for support. Nobody else has access.
How long we keep it
For as long as the client's programme runs, plus thirty days after it ends so the client can take an export of their list (which belongs to them). After that it is deleted. A customer can have their record deleted at any time — see "Your rights" below.
3. Your rights
Whether you are a visitor to this website, a client, or a client's customer, you can:
- Ask what we hold about you and receive a copy, normally within thirty days.
- Have it corrected if it is wrong.
- Withdraw consent to offers through a loyalty card at any time, by turning off notifications for the card, removing the card, or asking the shop or us.
- Have it deleted. For a loyalty card, tell the shop or email us with the member number on your card; we erase the record, the visit history and the card registrations, and the card in your wallet stops updating (you can then remove it). This normally happens the same business day.
- Complain. Write to us first and we will try to put it right. If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada.
To exercise any of these, email abid@keporia.ca. We may ask for enough detail to be sure we are talking about your record and nobody else's.
4. Security
Every connection to keporia.ca and card.keporia.ca is encrypted. Wallet cards are digitally signed, so an altered card cannot be installed. Access to the service is protected by secrets that are never stored in code and lockouts against guessing. The platform is reviewed on every change and was penetration-tested (by us, not yet by an outside firm) in September 2026. If, despite that, information were ever accessed without authorisation, we would notify every affected client within 72 hours and the Privacy Commissioner where the law requires it.
5. Children
This website and the loyalty-card service are aimed at businesses and their adult customers. We do not knowingly collect information from anyone under 13. If you believe a child has signed up for a card, tell the shop or email us and the record will be removed.
6. Changes
If this policy changes, the new version is posted here with a new date at the top. If a change affects how a client's customers' information is handled, we tell the client first.
7. Contact
Keporia · Md Abid Hasan · St. John's, Newfoundland and Labrador, Canada
abid@keporia.ca · 709-660-9874