Privacy Policy

Last updated: May 9, 2026

1. Who We Are

Almost Became is operated by [YOUR FULL LEGAL NAME], based in Canada. This policy explains how we collect, use, and protect your personal information in compliance with Canada's PIPEDA.

2. What We Collect

• Email address — for authentication only
• Museum content — the descriptions you provide and generated exhibits
• Payment data — processed by Stripe. We never store card details.
• Usage data — anonymous page view counts only

3. How We Use It

• To authenticate you and manage your account
• To generate and store your museums
• To process payments
• To send transactional emails (magic links, receipts)

We do not sell your data. We do not use your data for advertising. We do not share data with third parties beyond what is required to operate the Service.

4. Third-Party Processors

• Supabase — database and auth (SOC 2 Type II compliant)
• Stripe — payments (PCI DSS Level 1 compliant)
• Google Gemini API — AI content generation (see Google's Privacy Policy)
• Vercel — hosting

5. Your Rights Under PIPEDA

You have the right to access, correct, or request deletion of your personal information at any time. To exercise these rights, email hello@almostbecame.com. We will respond within 30 days.

6. Public Museums

If you share a museum via its public link, that content is viewable by anyone with the link. You may make any museum private at any time from your account.

7. Data Retention

We retain your data while your account is active. You may request account deletion at any time by emailing us.

8. Security

All data is encrypted in transit (TLS) and at rest. Authentication is managed by Supabase, a SOC 2 compliant provider.

9. Cookies

We use only essential session cookies required for authentication. No advertising or tracking cookies are used.

10. Contact & Complaints

Privacy questions: hello@almostbecame.com

If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.