Last updated: March 26, 2026
Edmonton Spotlight (“we”, “us”, “our”) is operated by Lumin Marketing Group, based in Edmonton, Alberta, Canada. We are committed to protecting your privacy in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).
This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights as a user. We've written it in plain language so you can actually understand it.
Lumin Marketing Group is responsible for all personal information in our custody or under our control. We have designated a Privacy Officer who is accountable for our compliance with PIPEDA and PIPA.
Our Privacy Officer is responsible for receiving and responding to inquiries or complaints, ensuring staff are trained on privacy obligations, and overseeing our compliance with this policy.
We identify the purpose for collecting personal information before or at the time of collection. We collect and use your information for the following purposes:
We will not use your personal information for any purpose beyond those stated here without first obtaining your consent, unless required or permitted by law.
We obtain your meaningful consent before or at the time of collecting personal information. The form of consent depends on the sensitivity of the information:
You may withdraw your consent at any time by contacting our Privacy Officer at privacy@edmontonspotlight.ca. Withdrawing consent may affect our ability to provide certain services to you. We will explain the consequences of withdrawal when you make your request.
You can opt out of marketing emails at any time using the unsubscribe link in any email, or by visiting our unsubscribe page.
We limit collection to information that is necessary for the purposes we have identified. We do not collect personal information indiscriminately.
| Context | Data Collected |
|---|---|
| Account Registration | Name, email address, password (encrypted and hashed — never stored in plain text) |
| User Profile | Name, email, phone number (optional), 2FA phone number (optional) |
| Business Claim | Name, email, phone number, role at business, verification documents (uploaded files) |
| Business Listing Submission | Business name, address, phone, email, website, hours, description, photos |
| Contact Forms | Name, email, phone (optional), message content |
| Payment | Billing name and email — card details are processed directly by Stripe and never touch our servers |
| Data | Details |
|---|---|
| Analytics Events | Pages visited, search queries, clicks on phone/website/directions buttons, referral source |
| Device Information | Browser type, operating system (derived from user agent string) |
| IP Address | Hashed using a one-way algorithm before storage — your actual IP address is never stored in our database. Google Analytics also anonymizes IP addresses (anonymize_ip: true). |
Saved/favorited businesses are stored in your browser's localStorage. This data stays on your device and is never sent to our servers.
We use personal information only for the purposes for which it was collected, or for purposes that a reasonable person would consider appropriate in the circumstances. We do not sell, trade, or rent your personal information to third parties.
| Data Type | Retention Period |
|---|---|
| Account data | Retained while your account is active; deleted within 30 days of a deletion request |
| Business listings | Retained while claimed; unclaimed listings may be retained indefinitely as public business information |
| Analytics events | Rolling 90 days, then automatically purged |
| Contact form submissions | 90 days |
| Claim verification codes | Expire after 24 hours |
| Payment records | 7 years (required under Canadian tax law) |
| Email communications | 90 days unless required for legal purposes |
When personal information is no longer needed for the purpose it was collected, or when the retention period expires, we securely delete or anonymize it.
We take reasonable steps to ensure that personal information is accurate, complete, and up-to-date for the purposes for which it is used.
We protect your personal information with security measures appropriate to the sensitivity of the information, including:
We are transparent about our privacy practices. This policy is publicly available on our website at all times. You can request additional details about our privacy practices by contacting our Privacy Officer.
If we make material changes to this policy, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.
Under PIPEDA and PIPA (Alberta), you have the right to:
To exercise any of these rights, contact our Privacy Officer at privacy@edmontonspotlight.ca. We will respond to your request within 30 days. If we need additional time, we will notify you of the extension and the reason.
There is no cost to access your personal information. In rare cases involving extensive or repeated requests, we may charge a reasonable fee — but we will inform you of the cost before proceeding.
If you have a concern or complaint about how we handle your personal information, please contact our Privacy Officer first at privacy@edmontonspotlight.ca. We take all complaints seriously and will investigate and respond within 30 days.
If you are not satisfied with our response, you have the right to escalate your complaint to:
We use the following cookies and browser storage technologies:
| Cookie / Storage | Type | Purpose | Duration |
|---|---|---|---|
| sb-*-auth-token | Essential | Supabase authentication session (logged-in users only) | Session / 7 days |
| partner_jwt | Essential | Partner authentication token (partner portal only) | Session |
| csrf_token | Essential | Security — prevents cross-site request forgery attacks | 24 hours |
| _ga / _gid | Analytics | Google Analytics — anonymized traffic analysis | Up to 2 years |
| __gads / __gpi | Advertising | Google AdSense — ad personalization and frequency capping | Up to 13 months |
| sessionStorage | Essential | Redirect handling after authentication | Browser session |
| localStorage | Functional | Saved/favorited businesses (stored locally, never sent to our servers) | Until cleared by you |
Essential cookies are required for the site to function and cannot be disabled. Analytics and advertising cookies can be controlled through your browser settings. Disabling these cookies will not affect core site functionality but may result in less relevant ads.
We share personal information with the following service providers who assist in operating our platform. Each provider is contractually required to protect your data and may only use it for the purposes we specify.
| Provider | Location | Purpose | Data Shared |
|---|---|---|---|
| Supabase Inc. | United States | Database, authentication, file storage | Account data, business listings, uploaded files |
| Stripe Inc. | United States | Payment processing, subscription management | Name, email, payment details |
| Resend Inc. | United States | Transactional email delivery | Email address, name |
| Google LLC | United States | Analytics (Google Analytics), maps and business data (Google Places API), advertising (Google AdSense) | Anonymized usage data, anonymized IP, ad interaction data |
| Vercel Inc. | United States | Website hosting, edge network | Server logs (IP address, user agent) |
| GoHighLevel / LeadConnector | United States | CRM and pipeline management | Business contact info (claimed business subscribers only) |
Cross-border transfers: Some of our service providers are located in the United States. When your personal information is transferred outside of Canada, it may be subject to the laws of that jurisdiction. We ensure that all service providers offer a comparable level of protection through contractual agreements. Under PIPEDA and PIPA, we remain accountable for your information even when it is processed by a third party in another country.
We do not sell, trade, or rent your personal information to any third party.
We use analytics to understand how people use our site so we can improve it. Here's exactly how it works:
anonymize_ip: true). Google truncates your IP address before processing, in compliance with data protection requirements.We display advertisements on certain pages (including business listing and category pages) through Google AdSense. Google may use cookies to serve ads based on your prior visits to our site or other websites.
Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child, we will promptly delete it. If you believe a child has provided us with personal information, please contact our Privacy Officer.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page.
We encourage you to review this policy periodically. Your continued use of Edmonton Spotlight after changes are posted constitutes your acceptance of the updated policy.
If you have any questions about this Privacy Policy, want to exercise your privacy rights, or have a concern about how we handle your personal information, please contact us: