Privacy Policy

1. Information We Collect

We collect information in three ways:

Information you provide directly

• Account details: display name, username, email address, date of birth (to verify minimum age of 13)
• Profile content: bio, profile photo, niche/category tags, social media handles
• Creator content: posts, comments, collaboration requests, messages
• Payment information: processed and stored by Stripe — Mutually never stores full card numbers
• Communications you send to our support team

Information collected automatically

• Device identifiers, IP address, browser type and version, operating system
• Usage data: pages viewed, features used, time spent, scroll depth, tap/click events
• Crash reports and performance metrics
• Cookie and similar tracking data (see our Cookie Policy for full details)

Information from third parties

• Google or Apple sign-in: name, email, and profile photo if you choose OAuth login
• Linked social accounts: public profile data from Instagram, TikTok, X, or YouTube when you voluntarily connect them
• Analytics providers: aggregated, anonymised audience insights

2. How We Use Your Information

We use the information we hold about you to:

• Create and maintain your Mutually account
• Power the creator-matching algorithm that suggests collaborators by niche, audience size, and engagement style
• Enable collaboration features: match proposals, shared campaign tools, messaging
• Process payments and manage subscriptions via Stripe
• Send transactional emails (account verification, password reset, match notifications)
• Detect and prevent fraud, spam, fake engagement, and Community Guidelines violations
• Improve product features through aggregated analytics
• Respond to customer support requests
• Comply with legal obligations under PIPEDA and other applicable laws

We do not use your personal data to train third-party AI models, and we do not sell your personal information to advertisers.

3. How We Share Your Information

We share your data only in the following circumstances:

• With other Mutually users: your public profile, niche tags, and content are visible to others on the platform. Private messages are visible only to participants.
• Service providers acting on our behalf: hosting (Vercel), database (MongoDB Atlas), payments (Stripe), email delivery (e.g. SendGrid), analytics (Google Analytics) — all bound by data processing agreements
• Legal compliance: if required by a court order, regulatory authority, or to protect the safety of users
• Business transfers: if Mutually is acquired or merges, user data may transfer to the successor entity with notice to you
• With your consent: for any other purpose we describe at the time of collection

We never sell, rent, or trade your personal information to third parties for their own marketing purposes.

4. Data Retention

We retain your account data for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Active accounts: data retained for the life of the account
• Deleted accounts: most personal data deleted within 30 days; some data (e.g. transaction records) retained for up to 7 years to meet legal and financial compliance requirements
• Analytics data: aggregated and anonymised after 26 months
• Backups: purged on a rolling 90-day cycle

5. Your Rights Under PIPEDA

As a Canadian resident, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate or incomplete information
• Withdrawal of consent: withdraw consent for non-essential data processing (e.g. marketing analytics) at any time
• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca

To exercise any of these rights, email us at support@mutually.ca. We will respond within 30 days. We may need to verify your identity before processing certain requests.

6. Children's Privacy

Mutually is intended for users who are 13 years of age or older. We do not knowingly collect personal information from children under 13. If we discover we have inadvertently collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, contact us at support@mutually.ca.

Users aged 13–17 require parental or guardian consent to use Mutually. We implement age-verification checks at registration and restrict certain features for minor accounts.

7. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, role-based access controls, and regular security audits. No method of electronic storage or transmission is 100% secure; we cannot guarantee absolute security but commit to promptly notifying affected users of any material breach as required by law.

8. International Transfers

Mutually is incorporated in Canada and our primary infrastructure is located in North America. Some service providers may process data in the United States or other jurisdictions. When we transfer data outside Canada, we ensure appropriate safeguards are in place (e.g. contractual clauses equivalent to PIPEDA protections).

9. Cookies and Tracking

We use cookies and similar technologies for authentication, analytics, and fraud prevention. You can manage cookie preferences through our cookie banner or your browser settings. For a full list of cookies and how to opt out, see our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy when we introduce new features or change our data practices. Material changes will be communicated via email or an in-app notification at least 14 days before taking effect. The "Last updated" date above will always reflect the current version. Continued use of Mutually after a change constitutes acceptance of the revised policy.

11. Contact Us

Questions, requests, or complaints about this Privacy Policy:

Email: support@mutually.ca

Mutually Inc.

You may also contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or priv.gc.ca.