Privacy Policy
Effective · Last reviewed
Read this first: we collect the minimum we need to run the site, we never sell your personal data, and anything you post publicly is public forever. Everything else is below.
Make a privacy or data request
The short version
We collect an email address, a username, your language, and the things you choose to save (watchlists, alerts, saved articles). We keep basic technical logs so the site works and does not fall over. We do not sell personal data, and we do not run a data brokerage.
Anything you post in a public area — comments, replies, sentiment votes, board posts, display name, avatar — is public. Treat it as permanent, quotable, indexable by search engines, and readable by anyone on earth, including your employer, your regulator, and people who dislike you.
If you want your account gone, you can delete it. Public posts may survive in quoted, cached, archived, aggregated or de-identified form, because we cannot un-ring a bell rung on the open internet.
Who is responsible for your data
The Maple Markets ("we", "us", "our") is operated by The Maple Index Inc. The Maple Index Inc. operates this website and is the controller of personal information collected through it. Privacy questions, access requests and deletion requests go to privacy@themaplemarkets.ca. We respond to verified requests within the timelines required by applicable law.
We operate primarily under Canadian federal and provincial privacy law, including PIPEDA and substantially similar provincial statutes, and Canada's Anti-Spam Legislation for commercial electronic messages. Where the GDPR, UK GDPR, the CCPA/CPRA or another regime applies to you because of where you live, we honour the rights that regime grants you, but only to the extent that regime actually applies.
What we collect
Information you give us: email address, hashed password (we never see or store your plaintext password), username and display name, language preference, profile details you choose to add, newsletter subscriptions, watchlists, price alerts, saved articles, follows, comments, replies, reports, sentiment votes, and anything you type into a form or send us by email.
Information generated by using the site: IP address, approximate location derived from IP, browser and device type, operating system, referring URL, pages viewed, timestamps, session identifiers, error and crash diagnostics, and interaction events such as article views used to compute counts.
Information from third parties: authentication data from a sign-in provider you choose (for example, an OAuth provider returning your email address and profile identifier), anti-abuse signals from our bot-mitigation provider, and delivery events from our email provider such as bounces and complaints.
Connector request records when you connect an assistant: the assistant's identity, the tool used, the outcome, timing and quote lookups counted (see "Connected assistants" below).
We do not knowingly collect sensitive categories of personal information — health data, biometrics, precise geolocation, government identifiers, financial account numbers — and we ask that you never post them. If you post them anyway, you have made them public voluntarily and you accept the consequences of doing so.
Why we use it, and our lawful bases
To create and secure your account and authenticate you (contractual necessity). To deliver the features you asked for, such as watchlists, alerts and saved articles (contractual necessity). To send transactional email such as password resets and alert notifications (contractual necessity). To send newsletters and product updates where you have opted in (consent, withdrawable at any time).
To keep the platform safe: rate limiting, spam and bot mitigation, fraud detection, abuse investigation, moderation of user content, and enforcement of our Terms of Use (legitimate interests, and compliance with legal obligations). To measure aggregate usage, diagnose faults, and improve editorial and product decisions (legitimate interests). To comply with law, respond to lawful demands, and establish, exercise or defend legal claims (legal obligation and legitimate interests).
Service providers and international transfers
We use third-party processors to host the application and database, authenticate users, deliver email, mitigate bots, serve or measure advertising where applicable, and supply market data. These providers act on our documented instructions under contractual confidentiality and security obligations.
Those providers may store or process data outside your province or country, including in the United States and the European Union. Data held in another jurisdiction may be accessible to the courts, law enforcement and national security authorities of that jurisdiction. By using the site you acknowledge this transfer and the associated risk, which no privacy policy can eliminate.
Automated tools, AI and machine processing
We use automated systems for translation, summarisation, tagging, spam and abuse detection, and internal drafting assistance. Content you submit publicly may be processed by these systems. We do not use the content of your private account settings to train third-party general-purpose models, and we require our processors to operate under no-training terms where their service offers them.
Automated moderation may hide, delay, rate-limit or remove content without human review. No automated decision made on this site produces legal or similarly significant effects on you within the meaning of Article 22 of the GDPR; if you believe an automated action was wrong, contact us and a human will look at it.
Connected assistants (Claude, ChatGPT and other MCP clients)
You can connect an AI assistant such as Claude or ChatGPT to your account through our Maple Connect connector at https://themaplemarkets.ca/mcp. You authorise each assistant yourself through an OAuth consent screen, and you can disconnect it at any time from Account → Connected assistants. A connected assistant can read published articles and market data, read and change your own watchlists and price alerts, and see your plan and usage. It never receives your password, your email, other readers' data, or unpublished content.
For each request an assistant makes we record the assistant's identity, the tool used, whether it succeeded, how long it took and any quote lookups counted against your plan; we do not store the content of your conversation with the assistant. These request records are kept for 90 days for rate limiting, abuse prevention and support, then deleted. Rate-limit counters are kept for 2 days. The assistant provider (for example Anthropic or OpenAI) handles your conversation under its own privacy policy. Questions: privacy@themaplemarkets.ca.
Retention
Account data is retained while your account is active and for a reasonable period afterwards to handle disputes, chargebacks, abuse investigations and legal obligations. Security and access logs are retained for a limited period appropriate to their purpose. Connector request records: 90 days. Rate-limit counters: 2 days. Aggregate and de-identified statistics may be retained indefinitely, because they are no longer personal information.
Public contributions may remain visible after account deletion in anonymised form where removal would break the readability of a thread, and may persist in third-party caches, archives and search indexes we do not control.
Your rights and how to use them
Subject to applicable law, you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing, portability of information you provided, withdrawal of consent, and objection to processing based on legitimate interests. You may also complain to your privacy regulator, including the Office of the Privacy Commissioner of Canada or your provincial or European supervisory authority.
Email privacy@themaplemarkets.ca. We may need to verify your identity before acting, and we may refuse or narrow a request where an exemption applies — for example, where compliance would reveal another person's information, defeat an abuse investigation, breach legal privilege, or where the request is manifestly unfounded or repetitive.
Security, breach and honest limits
We use encryption in transit, hashed credentials, access controls, row-level database authorisation and least-privilege service accounts. That is meaningful, and it is not a guarantee. No internet-facing system is perfectly secure, and we do not represent that ours is.
You are responsible for your password, your device, your session, and anyone you allow to use your account. If we become aware of a breach creating a real risk of significant harm, we will notify affected users and regulators as required by law and on the timelines law requires — not on the timeline a critic demands.
Children
The site is not directed to children under 16 and we do not knowingly collect their personal information. If you believe a child has created an account, email privacy@themaplemarkets.ca and we will delete it.
Changes to this policy
We may update this policy as the product, our providers or the law change. Material changes will be announced on this page with a revised effective date, and where required, we will seek fresh consent. Continued use after the effective date is acceptance of the updated policy.
This page is maintained by The Maple Markets and is general information, not legal advice.