Privacy Policy

Information We Collect

We do not collect your Facebook credentials, your Facebook friends list, private messages, or any data from your Facebook account beyond the public Marketplace listings retrieved by the agent on your behalf.

How We Use Your Information

• To create and manage your account and authenticate you.
• To run scrape jobs, watches, and AI filtering on your behalf.
• To deliver Telegram notifications you have configured.
• To send transactional emails (email confirmation, password reset, billing receipts).
• To process payments and manage your subscription via Stripe.
• To enforce plan limits (daily scrape counts, number of watches).
• To detect and prevent fraud, abuse, or security incidents.
• To improve the reliability and performance of the Service.
• To comply with legal obligations.

We do not: sell, rent, or share your personal information with third parties for advertising or marketing purposes. We do not use your data to train AI models.

Legal Basis for Processing

Under PIPEDA and applicable privacy legislation, we process your personal information on the following bases:

• Contractual necessity: Processing required to provide the Service you signed up for (account management, running searches, notifications).
• Legitimate interest: Security monitoring, fraud prevention, Service improvement.
• Consent: Optional data uses such as Telegram notifications (you can withdraw by removing your Chat ID at any time).
• Legal obligation: Retaining records as required by law.

Data Storage & Retention

Your data is stored on servers located in Toronto, Canada (DigitalOcean). We use PgBouncer connection pooling and PostgreSQL for data storage. All connections use TLS encryption in transit.

• Account data: Retained for as long as your account is active, or until you request deletion.
• Scrape results & job history: Retained for up to 90 days, then automatically purged.
• Access logs: Retained for up to 30 days for security purposes.
• Billing records: Retained as required by applicable tax and financial regulations (typically 7 years).
• Deleted accounts: Personal data is removed within 30 days of account deletion, except where retention is required by law.

Third-Party Services

We use the following sub-processors and third-party services to operate JDMarket:

We do not share your personal information with any other third parties. Each sub-processor has been selected for their privacy and security standards.

The Agent Application

The JDMarket desktop agent runs on your computer and communicates with our servers over HTTPS. Specifically:

• The agent sends your user ID and job instructions to our servers to retrieve pending tasks.
• The agent sends scraped listing data (publicly visible Marketplace listings) back to our servers for processing and storage.
• The agent does not transmit your Facebook credentials, cookies, or session tokens to our servers. Your Facebook login stays entirely on your device.
• The agent does not record keystrokes, take screenshots, or access any data outside of the Marketplace pages it is instructed to visit.

Cookies & Tracking

We use a single session cookie to keep you logged into the JDMarket web dashboard. This cookie is:

• Set only after you log in.
• HttpOnly and Secure — it cannot be accessed by JavaScript and is only sent over HTTPS.
• Deleted when you log out or when your session expires.

We do not use advertising cookies, cross-site tracking cookies, or any third-party analytics cookies (e.g. Google Analytics). We do not use fingerprinting or any other form of persistent tracking.

Cloudflare Turnstile (our CAPTCHA provider) may set a short-lived cookie on login and registration pages for bot detection purposes only.

Data Security

We implement reasonable technical and organizational measures to protect your personal data, including:

• All data in transit encrypted via TLS 1.2/1.3 (HTTPS).
• Passwords stored as bcrypt hashes — we never store plaintext passwords.
• Database access restricted to internal services only — not publicly accessible.
• Regular automated backups with point-in-time recovery.
• DDoS protection via Cloudflare.

However, no method of electronic transmission or storage is 100% secure. In the event of a data breach that poses a risk to you, we will notify affected users and relevant authorities as required by law.

Your Rights

Under PIPEDA and applicable Canadian privacy law, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated personal data.
• Portability: Request an export of your data in a machine-readable format (where technically feasible).
• Withdrawal of consent: Opt out of optional data uses (such as Telegram notifications) at any time via your profile settings.
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you believe your rights have been violated.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

International Data Transfers

Your data is primarily stored and processed in Canada (Toronto). Some of our sub-processors (Stripe, Cloudflare, Resend) are US-based companies. By using the Service, you consent to the transfer of your information to these providers in accordance with their respective privacy policies and applicable data transfer frameworks.

We select sub-processors that provide contractual guarantees for the protection of personal data transferred internationally.

Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has created an account, please contact us at [email protected].

Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or by posting a prominent notice within the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

Contact & Privacy Officer

For any privacy-related questions, requests, or concerns, please contact us:

• Email: [email protected]
• Website: jdmarket.cc
• OPC (Canada): www.priv.gc.ca