Privacy Policy

Bin Heroes is a kid-run, parent-supported neighbourhood business in Kitchener, Ontario. The adults supporting the business oversee privacy requests and the systems that hold customer information.

• We collect only what we reasonably need to arrange and provide a cleaning.
• We do not sell or rent personal information.
• We do not use advertising trackers or build behavioural advertising profiles. We use privacy-focused, aggregate Web Analytics as described below.
• If you pay by card, Square automatically creates a basic customer record for us that links payments made with the same card. You can ask us to delete it.
• We do not send marketing email or text messages unless we ask separately first.
• You can ask to access, correct, or delete your information.

This policy applies to binheroes.ca, the booking form, payments and invoices we arrange, and direct communications about Bin Heroes services. It does not control a third-party website you choose to visit.

Booking and service information. When you send a booking or request, we collect your name, email address, phone number, street address, city, postal code, bins selected, requested or booked date and time, and anything you put in the notes field.

We also create service records such as booking status, scheduled date, and crew notes. For grouped routes, we may attach an approximate street-level location from our local map index. This is not live GPS tracking and is used only to group nearby jobs.

Booking address lookup. After you enter a recognized address in the booking form, the site may send it to our own server to look for an exact postal-code match in a local OpenStreetMap-derived index. That lookup does not save the address or send it to an outside geocoder. If you submit the booking, the address is then stored as part of the booking record.

Waste schedule lookup.If you choose to check a 2026 collection schedule, our server sends the house number, street, and selected city to the Region of Waterloo's public waste schedule map service and returns the matching collection dates. Bin Heroes does not add that lookup to a booking or save the address, although ordinary short-lived security records described below still apply. The Region and its mapping service provider process the request under their own privacy terms.

Communications. If you call, text, or email us, we receive the contact information and message you choose to provide.

Basic technical and security information. Our hosting provider may process information normally sent with a web request, such as IP address, browser type, requested page, and time. To prevent spam and password guessing, our application converts IP addresses into one-way keyed hashes before storing short-lived rate-limit records. We do not use those records to identify or locate visitors.

Payment and invoice information. If you pay by card, your card details are provided directly to Square through its mobile payment service or hosted invoice checkout, not to the Bin Heroes website or booking form. We may receive and keep the customer contact details, invoice, amount, payment method, payment status, receipt, and transaction reference needed to manage the booking and our accounting. An e-transfer is processed by the participating financial institutions.

Square customer records.Square's Instant Profiles setting is turned on for our account. That means Square automatically creates or updates a Bin Heroes customer record when you pay by card, even if you never filled in the booking form and even if we never typed your details in ourselves. The record can hold the cardholder name read from the card and the date, amount, payment method, and status of each payment. Sometimes it holds no name at all and simply links the payments together. If you ask Square for an emailed or texted receipt, or pay a Square invoice, the email address or phone number you give Square can be added to the same record. Square recognizes the same card on a later visit and adds that payment to the existing record, so it builds a history of your purchases with us over time.

We never receive your full card number, and we do not store your card to charge it later. We use these records to recognize a repeat customer, match a payment to the right booking, and keep accurate accounting. We do not use them for advertising, and we do not run Square marketing, feedback, or loyalty campaigns. You can ask us to delete your Square customer record, or avoid one entirely by paying by e-transfer or cash. See Your choices and rights below.

Please do not put payment-card details, online banking credentials, health information, or other sensitive information in the notes field or send it to us by email or text.

We use personal information to:

• check whether an address is in the service area;
• show availability, accept a booking, or arrange a grouped route;
• contact you about timing, access, changes, payment, or follow-up;
• after a completed service, send one optional request for an honest Google review when that feature is configured;
• provide the cleaning and return bins to the right property;
• match a card payment to the right booking and recognize a repeat customer;
• plan efficient routes and manage completed or cancelled jobs;
• protect the website and crew dashboard from abuse;
• handle questions, complaints, safety concerns, and legal obligations; and
• maintain ordinary business, insurance, and accounting records.

We ask for consent at the booking form. You can withdraw consent for future optional uses by contacting us, but withdrawing information needed for an active booking may mean we cannot provide the service. If we want to use personal information for a materially different purpose, we will explain it and obtain consent where required.

Ruby, participating crew members, and supervising parents may see the parts of a booking they need to schedule and provide the service. Access to the full booking dashboard is password-protected.

We also use a small number of service providers:

• Supabase stores booking, availability, and security rate-limit records.
• Vercel hosts the website, processes web requests, and provides aggregate Web Analytics for public pages.
• OneSignal sends transactional booking-request summaries and appointment confirmations to you, as well as a new request notification to the crew and, when configured, one optional post-service review request. Those messages can contain the booking details; the crew notification uses your email address as the reply-to address.
• Square provides mobile card payment processing, emailed invoices, hosted invoice checkout, and payment receipts. It processes the contact, transaction, device, billing, and payment information needed to provide those services, and it holds the customer records described above in our Square Customer Directory, including the ones its Instant Profiles setting creates automatically from a card payment. Square handles that information under its privacy notice.
• Mapping or navigation providers may receive the service address when the crew deliberately opens it for directions.
• Region of Waterloo's public waste schedule map service receives an address only when you ask the site to look up collection dates.
• Email and telecommunications providers carry calls, texts, and booking-related messages.

A review-request email contains a link to Google. Google receives information from your browser only if you choose to open that link, under Google’s own terms and privacy policy. Bin Heroes does not require a positive review, offer an incentive, or send your booking address to Google through the review link.

These providers may process information in Canada, the United States, or other countries where they operate. Information processed elsewhere may be subject to the laws and lawful access rules of that place.

We may also disclose information when reasonably necessary to comply with law, respond to legal process, protect a person's safety, investigate fraud or misuse, enforce an agreement, or complete a genuine transfer of the business with appropriate confidentiality protections. We do not sell personal information.

The public website does not use advertising cookies or social-media pixels. It uses Vercel Web Analytics to count public-page visits and understand aggregate information such as the page viewed, referring site, country or region, browser, operating system, and device type. Analytics events exclude the private crew dashboard and the site removes query strings before an event is sent.

Vercel Web Analytics does not use third-party cookies or attach these events to a name, email address, booking, or advertising profile. Its short-lived visitor identifier is derived from request information and discarded after 24 hours. Aggregate reports may remain available for the reporting period attached to our Vercel plan.

Fonts, images, street suggestions, and the postal-code lookup are served through the site rather than loaded from marketing networks.

The private crew dashboard uses one secure, http-only session cookie after an authorized crew member signs in. It lasts up to 12 hours and is not used to track customers.

Active booking information is kept while we arrange and provide the service. Afterward, we keep it only as long as reasonably needed for follow-up, repeat-service history, accounting, insurance, disputes, security, and legal obligations. When information is no longer needed, we delete it or remove identifying details.

Transactional booking emails, invoices, payment records, and backups may remain for a limited period after the main booking record is removed, including where accounting or legal obligations require retention. A Square customer record, including one created automatically from a card payment, stays in our Square Customer Directory while we use it for repeat-service history and accounting. We delete it on request unless an accounting or legal obligation requires us to keep the underlying payment record. Hashed rate-limit records stop affecting requests after their short rate-limit window and are pruned once they are more than 24 hours old, either by the next rate-limited request or by the database's scheduled cleanup when enabled. The crew session cookie expires within 12 hours.

We use HTTPS, server-only database credentials, database access rules, a password-protected crew dashboard, secure session cookies, rate limiting, and restricted access to booking information. Service providers are selected to operate the website, database, payments, and transactional email systems.

Booking confirmation emails may include an expiring, signed management link for that specific booking. The link does not contain your name, address, or contact details, but anyone with the current link can open the booking-management page and submit a cancellation or reschedule request. A successful change or newer confirmation invalidates the older link, so please keep confirmation emails private.

No internet system can promise perfect security. If we learn of a breach that creates a real risk of significant harm, we will investigate it and notify affected people and regulators when required.

You may ask what personal information we hold about you, request a correction, withdraw consent for future optional uses, or ask us to delete information we no longer need. We may need to verify your identity first, and legal or operational obligations may require us to retain limited records.

Square customer records.Tell us before or after you pay if you would rather not have one. Square's Instant Profiles setting applies to our whole account rather than to a single customer, so we cannot exclude one card in advance. What we can do is delete your record from our Square Customer Directory after a payment, and you can avoid one being created at all by paying by e-transfer or cash. If it matters to you that the setting is on, say so and we will consider turning it off for everyone.

Contact us using the details below. We will explain our decision if we cannot fully complete a request. You may also raise a concern with the Office of the Privacy Commissioner of Canada.

Bin Heroes may be kid-run, but the booking form is for householders arranging a paid service. We do not knowingly ask children to submit customer information. If you are under 18, please have a parent or guardian make the booking or help you contact us.

If a parent or guardian believes a child submitted personal information without appropriate permission, contact us and we will review and remove it where appropriate.

Questions, access requests, corrections, deletion requests, or privacy complaints can be sent to the parent-supported management of Bin Heroes:

• Email: info@binheroes.ca
• Phone or text: 519-591-7115
• Kitchener, Ontario, Canada

We may update this policy when the service or its technology changes. The revised version will be posted here with a new last-updated date. If a change materially affects how existing personal information is used, we will provide additional notice or seek consent where required.