Privacy Policy
Last Updated: May 2026
Effective Date: May 2026
1. Introduction
MicroMA operates the MicroMA platform at microma.ca, a marketplace for buying and selling small businesses in Ontario, Canada. We are committed to protecting your personal information. This policy is governed by PIPEDA and applicable Ontario privacy legislation.
Contact us at: davidblair667@gmail.com
2. Information We Collect
Account Information: Full legal name, email address, phone number, date of birth (buyers), password (encrypted).
Seller Information: Legal business name, CRA Business Number, province of registration, business entity type, years in operation.
Financial Documents (Sellers): T2 Corporate Tax Returns (last 2 years), HST Returns (last 4 quarters), Business Bank Statements (last 6 months), Notice of Assessment. Optional: P&L statements, lease agreements, franchise agreements.
Identity Verification (Buyers): Government-issued photo ID, selfie/liveness photo, proof of funds or financing documentation.
Legal identity (both sides): the full legal name, address for notices and signing capacity that appear on any agreement you sign, and an HST registration number where you supply one.
What we read out of your documents: when you upload a document to support a listing, we extract its text to check it against your figures, and store what we found: the years it mentions, the largest amounts, and whether it could be read at all. We keep the extracted figures, not a copy of the text.
Signature records: for every document you sign, the name you typed, the time, your network address, your browser, the acknowledgements you ticked, and a cryptographic digest of the exact document. This is what makes an electronic signature evidence rather than a click, and it is kept for as long as the agreement could matter.
Conversations: the messages you send about a deal, the events that happened to it (an agreement issued, an auction closing, a deal going firm), any files you share, and private notes you write to yourself, which the other party never sees.
Usage Data: IP address, browser type, pages visited, device information. Views of a listing are de-duplicated using a salted, one-way hash of address and browser, which we cannot reverse into an identity and do not join to anything else. Visits to public pages are counted in daily totals per page and per referring site — the totals, and nothing about who visited. No cookie is set for this, and no third-party analytics service is used. Your browser remembers the first page you visited here and the site that sent you, and if you create an account, that, the page you signed up from and what you were doing (listing a business, bidding, contacting a seller) are kept on your account so we can see how people find MicroM&A and what they came for.
3. How We Use Your Information
We use your information to run your account, verify identity, business ownership and funds, review listings and the documents supporting them, generate and record the transaction documents you sign, carry conversations between the parties to a deal, detect fraud, send notifications, and improve the platform. We do not sell your personal information, and we do not use documents you upload for any purpose other than the check they were uploaded for and the deal they belong to.
Document checking happens on our own servers. Nothing you upload is sent to a third-party model, transcription service or analytics provider. The check is text extraction and arithmetic, performed here.
Auctions are public, so some of what you do is seen by others. Every bid’s amount and time is shown on the listing against an anonymous bidder number, never your name. Questions you ask in an auction’s forum are seen by the seller and every buyer under the confidentiality agreement, under an alias that is not your bidder number; the seller sees your name. When you join an auction, the seller sees your name, whether your funds are confirmed and whether they cover the starting bid, never the amount. Your verified funds figure is never shown to the seller or to other buyers.
4. How We Store and Protect Your Information
Data is stored in a Neon Postgres database, and uploaded files are held in that same database rather than in public object storage. No file has an address of its own: every one is served through an authenticated request, and can be retrieved only by the document's owner, the other party to a deal where the document was shared under an executed NDA, or a MicroM&A administrator. Documents are shared with buyers only after a valid NDA is executed, and links sent to outside legal counsel are time-limited and can be revoked. Passwords are hashed and never stored in plain text. All data is transmitted over HTTPS.
Retention:
- Account information is kept while your account is active.
- Identity documents — a government photo ID, a selfie — are destroyed 90 days after the verification they were collected for has been decided. The decision stays on the record; the image does not, and the date it was destroyed is recorded.
- Financial documents supporting a listing are retained for 2 years after that listing closes.
- Signed agreements and the conversations around a deal are kept for as long as the agreement could matter, which is a question of limitation periods rather than storage.
- Detailed view records are aggregated into daily counts after 90 days; read notifications are dropped after six months.
- You may request deletion at any time.
5. Who We Share Your Information With
We do not sell or rent your data. Sellers see a buyer’s verification status only, never underlying documents. Buyers see a listing’s verification badge only, never the seller’s BN or financial documents unless an NDA is signed.
Third-party service providers include Neon, Vercel, Resend, and Google Maps, all bound by data processing agreements. We may disclose information if required by law or court order.
6. Your Rights (PIPEDA)
You have the right to access, correct, or request deletion of your personal information, withdraw consent, and file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Two of those you do not have to ask us for. Under Your data in your profile, Download my data gives you everything we hold about you as one file, and Close my accountempties the account: your name, email, phone, date of birth and any identity documents are removed, and email from us stops. Deals you were part of stay on the record for the other party, under “Former member” — an agreement whose counterparty had vanished would not be a record either side could rely on. An account cannot be closed in the middle of a live offer or with a fee outstanding, and the screen says which it is.
Contact us at: davidblair667@gmail.com
We will respond within 30 days.
7. Email You Can Stop
Saved-search alerts and the weekly digest carry an unsubscribe link that works in one click, without signing in, and takes effect immediately. Your saved searches are kept, so turning the emails back on restores what you had.
Messages about a deal you are already in — a bid, a document waiting for your signature, a sale completing — are correspondence rather than marketing, and are not covered by that unsubscribe. Close your account to stop those.
8. Children’s Privacy
MicroMA is not intended for anyone under 18. We do not knowingly collect information from minors.
9. Changes to This Policy
We will notify you of material changes by email or prominent notice on the platform. Continued use after changes constitutes acceptance.
9. Contact
Email: davidblair667@gmail.com
Platform: microma.ca