Legal Document
Last updated: July 2, 2026
This Privacy Policy explains how COCONECT, a business registered in Ontario, Canada ("coconect", "we", "us", or "our"), collects, uses, shares, and protects personal information when you use our website at coconect.io, our messaging channels (including WhatsApp), and our curated in-person experiences (collectively, the "Services").
We collect personal information directly from you, automatically when you use the Services, and from publicly available sources, as described below.
We are based in Toronto, Canada, and handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to you, Quebec’s Law 25, the EU/UK General Data Protection Regulation (GDPR), and US state privacy laws such as the CCPA/CPRA. For GDPR purposes, coconect is the data controller.
Sign-up and onboarding information: your name, phone number, email address, city, your LinkedIn profile URL (where you provide or confirm it), what you’re building, who you want to meet, your interests and activity preferences, your budget per experience, and your availability.
Public professional information: to build your coconect profile and improve matching, we access, collect, and use your public LinkedIn profile information and other publicly available professional information about you — such as your headline, role, company, industry, education, and experience — including from any profile links you provide or confirm. You authorize this when you sign up (see our Terms of Service, Section 4). During onboarding we may ask you to provide or confirm your LinkedIn profile URL. You may review, correct, object to, or request deletion of this information at any time (see Section 9).
Communications: messages you exchange with us via WhatsApp, SMS, email, or the website, including your onboarding conversation and post-event feedback.
Payment information: processed by Stripe. We never receive or store your full card number — only card brand, last four digits, transaction status, and billing details needed to manage your subscription.
Event participation: RSVPs, attendance, no-shows, and feedback about events and other attendees. Note that other Members may give us feedback that relates to you; we treat such feedback as confidential and use it for matching quality and community safety.
Photos and recordings: if we photograph or record an Event for community or marketing purposes, we will tell attendees, and you can opt out of appearing in marketing materials at any time.
Usage and device data: IP address, browser type, device identifiers, pages viewed, and approximate location (city level), collected via cookies and similar technologies (see Section 8).
We don’t ask for sensitive personal information. If you choose to share something like a dietary restriction, allergy, or a physical limitation relevant to an activity, we use it only to organize the event, share it only as needed (for example telling a venue about an allergy at your request), and treat it with heightened care — with your explicit consent where the law requires it.
Matching: our core use. We match you with other Members for dinners, activities, and meetups using algorithmic and AI-assisted processing of your goals, interests, availability, budget, profile, and feedback signals (see Section 3).
Building your profile: combining the information you give us with your public LinkedIn profile information and other publicly available professional information to create and keep current your coconect profile.
Running events: selecting venues, composing tables, sharing logistics, managing RSVPs.
Communicating with you: onboarding, match notifications, confirmations, and safety notices via WhatsApp, SMS, and email.
Billing: processing payments, managing subscriptions, and preventing fraud.
Marketing: sending promotional messages where permitted (with consent where required, including under CASL and GDPR). You can opt out at any time.
Improving the Services: including improving matching quality using aggregated and feedback data.
Safety and legal: enforcing our Terms and Community Guidelines, keeping the community safe, and complying with legal obligations.
Where the GDPR applies, our legal bases are: contract performance (matching, events, membership); legitimate interests (building and enriching your professional profile from your public LinkedIn profile and other publicly available sources, service improvement, safety, and fraud prevention — you may object to this processing at any time); consent (marketing and any sensitive data you share); and legal obligation (tax, accounting, lawful requests).
Our matching uses automated systems, including AI-assisted scoring, to propose groups of Members likely to create value for one another — based on goal compatibility, role and industry, location, budget, availability, and feedback from past events. Humans curate final tables.
This is a form of profiling. It determines which events and people you are matched with; it does not produce legal effects concerning you and is not used to evaluate creditworthiness, employment, or eligibility for essential services. You may ask us how a match was made, object to this processing, or request human review of a matching decision by contacting us (Section 12). Where Quebec Law 25 or the GDPR applies, you have specific rights regarding automated processing, and we will honour them.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:
With other Members: so events can work, the Members matched with you can see limited profile information — typically your first name (and last initial), photo if provided, role or professional focus (which may be drawn from your public professional profile), and what you’re working on or looking for. We never share your phone number or email with other Members; staying connected after an event is your choice.
With venues: only what’s needed to run an event — group size, reservation name, and, at your request, dietary or accessibility needs.
With service providers: companies that process data on our behalf under contractual protections — Stripe (payments), WhatsApp/Meta (messaging), hosting and infrastructure providers, analytics providers, and AI tools used for matching.
For legal and safety reasons: to comply with a lawful request, enforce our agreements, or protect the rights, property, or safety of coconect, our Members, or the public — for example, in response to a credible safety incident at an event.
Business transfers: if coconect is involved in a financing, merger, acquisition, reorganization, or sale of assets, personal information may transfer as part of the transaction, subject to this Policy, with notice where required by law.
Your information may be stored and processed in Canada, the United States, and other jurisdictions where we or our service providers operate, and may be accessible to courts and authorities there under local law. Where required — for example, for EU/UK personal data — we rely on appropriate safeguards such as adequacy decisions and standard contractual clauses. Where Quebec Law 25 applies, we assess transfers outside Quebec for adequate protection.
Profile and matching data: retained while your account is active, then deleted or anonymized within 90 days of account deletion.
Communications: retained for up to 2 years for service quality and support, then deleted or anonymized.
Payment records: retained as required by tax and accounting law (typically 7 years in Canada).
Safety and enforcement records: may be kept longer where reasonably necessary to keep the community safe (for example, records of a ban).
Aggregated, de-identified data that cannot reasonably identify you may be retained for analytics.
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including encryption in transit, access controls, and reputable infrastructure providers. No system is completely secure. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulators as required by applicable law.
Our website uses cookies that are necessary for it to function (session management, security) and, where you consent or the law permits, analytics cookies that help us understand usage. You can control cookies through your browser settings and any cookie banner we present. Rejecting non-essential cookies won’t stop you from using the Services.
Wherever you live, you can:
Access and correct the personal information we hold about you, including information collected from public sources. Where a record also contains personal information about someone else (for example, feedback from another Member), we may redact that information to protect their privacy, as permitted by law.
Delete your account and personal information, except where retention is required or permitted by law.
Object to our collection and use of your public LinkedIn profile information or other publicly available professional information — if you object, we will stop and delete it, though matching quality may be reduced and we may need you to provide profile details yourself.
Withdraw consent, subject to legal and contractual restrictions — note that withdrawing consent for processing essential to matching means we may no longer be able to provide the Services.
Opt out of marketing at any time via the unsubscribe link or by replying STOP. Service messages continue while your account is active.
Depending on where you live, you may have additional rights:
EU / UK (GDPR): data portability, restriction of processing, objection (including to direct marketing and to processing based on legitimate interests), rights related to automated decision-making, and the right to complain to your supervisory authority.
California and other US states: rights to know, access, correct, and delete, and to opt out of “sale” or “sharing” — we do not sell or share personal information as defined by the CCPA/CPRA, and we will never discriminate against you for exercising your rights.
Quebec (Law 25): the right to be informed of and have reviewed decisions based exclusively on automated processing, data portability, and the right to complain to the Commission d’accès à l’information du Québec.
To exercise any right, contact us at hello@coconect.io. We may need to verify your identity, and we will respond within the time required by applicable law (30 days under PIPEDA and Law 25, one month under GDPR, 45 days under CCPA, subject to permitted extensions).
The Services are for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
We may update this Policy from time to time. Material changes will be communicated in advance by email, WhatsApp, or a prominent website notice, and where required by law we will seek your consent. The “Last updated” date above shows the latest revision.
Our Privacy Officer is the person in charge of the protection of personal information (for Quebec Law 25) and the accountable person under PIPEDA.
COCONECT — Privacy Officer
Email: hello@coconect.io
Website: coconect.io
Toronto, Ontario, Canada
If we can’t resolve your concern, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), your provincial regulator, your EU/UK supervisory authority, or your state attorney general, as applicable.