1. Who we are and what this policy covers
Cashify is a Canadian-facing service that helps people request estimates and sell eligible used iPhones, MacBooks, and Android phones. In this policy, “Cashify,” “we,” “us,” and “our” mean the business operating the Cashify website and purchase service.
Cashify’s legal operator, Canadian mailing address, privacy contact route, and processing location are published before seller requests open. Seller requests are closed until they are.
This policy applies to information collected through Cashify’s website, estimate and seller-request forms, communications about a device sale, shipping, inspection, payout, return, support, fraud prevention, and legal compliance. It does not govern a carrier, bank, Interac participant, or other third party’s independent handling of information.
2. Personal information we collect
We collect only information reasonably necessary for the purposes described in this policy. Depending on how you use Cashify, this may include:
- Contact and identity details: full name, email address, phone number, and communications with us.
- Shipping details: street address, unit number, city, province or territory, and postal code.
- Device and quote details: device type, model, storage, condition, power and activation-lock status, estimate, serial number or IMEI if later required for inspection or fraud prevention, and transaction history.
- Photos and notes: device photos and any optional details you submit. Photos or notes may inadvertently reveal personal information, such as a serial number, a name, a location, or content visible on a screen.
- Sale, shipping, and payout details: shipping tracking information, inspection findings, final offer, acceptance or decline, payout confirmation, and information needed to investigate a dispute or comply with law.
- Technical information: limited information normally sent when a browser accesses a website, such as IP address, browser type, device type, request date and time, and security or error logs. We do not currently use advertising pixels, session-replay tools, or third-party behavioural analytics on this site.
3. Why we use personal information
We may use personal information to:
- generate or validate an estimate and assess whether a device is eligible;
- contact you about your request, send packing instructions and a shipping label, arrange shipping or return, inspect the device, and make or confirm payment after you approve a final offer;
- verify ownership, prevent fraud, detect stolen, lost, locked, financed, or unlawfully obtained devices, and protect Cashify, sellers, and the public;
- respond to questions, complaints, access requests, corrections, and disputes;
- maintain records, enforce our Terms of Use, comply with tax, consumer-protection, court, regulatory, insurance, and other legal obligations; and
- maintain, secure, troubleshoot, and improve the service using de-identified or aggregated information where reasonably possible.
We do not sell personal information. We do not use your information to make automated decisions that produce legal or similarly significant effects without meaningful human involvement.
4. Automated estimates and human review
The estimate shown on our home page is produced automatically. No person reviews it before it appears, and the page says so at the moment the number is displayed.
The estimate is calculated from four inputs and nothing else: the model and storage you selected, the condition you selected, whether you told us the device powers on and holds a charge, and whether you told us it is free of carrier locks, Activation Lock and lost-device reports. Each model has a published base price, which is then adjusted for the condition you selected and for a device that does not power on or is locked or reported lost. No personal information about you is used, no profile of you is built, and no information from outside your own answers is fed into the number.
An estimate is not a decision about you and it is not final. A person inspects the device, and you see and accept the final offer before any money moves. You may also ask us to explain the estimate, tell us what you believe is wrong with it, and have a person review it. Requests are recorded against your reference number and worked through by a person: use the human review form.
5. Consent and your choices
Accepting our Terms of Use is a separate act from consenting to the use of your personal information. The seller form asks for them separately, and it asks for each privacy purpose separately. Nothing is ticked for you, and consent to an optional purpose is never a condition of selling us a device.
- Required — completing your request. Using your contact details, address, device description and photos to review the request, send a shipping label, inspect the device, make an offer, pay you, and return the device if you decline. Without this consent we cannot process a sale at all.
- Optional — improving our estimates. Keeping device photos and inspection results, separated from your contact details, to check and improve how estimates are calculated.
- Optional — marketing email. Emailing you about Cashify prices and offers later. This is never sent unless you ask for it, and every message includes a way to stop.
We record which consents you gave, in which language, and against which version of this policy and of the Terms of Use, so that the record names the exact wording you saw.
You may withdraw either optional consent at any time without affecting a sale in progress. Withdrawing the required consent means we cannot continue: it may prevent us from sending a label, completing a purchase, paying you, returning a device, or resolving an existing transaction. To withdraw a consent, use your privacy rights page.
Where applicable law permits collection, use, or disclosure without consent—for example, to comply with a legal obligation, investigate fraud, or respond to a valid legal demand—we may rely on that authority. We will not require consent for purposes unrelated to providing the requested service.
6. Personal data left on a device
You are responsible for backing up and removing personal data from a device before shipping it. During inspection, we may need to power on and test device functions. We do not intend to access personal content, but data left on a device may be visible to a technician.
We will not intentionally reset or erase a device before you accept a final offer unless you ask us to, it is reasonably necessary to protect a person or secure the device, or law requires it. After acceptance, we use the manufacturer-supported reset or secure-erase process applicable to the device, remove accounts and eSIMs where possible, and verify that it starts at the initial setup screen with activation lock disabled before it may be resold. A device that does not pass that check is kept out of resale until the issue is resolved. If we discover personal information on a device, we will handle it as confidential information and take reasonable steps to avoid accessing or retaining it, except where necessary to protect a person, investigate fraud, or comply with law.
8. Cross-border processing
Where your information is processed, which providers are involved, and the assessment we complete before anything leaves Québec or Canada are published as a separate record: Where your data is processed. That page is the assessment itself, not a summary of it, and it is dated and versioned.
Information processed in another jurisdiction may be subject to that jurisdiction’s laws and may be accessible to foreign courts, law enforcement, or regulatory authorities. Before communicating personal information outside Québec we assess the sensitivity of the information, the purpose, the protections the provider gives it including contractual terms, and the legal framework where it lands — and we do not send it if the assessment shows it would not receive adequate protection.
If Cashify begins using a provider that materially changes where or how your information is processed, we complete a new assessment, publish a new version of that page, update this policy and, where required, provide additional notice or obtain consent.
9. Retention, deletion, and de-identification
Every class of information we hold has a fixed window, written into the system rather than left to judgement. Information past its window is destroyed. These are the windows:
| What | How long | Why that long |
|---|---|---|
| Device photographs | 90 days after the last activity on the request | Photographs are the most revealing thing you send us — a serial number, a lock screen, a room — and they stop being useful once an inspection is settled. |
| The request itself: your name, contact details, address, device description and notes | 1 year after the last activity | After a year there is no operational reason to hold contact details for a request that did not complete. |
| A completed purchase, reduced to a tax record | 7 years | The Canada Revenue Agency requires six years from the end of the tax year. At the one-year mark the full record is minimized, not kept: the price, date, device and reference survive; your address, phone number, photographs and notes are destroyed. |
| Government identification given when you sell a device: the kind of document, its number, where it was issued, and your date of birth | 180 days after we take it | A dealer in second-hand goods has to record who sold each device. It is held apart from the rest of your record, under stricter access control, and destroyed once the device has cleared its 30-day holding period and the acquisition has been reported. What survives is that identification was checked, not the document. |
| A privacy request and what we did about it | 3 years after it closes | Long enough to answer a regulator asking whether we met the 30-day deadline. |
| The confidentiality incident register | 5 years | The period Québec law requires the register to be kept. |
| The access log described in the next section | Kept | It records references and actions, never names or addresses. Removing entries from it would defeat the point of keeping it. |
Destruction is permanent: what is left is a record that something with that reference existed and was destroyed, with no personal information in it. If you withdraw a required consent, or ask us to delete your record, we do the same thing immediately rather than waiting for a window to expire — except for a completed purchase, where we keep the minimized tax record described above and tell you that we have.
Some information may be retained longer where a law requires it, or where it is reasonably necessary to establish, exercise, or defend a legal claim. If that happens to your record we will tell you, and say which obligation it is.
10. Security safeguards and breach response
We maintain physical, organizational, and technological safeguards appropriate to the sensitivity of the information we hold. Personal information is encrypted in transit and at rest. Seller records are kept apart from anything the public website serves. Access is limited to authorized staff through an authenticated console, every access, correction, export and destruction is logged, and the service limits repeated automated attempts against it. We review these safeguards as the service changes, and we do not publish the details of how they are implemented, because doing so would help someone attack them.
No method of transmission or storage is completely secure; please do not send information you do not want us to receive.
If we determine that a privacy breach creates a real risk of significant harm or triggers another legal notification obligation, we will take steps required by applicable law, which may include notifying affected individuals, regulators, and other organizations, and keeping required records.
11. Your access, correction, and other privacy rights
Subject to applicable law and limited exceptions, you may ask us to confirm whether we hold personal information about you, explain how it has been used or disclosed, provide access to it, correct inaccurate information, withdraw consent, or request deletion where we no longer need it.
Portability. You can obtain the personal information you gave us in a structured, commonly used, machine-readable format, including the photographs you uploaded, rather than only reading it. Use the reference number shown when you sent your request together with the email address on that request on your privacy rights page, and the file downloads immediately. We ask for both together so a reference number on its own can never reveal someone else’s information.
Automated decisions. You can ask a person to review an automated estimate and make representations about it. See automated estimates and human review.
To make a request, use the forms on your privacy rights page, or the contact routes published on the Cashify home page, and provide enough information for us to verify your identity and locate the record. We may need to request reasonable identification before responding. We will respond within the time required by applicable law or explain a permitted extension or refusal. We will not discriminate against you for making a privacy request, though some requests may affect our ability to provide the service.
If you are not satisfied with our response, you may contact the relevant privacy regulator, including the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia, as applicable.
12. Who is responsible, and in which language
One named person is accountable for the personal information Cashify holds and for answering privacy requests. Their title and contact details are published before seller requests open. Until then, use the self-service routes on your privacy rights page for portability, automated-estimate review, and consent withdrawal.
This policy, the Terms of Use and every notice in the seller flow exist in French and in English, and the French version is offered first to sellers in Québec. Where you choose to use the English version instead, that choice is explicit and is recorded with your consent. You can write to us in either language and we answer in the language you used.
If our answer does not satisfy you, you can complain to the Commission d’accès à l’information du Québec or to the privacy regulator for your province, without going through us first. Complaints about French-language commerce go to the Office québécois de la langue française.
14. Transactional email and marketing
We may send service messages about an estimate, shipping label, inspection, return, payment, support, security, or legal notice. These messages are not marketing.
Every message we send, service or commercial, identifies Cashify and gives a way to reach a person. Commercial messages additionally carry a mailing address and a one-click unsubscribe link that works without signing in, as Canada’s Anti-Spam Legislation requires.
You can withdraw marketing consent at any time, from the withdrawal form or from any commercial message. Withdrawing it does not stop essential transaction messages about a sale in progress. When you unsubscribe we record that you have opted out, so that we stop writing to you.
15. Children and minors
Cashify is not directed to children. You must be the age of majority in your province or territory and capable of entering into a sale agreement to use the service. If we learn that we collected personal information from a person who is not eligible to use Cashify without appropriate authority, we will take reasonable steps to delete it or obtain appropriate consent.
16. Changes to this policy and complaints
We may update this policy when our practices, service providers, or legal obligations change. The current version and effective date will appear at the top of this page. For a material change, we will give affected sellers at least 30 days’ advance written notice, describe the change and its effective date, and give a way to stop the affected sale before it takes effect. We will not apply a material change to an active seller request unless the seller re-confirms acceptance through the notice flow or applicable law permits otherwise.
Questions, access requests, correction requests, withdrawal of consent, and complaints should first be directed to our privacy contact. We will investigate complaints fairly and respond in accordance with applicable law.
Contact Cashify about privacy
Portability, human review of an estimate, and consent withdrawal are handled by the forms on your privacy rights page. For anything else, use the contact routes published on the Cashify home page and say that it is a privacy request. Do not send government ID, card numbers, passwords, or account-recovery codes by email.
17. Canadian privacy resources
This policy is designed around Canadian private-sector privacy principles, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable, and substantially similar provincial private-sector laws in Alberta, British Columbia, and Québec. It does not replace legal advice or determine which law applies to a particular business or transaction.