Pass or Fail

Privacy Policy

Last updated: May 5, 2026

1. About This Policy

Pass or Fail (“we,” “us,” “our”) operates passorfail.ca, a public health inspection aggregator for Canadian restaurants. This Privacy Policy explains what personal information we collect, how we use it, how we protect it, and your rights under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Québec, the Act respecting the protection of personal information in the private sector (Law 25).

2. Privacy Officer

In accordance with PIPEDA and Québec’s Law 25, Pass or Fail has designated a Privacy Officer responsible for compliance with this Policy and applicable privacy law. The Privacy Officer can be contacted at:

Privacy Officer, Pass or Fail
Email: contact@passorfail.ca

3. Information We Collect

Automatically collected (when you visit the site):

  • Usage data and analytics via Google Analytics 4 (GA4) — pages visited, session duration, general geographic region, and device/browser type. GA4 uses cookies and similar tracking technologies. We have Google Signals enabledon our GA4 property, which means that for users signed in to a Google account with Ads Personalisation turned on, Google may associate GA4 events with that user’s cross-device, signed-in activity to provide aggregated cross-device reports, demographics and interests reporting, and remarketing audiences. See Section 7 for how this is treated under PIPEDA and Law 25. Where you have consented via our cookie banner (and absent a Global Privacy Control opt-out signal), GA4 is loaded; otherwise it is not.
  • Vercel, our hosting provider, may log standard HTTP request metadata (IP address, user-agent, timestamp) for infrastructure security and performance purposes. These logs are not used for marketing.

Voluntarily provided:

  • Email address— if you subscribe to inspection alerts (“notify me when this restaurant is inspected”), we collect your email address for the sole purpose of sending those alerts. We do not use your email for any secondary purpose.
  • Contact correspondence — if you email contact@passorfail.ca, we retain your message, email address, and any information you choose to include (which may include your name or other personal details) in order to respond to your inquiry.

We do not collect payment information, government identifiers, health information, or other sensitive categories of personal information.

4. How We Use Your Information — Purpose Limitation

We use personal information only for the specific purposes disclosed at or before collection:

  • To operate, maintain, and improve passorfail.ca
  • To send inspection alert notifications (only to email addresses that have explicitly subscribed, and only for that purpose)
  • To respond to inquiries sent to contact@passorfail.ca
  • To understand aggregate usage patterns via analytics
  • To comply with applicable law and respond to lawful requests

Pass or Fail does not build advertising profiles about you, does not sell personal information, and does not share personal information with third parties except the service providers listed in Section 7 who act on our behalf.

Third-party advertising. We display advertisements served by Google AdSense and its ad-network partners. Where you have consented (and absent a Global Privacy Control opt-out), Google and its partners may use cookies, device identifiers, and similar technologies to serve and measure advertisements, including personalised advertisements based on your prior visits to this Site and other sites. This processing is carried out by Google as a separate controller under Google’s Privacy Policy; Pass or Fail does not direct that profiling, does not receive the resulting advertising profile, and cannot access individual users’ advertising-cookie data. You may opt out of personalised advertising at google.com/settings/ads or via aboutads.info.

5. Health Inspection Data — Public Sources

The inspection data displayed on passorfail.ca is sourced from publicly available government datasets, including:

  • City of Toronto / DineSafe (Toronto Open Data, licensed under the City of Toronto Open Government Licence)
  • Regional Municipality of Peel — DineSafe programme (Mississauga, Brampton, Caledon)
  • Regional Municipality of Halton (Burlington, Oakville, Milton, Halton Hills)
  • Regional Municipality of York (Markham, Vaughan, Richmond Hill, Newmarket, Aurora, and others)
  • Region of Waterloo (Kitchener, Waterloo, Cambridge)
  • Ottawa Public Health (Ottawa)
  • Vancouver Coastal Health (VCH) (Vancouver, Richmond, Whistler, North Vancouver, West Vancouver)
  • Alberta Health Services (AHS) — Environmental Public Health (Calgary, Edmonton, Red Deer, Lethbridge, and other Alberta municipalities)
  • Saskatchewan Health Authority (SHA) — Inspection InSite portal (Saskatoon, Regina, Moose Jaw, Prince Albert, SK)
  • Interior Health Authority (IHA) (Kelowna, Kamloops, Vernon, Penticton, and other BC Interior cities)
  • Island Health (VIHA) (Victoria, Nanaimo, Tofino, Parksville)
  • Middlesex-London Health Unit (MLHU) (London, ON)
  • Hamilton Public Health Services (Hamilton, ON)
  • Ville de Montréal — court conviction records from donnees.montreal.ca (Montréal, QC). Note: Montréal publishes court convictions only, not routine inspection records.
  • MAPAQ (Ministère de l’Agriculture, des Pêcheries et de l’Alimentation du Québec) — provincial court conviction records from donneesquebec.ca (Brossard, Gatineau, Laval, Lévis, Longueuil, Québec City, Repentigny, Saguenay, Sherbrooke, Terrebonne, QC). Note: MAPAQ publishes court convictions only, not routine inspection records.
  • Additional municipal and regional health authorities as the service expands across Canada

This data is published by government agencies about inspected establishments; it is not personal information about you as a site visitor. We reproduce it as-is. See the Terms of Use for important accuracy limitations.

6. Cookies, Tracking, and Your Choices

We use a limited set of cookies and similar technologies:

  • Strictly necessary — required for the site to function (e.g. session cookies, cookie-consent preference).
  • Analytics and cross-device measurement — Google Analytics 4 sets cookies such as _ga and _gid to distinguish users and sessions. With Google Signals enabled, Google may also use Google-domain cookies (such as NID) to associate your visit with a Google account where you are signed in and have enabled Ads Personalisation, for the cross-device, demographics, and remarketing-audience purposes described in Sections 3 and 7. Loaded only where you have consented via our cookie banner.
  • Advertising — we display third-party advertisements served by Google AdSense. Google and its partners use cookies (such as IDE, DSID) to serve ads based on your prior visits to this site and other sites on the internet. Advertising cookies will not be set without your consent where consent is required. You may opt out of personalised advertising at google.com/settings/ads or via aboutads.info.

Your choices:

  • Use the cookie banner displayed on first visit to accept or reject non-essential cookies. You can change your preferences at any time.
  • We honour the Global Privacy Control (GPC) signal (Sec-GPC: 1). If your browser or extension sends GPC, we will not load non-essential trackers or advertising scripts on your session, regardless of your cookie-banner selection.
  • You may opt out of GA4 by installing the Google Analytics Opt-out Browser Add-on.
  • You may block or delete cookies in your browser settings at any time.

7. Service Providers and International Data Transfers

Processors acting on our behalf.The following providers process personal information on Pass or Fail’s instructions, under contractual confidentiality obligations and their own privacy commitments:

  • Vercel Inc. — website hosting and content delivery (servers may be located in the United States)
  • Supabase Inc. — database hosting (servers may be located in the United States)
  • Google LLC (Google Analytics 4)— website analytics. Loaded only where you have consented via our cookie banner and absent a GPC opt-out. As described under “Independent third parties” below, when Google Signals is active in this property, Google also processes some GA4 data for its own purposes as a separate controller. Data may be processed in the United States and other jurisdictions.

Independent third parties (separate controllers). The following third parties receive information directly from your browser when you visit the Site (subject to your consent and any GPC opt-out) and process it under their own privacy policies and for their own purposes, not as our processor:

  • Google LLC — Google Signals (cross-device tracking and ad personalisation in Google Analytics 4).Google Signals is enabled on our GA4 property. For users signed in to a Google account who have enabled Ads Personalisation, Google associates GA4 event data with their cross-device, signed-in activity for purposes including aggregated cross-device reporting, demographics and interests reporting, and remarketing audiences usable in Google’s advertising products. Pass or Fail does not control or receive that signed-in advertising profile. You may opt out of Google Signals processing by turning off “Ads Personalisation” in your Google account at myadcenter.google.com.
  • Google LLC (Google AdSense and ad-network partners) — advertising delivery, measurement, and personalisation. Data may be processed in the United States and other jurisdictions; see Google’s Privacy Policy and Section 4 (Third-party advertising) above for opt-out options.

Cross-border transfers: Because these providers operate from or process data in the United States and other jurisdictions, your personal information may be transferred outside of Canada (and outside of Québec, for Québec residents). While stored or processed abroad, personal information is subject to the laws of those jurisdictions, including lawful access by foreign authorities. By using the site, you acknowledge this transfer. For Québec residents, Pass or Fail considers the adequacy factors set out in Law 25 when selecting service providers and structuring transfers outside Québec.

The site may display links to third-party platforms (for example, online reservation and food-delivery services). These third parties operate independently under their own privacy policies; Pass or Fail does not share your personal information with them unless you voluntarily interact with their services.

8. Your Rights

All Canadian residents (PIPEDA):

  • Access: Request a copy of personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete information.
  • Withdrawal of consent: Unsubscribe from inspection alerts at any time by emailing contact@passorfail.ca (subject to legal or contractual retention obligations).
  • Challenge compliance: Challenge our handling of your personal information and receive a response to your challenge.
  • Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Québec residents — additional rights under Law 25:

  • Data portability: Request personal information you have provided in a structured, commonly used technical format.
  • De-indexation / erasure: Request de-indexation or deletion of personal information, subject to legal retention requirements.
  • Automated decision-making: We do not make decisions based exclusively on automated processing that produce legal or similarly significant effects about you.
  • Complaint:Lodge a complaint with the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.

To exercise any of these rights, email the Privacy Officer at contact@passorfail.ca. We will respond within 30 days of receiving a verified request; where a request is complex or voluminous, we may extend this period as permitted by law and will notify you.

9. Data Retention

  • Email alert addresses: Retained until you unsubscribe or request deletion.
  • Contact correspondence: Retained for up to 2 years, then deleted.
  • Analytics data: Retained according to our configured Google Analytics 4 data-retention settings.
  • Server logs (Vercel):Retained according to Vercel’s standard log retention policy.

10. Security and Breach Notification

We take reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, unauthorized access, disclosure, or alteration. Measures include encryption in transit (HTTPS), access controls on our database, and the use of reputable service providers with established security programs.

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and — for incidents affecting Québec residents — the Commission d’accès à l’information du Québec as required by Law 25.

11. Children’s Privacy

passorfail.ca is not directed at children. We do not knowingly collect personal information from children under 13 (or, for Québec residents, under 14) without verifiable parental consent. If you believe a child has provided us personal information, contact the Privacy Officer at contact@passorfail.ca and we will promptly delete it.

12. Changes to This Policy

We may update this Policy from time to time as the service grows or as the law changes. Material changes will be reflected in the “Last updated” date at the top of this page and, where we hold your email address for alerts, we will notify you of significant changes by email.

13. Contact

Questions, requests, or complaints regarding this Policy:

Privacy Officer, Pass or Fail
Email: contact@passorfail.ca