← Back to The Bedside Exit

Privacy

This policy explains what personal information The Bedside Exit collects, why, and what your rights are. It is written in plain language because privacy disclosures should be readable, not just compliant.

1. Who we are

The Bedside Exit is operated by 2800977 Alberta Inc. (the "Company"), a Canadian corporation incorporated under the laws of Canada and registered in the Province of Alberta. Business Number: 794307173. Corporation Number: 2028009773.

We do business as The Bedside Exit at bedsideexit.com.

Contact for privacy matters: editor@bedsideexit.com

2. What information we collect

Information you give us

• Email address — collected when you subscribe to The Bedside Exit newsletter or purchase a product. Required to deliver what you signed up for.
• Payment details — if you purchase The Exit Manual or The Quarterly subscription, payment is processed by Stripe (for direct purchases) or Whop (for Exit Manual storefront purchases). We never receive, see, or store your card number, CVV, or full payment credentials. What we receive from Stripe/Whop is a transaction confirmation and, where tax compliance requires it, your billing country.
• Messages you send us — if you reply to an email or contact us at editor@bedsideexit.com, we keep that correspondence.

Information collected automatically

• Server logs — our hosting infrastructure (Netlify, Cloudflare) automatically records IP addresses, request paths, and timestamps. These logs are used solely for security, uptime monitoring, and fraud prevention. They are not used for advertising or behavioral profiling.
• No marketing cookies — this site does not set cookies for advertising, retargeting, or analytics. We do not use third-party tracking pixels. Essential session cookies may be set if you use authenticated features of the site; these expire when you close your browser.

3. Why we collect it

1. To deliver the publication. We send issues of The Quarterly and access to The Exit Manual to subscribers and purchasers. Without your email, we cannot do this.
2. To process purchases. Payment data is handled by Stripe and Whop. We retain transaction references to manage subscriptions, cancellations, and refund eligibility.
3. To comply with tax and accounting obligations. Canadian tax law requires us to retain records of commercial transactions for a minimum of seven years. This is a legal obligation, not a choice.
4. To prevent fraud and protect security. Server logs and IP data allow us to identify and block abusive requests, content scraping, and unauthorized distribution of paid content.
5. To communicate with you. If you contact us, we use your message to respond. We do not add you to a marketing list as a result of a support inquiry.

4. Legal basis for processing

For readers in Canada, our collection is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA). For readers in the EU/EEA, the GDPR applies. In both frameworks, we rely on the following bases:

Processing activity	Legal basis
Sending newsletter emails you opted into	Consent (PIPEDA / CASL / GDPR Art. 6(1)(a))
Delivering a purchased product	Performance of a contract (GDPR Art. 6(1)(b)); necessary purpose under PIPEDA
Retaining transaction records	Legal obligation (Canadian tax law; GDPR Art. 6(1)(c))
Server logs / fraud prevention	Legitimate interest (GDPR Art. 6(1)(f)); security purpose under PIPEDA
Responding to your messages	Legitimate interest; contract performance where applicable

5. Who we share it with

We do not sell, rent, or trade your personal information. We share data only with the processors listed below, each engaged for a specific operational purpose.

Processor	Purpose	Privacy policy
Supabase	Subscriber database (Canada region)	supabase.com/privacy
Resend	Transactional and newsletter email delivery	resend.com/legal/privacy-policy
Stripe	Payment processing for direct purchases and subscriptions	stripe.com/privacy
Whop	Storefront and delivery for The Exit Manual	whop.com/privacy
Cloudflare	DNS, CDN, and DDoS protection	cloudflare.com/privacypolicy
Netlify	Website hosting and deployment	netlify.com/privacy

Each processor is contractually bound to use your data only for the stated purpose. We do not authorize any processor to use your data for their own marketing purposes.

6. Where your data is stored

• Subscriber email addresses are stored in Supabase, hosted in the Canada region.
• Payment records are held by Stripe, whose infrastructure is based in the United States.
• Email delivery logs are held by Resend, based in the United States.
• Exit Manual purchase records are held by Whop, based in the United States.

Cross-border transfers. PIPEDA requires us to disclose when personal information is transferred outside Canada. Payment and email delivery data is processed in the United States. While PIPEDA does not require foreign recipients to provide the same level of protection as Canadian law, we have selected processors with strong privacy practices and contractual protections. You may direct questions about cross-border transfers to editor@bedsideexit.com.

7. How long we keep it

Type of data	Retention period
Subscriber email (active)	Kept while you are subscribed
Subscriber email (after unsubscribe)	Deleted within 30 days of confirmed unsubscribe
Transaction records	7 years from the date of transaction (Canadian Income Tax Act requirement)
Server logs (IP addresses, request logs)	30 days, then deleted automatically
Correspondence (emails you send us)	2 years from the date of last contact, then deleted

After retention periods expire, data is deleted or anonymized. We do not archive personal information beyond what is described here.

8. Your rights

Under PIPEDA (and PIPA in Alberta), you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — ask us to delete your information, subject to any legal retention obligations (e.g., tax records cannot be deleted early).
• Withdrawal of consent — withdraw your consent to marketing emails at any time (via the unsubscribe link in any email, or by contacting us). Withdrawal does not affect data we must retain for legal reasons.
• Portability — request your data in a commonly used, machine-readable format where technically feasible.
• Complaint — complain to the Office of the Privacy Commissioner of Canada (OPC) if you believe we have mishandled your information.

How to exercise your rights: Email editor@bedsideexit.com with the subject line Privacy Request. Describe what you are requesting. We will respond within 30 days. In some cases we may need to verify your identity before acting on the request.

9. Rights for EU and EEA visitors

Although The Bedside Exit is not primarily marketed to EU or EEA audiences, we respect the rights conferred by the General Data Protection Regulation (GDPR). If you are located in the EU or EEA, you have all the rights described in Section 8 above, plus:

• Right to object — you may object to processing based on legitimate interest, including any profiling.
• Right to restrict processing — you may ask us to restrict processing while a dispute is resolved.
• Right to complain to a supervisory authority — you may lodge a complaint with your local data protection authority.

Data controller for GDPR purposes: 2800977 Alberta Inc., contactable at editor@bedsideexit.com. We do not maintain a designated EU representative, as we are a small Canadian operator without a principal establishment in the EU and do not systematically target EU residents. We grant GDPR rights as a matter of policy regardless of this.

10. Commercial email (CASL)

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages sent to Canadian recipients. We comply as follows:

• Express consent. We send marketing or newsletter emails only to people who have explicitly opted in (via a subscription form or product purchase where consent is clearly indicated at the point of collection).
• Identification. Every email we send identifies the sender as The Bedside Exit, operated by 2800977 Alberta Inc.
• Contact information. Every commercial email includes a working contact address: editor@bedsideexit.com. As a digital-only operator, we use email as our official contact mechanism consistent with CASL requirements for electronic senders.
• Unsubscribe mechanism. Every email contains a clear, functional unsubscribe link. We process unsubscribes within 10 business days, as required by CASL.
• No implied-consent harvesting. We do not collect email addresses from public sources or add people to our list without a direct opt-in.

11. Children's privacy

The Bedside Exit is not directed at anyone under the age of 18. We do not knowingly collect personal information from children. If we learn that we have inadvertently collected information from someone under 18, we will delete it promptly. If you believe a minor has provided us with information, contact us at editor@bedsideexit.com.

12. Security

We take reasonable technical and organizational steps to protect your information:

• TLS in transit. All connections to bedsideexit.com are encrypted via TLS (HTTPS). Emails are delivered over TLS where supported.
• Encryption at rest. Subscriber data in Supabase is encrypted at rest using Supabase's managed encryption.
• Payment security. Card payments are handled by Stripe, which is certified to PCI-DSS Level 1. We never transmit or store card numbers on our own servers.
• Access controls. Access to subscriber data is limited to necessary operational functions and is not shared with outside parties beyond the processors named in Section 5.

No method of electronic transmission or storage is 100% secure. We maintain these practices as a reasonable safeguard, not as an absolute guarantee.

13. Data breaches

If we become aware of a security breach that involves your personal information and creates a real risk of significant harm, we will:

• Notify affected subscribers by email within 72 hours of confirming the breach, where contact information is available.
• Report the breach to the Office of the Privacy Commissioner of Canada as required under PIPEDA's mandatory breach reporting rules.
• Keep a record of the breach and our response.

14. Changes to this policy

If we make material changes to this policy — meaning changes that affect how your information is collected, used, or shared — we will notify active subscribers by email before the changes take effect. The "Last updated" date at the bottom of this page will always reflect the current version. Continued use of The Bedside Exit after notice constitutes acceptance of the revised policy.

Minor, non-material changes (such as clarifications or formatting updates) may be made without individual notice.

15. Privacy officer

PIPEDA requires every organization to designate an individual responsible for compliance with its privacy obligations. That person is The Editor — the individual responsible for the operation of The Bedside Exit and 2800977 Alberta Inc.

Privacy Officer contact: editor@bedsideexit.com — subject line Privacy Request. We respond within 30 days.

16. Jurisdiction

This privacy policy is governed by the laws of the Province of Alberta, Canada, and the applicable federal laws of Canada, including PIPEDA and CASL. Any dispute arising from this policy is subject to the jurisdiction of the courts of Alberta, unless applicable consumer protection law in your jurisdiction provides otherwise.

Last updated: May 2026