Marketing Communications Policy

1. What This Policy Covers

This Policy explains when and how Candyll sends you electronic messages — email, push notifications, and in-app messages — and how you control them. It is written to comply with Canada's Anti-Spam Legislation ("CASL") and with the consent rules in our Privacy Policy.

"Candyll", "we", and "us" mean Boryne Labs Ltd. (operating as 'Candyll'), operator of the candyll.com website and the Candyll mobile app (together, the "Platform"), whose mailing address is 604-7769 Park Crescent, Burnaby, BC V3N 0J7, Canada. Capitalized terms not defined here (such as "Deal", "Group Deal", "Pledge", "Final Confirmation", "Deal Pass", and "Redemption") have the meanings given in the Terms of Service.

This Policy is one of the Policies incorporated into the Terms of Service. On the subject of marketing and electronic communications, this Policy prevails over the Terms of Service; the Terms of Service govern everything else. For how we handle the personal information involved (such as your email address, push token, and consent records), the Privacy Policy applies. Nothing in this Policy limits any right you have under applicable law that cannot be waived; if anything here conflicts with such a right, the right prevails.

2. Two Kinds of Messages: Service Messages and Marketing Messages

We separate everything we send into two categories, and we treat them differently.

Service messages are part of operating the service you asked for. We send them without marketing consent because you cannot use the Platform properly without them. They include:

sign-in and verification codes;
Pledge and Final Confirmation acknowledgements, and Deal Pass issuance notices;
Group Deal outcome notices — that your Deal reached its group threshold and your Deal Pass was issued, or that it did not proceed (no payment is ever involved either way, because Candyll never charges you);
Deal Pass reminders (for example, that a Deal Pass is about to expire);
Redemption reminders for a Deal Pass you hold;
security alerts about your account;
responses to your support, privacy, or security requests;
required notices about changes to our terms and policies.

We keep service messages free of promotional content. If a message ever combines service content with promotional content, we treat the whole message as a marketing message under this Policy. In practice that means we do not insert unrelated Deal recommendations, discounts, or promotional taglines into a Deal Pass notice, a booking notice, a security alert, a support reply, or any other operational message.

How we classify a message — the test is purpose and content, not how it was sent. We do not treat a message as exempt from CASL merely because a person typed and sent it by hand from our own email account rather than the Platform sending it automatically. A manually sent message can still be a commercial electronic message if its purpose or its content encourages participation in a commercial activity — so a hand-written email that promotes a Deal, a Merchant, or an offer is a marketing message under this Policy and needs the consent, identification, and unsubscribe elements in Sections 3 and 4, whoever sent it and however few people received it. What keeps our one-to-one support, security, privacy, legal, and Merchant-onboarding correspondence outside that category is that it stays genuinely operational: it answers the matter at hand and does not promote anything.

Marketing messages promote something — for example, feature announcements, Deal recommendations and roundups, promotions or offers, and news about Merchants on the Platform. We send marketing messages only if you have opted in, and every one of them includes the identification and unsubscribe elements described in Section 4.

Alerts you switch on yourself. Some notifications exist only because you asked for them — for example, alerts about a store you chose to follow or a Deal you favourited. You control these directly in your notification settings and can turn them off the same way you turned them on.

Off by default. Marketing is off unless you opt in — you turn it on from the notification preferences in your account settings, and nowhere else. There is no marketing checkbox in signing up, and we do not ask you for marketing consent while you are creating your account. You still get full use of the Platform whether or not you opt in.
Never bundled. Agreeing to the Terms of Service is never treated as marketing consent, and marketing consent is never a condition of creating an account, taking part in a Deal, or buying anything.
Opt in or out any time. You can turn marketing on or off in your account settings whenever you like, on the web or in the app.
We keep records. We log when and how you gave or withdrew each consent, and which version of our terms was in force, so we can prove and honour your choice.
Consent lasts until you withdraw it. Your opt-in does not expire on its own; it stays valid until you unsubscribe or delete your account.

3A. Where Marketing Stands Today

We describe what we actually do, not what we might do later:

No automated promotional email program is running. Product-generated promotional email is disabled at the platform level.
Bulk promotional email is prohibited — including bulk sending by hand from a Candyll mailbox — until we complete a separate CASL activation review of consent evidence, sender identification, unsubscribe handling, and suppression.
One-to-one support, legal, security, privacy, Merchant-onboarding, and genuinely transactional messages continue as normal. They are operational in nature and carry no promotional content (Section 2).
Promotional push notifications stay off unless you switch them on yourself (Section 6).
Before any promotional outreach begins, we will have a documented consent or other lawful basis for each recipient, the sender identification and unsubscribe elements in Section 4, and a working suppression process that keeps unsubscribed and deleted addresses out of every future send (Section 5).

4. What Every Marketing Message Includes

Every marketing message we send:

identifies who sent it — Boryne Labs Ltd. (operating as 'Candyll'), our mailing address 604-7769 Park Crescent, Burnaby, BC V3N 0J7, Canada, and a way to reach us (customersupport@candyll.com or candyll.com);
includes a working unsubscribe — free, one step, no login wall, and functional for at least 60 days after the message is sent;
is honoured quickly — we process unsubscribes promptly, and in every case within 10 business days (our target is immediate).

If we ever send a marketing message that promotes a specific Merchant, the message is sent by Candyll under this Policy and will also identify that Merchant where the law requires it.

5. How to Unsubscribe

You can stop marketing messages at any time, by any of these routes:

click the unsubscribe link in any marketing email;
turn off marketing in your account settings;
write to us at customersupport@candyll.com.

Unsubscribing stops marketing messages only. You will keep receiving service messages (Section 2), because they are part of your account and your orders. If you delete your account, all marketing stops immediately — see the Data Retention & Account Deletion Policy.

Suppression. When you unsubscribe or delete your account, we record the withdrawal and keep the address on a suppression list, so that it is excluded from any future promotional send. The suppression record exists only to honour your choice; it is not used for any other purpose, and it is covered by the consent-record retention period in the Data Retention & Account Deletion Policy.

6. Push Notifications

Push notifications have two layers of control, and you hold both:

Device permission. Your phone's operating system asks you whether Candyll may send push notifications at all. If you decline or later revoke this in your device settings, no pushes are sent.
In-app preferences. Inside the app, notification categories are controlled separately. Order and account pushes (for example, "your Deal was Confirmed") are service messages. Promotional pushes are treated like marketing: they are governed by a separate preference that is off unless you turn it on, and you can turn them off at any time without affecting your order updates.

We design promotional push notifications to the same standard as marketing emails — clear sender identity and an always-available way to switch them off — regardless of how the law ultimately classifies them.

The two categories, in practice. Transactional / operational pushes and in-app notices include: a Deal unlocking or not unlocking, a booking being confirmed, changed, or cancelled, a durable contract copy becoming available, a Deal Pass being issued or about to expire, a pickup or service reminder, a security alert, a privacy-incident notice, and a support response. Marketing pushes include: recommended Deals, promotional campaigns, Merchant advertisements, "come back" messages, discounts unrelated to a booking of yours, and newsletter-style content. Marketing notifications are off at launch, and no promotional content is added to a transactional notification.

7. Quiet Hours

As a practice, we avoid sending promotional notifications during late-night and early-morning hours in your local time. This is a courtesy practice we apply to marketing only — it never delays service messages such as security alerts, Deal outcome notices, or Redemption reminders, and it is not a contractual commitment.

8. Merchants and Your Contact Details

Merchants can pay for extra visibility of their Deals inside the Platform (promoted placements are labelled where the law requires). That visibility never involves your contact details:

we do not give Merchants your email address, full phone number, or push token;
Merchants cannot send you email or text messages through Candyll;
what Merchants can see about you is limited to the short list in the Privacy Policy (Section 6 of that document).

9. Referral and Invitation Features

Candyll does not currently operate a customer referral program. If one is ever offered, it will be governed by the Promotions, Credits, Rewards & Referral Policy, and any invitation feature will be built to comply with anti-spam law — personal, one-to-one sharing rather than bulk sending, with clear identification of Candyll's role in any message the Platform generates.

10. Text Messages (SMS)

We do not currently send marketing text messages. If we ever introduce them, the same rules in this Policy will apply: express opt-in that starts switched off in your settings, sender identification, and a free, fast unsubscribe.

11. Recognizing a Genuine Candyll Message

Genuine Candyll messages never request your password, verification codes, or any payment. Candyll never collects payment for a Deal — you pay the Merchant directly at the store — so a message claiming to be from Candyll that asks for your card number, an e-transfer, or any other payment is a scam. If you receive one, do not respond — report it as described in the Account Security Policy.

12. Changes to This Policy

We may update this Policy as the law, our features, or our practices change. We will post the updated version with a new version number and effective date, and for material changes we will give reasonable advance notice by email or in-app message. Each version applies from its stated effective date.

13. Contact

Boryne Labs Ltd. (operating as 'Candyll'), 604-7769 Park Crescent, Burnaby, BC V3N 0J7, Canada. Questions about this Policy or your message preferences: customersupport@candyll.com Privacy questions (including consent records): privacy@candyll.com — see the Privacy Policy.