Privacy

This page explains what Way2Rare collects when you use the site, why, and who handles it for us. We follow Canada's privacy law, PIPEDA.

What we collect

• At checkout: your name, email, phone number, shipping address and what you ordered. You enter these on Stripe Checkout. Your card details go to Stripe and never touch our servers.

• Order records: we keep a record of each order so we can ship it, support you and keep our books.

• Newsletter: your email address, plus a consent record with the time you signed up, where you signed up, when you confirmed, when you unsubscribed and the exact wording you saw.

• A one-way hash of your IP address. We use it to limit abuse of checkout and the newsletter form. We can't turn it back into your IP address.

• Your cart and saved list are stored only on your own device.

• Staff login cookies are used for the team admin only.

• Visit statistics: Cloudflare Web Analytics counts aggregate visits (page, referrer, country and device type). It does not track individual visitors across sites. We don't use advertising trackers.

Why we use it

• To take payment, fulfil and ship your order.

• To send your order email.

• To send the newsletter, only after you confirm your email.

• To prevent abuse of the site.

• To meet our tax and accounting duties.

Who handles it for us

• Stripe: payments, tax and receipts (United States and Canada).

• Resend: sending order and newsletter emails (United States).

• Supabase: our database and photo storage (Canada (Montreal region)).

• Netlify: hosting the website (servers may be in the United States).

• Cloudflare Turnstile: a bot check on the newsletter form (global network).

• Cloudflare Web Analytics: aggregate visit statistics (page, referrer, country, device) (global network).

Some of these services handle data outside Canada, so your information may be stored or processed in other countries. We don't sell your information.

How long we keep it

We keep order records as long as we need them for tax and accounting. We keep newsletter consent records as proof of consent, including after you unsubscribe.

Your choices

Under PIPEDA you can ask to access the information we hold about you, ask us to correct it, and withdraw your consent for marketing at any time. Use the unsubscribe link in any newsletter, or email us.