Privacy Policy

Introduction

Sweets by Steph is a gluten-free bakery owned and operated by Stephanie Glazer as a sole proprietorship ("Sweets by Steph", "we" or "us"). We respect your privacy and are committed to protecting it by following this policy.

This policy describes:

• How we collect, use, disclose, and protect the personal information of our customers and website visitors ("you").
• The types of information we may collect from you, or that you may give us, when you visit sweetsbysteph.ca (our "Website") or place an order with us.
• Our practices for collecting, using, keeping, protecting, and disclosing that information.

We use your personal information only as described in this policy, unless the law requires otherwise. We collect only the information we need, and we use it only for the purposes set out below.

Privacy laws in Canada generally define "personal information" as any information about an identifiable individual. This includes information that can be used on its own, or with other information, to identify, contact, or locate a single person.

This policy applies to information we collect, use, or disclose about you:

• On our Website.
• In email, text, Instagram, and other electronic messages between you and us, including when you place or discuss an order.

Our Website may include links to other websites and services, including Instagram and Square. Clicking on those links may allow the third party to collect or share information about you. These third parties have their own privacy policies, which we do not control and are not responsible for. If you message us on Instagram, Meta also handles those messages under its own privacy policy. We encourage you to read the privacy policy of every website you visit.

Please read this policy carefully. If you do not agree with our practices, you can choose not to use our Website or place an order with us. By using our Website or placing an order, you consent to the practices described in this policy. This policy may change from time to time (see Changes to Our Privacy Policy). We will let you know in advance of any material change and ask for your consent before we collect, use, or disclose your personal information in a new way.

Information We Collect About You

We collect and use the following types of information from and about you:

• Personal information that identifies you or could be used to identify you, such as your name, delivery or mailing address, email address, phone number, the date of your event and the details of your order, the name and address of a person an order is for or delivered to, any allergy or dietary information you choose to give us, and any photos or images you send us about an order.
• Technical and usage information that is collected automatically when you use our Website, such as your IP address, device and browser type, approximate location (city level), the pages you view and for how long, and how you arrived at our Website (for example, from Instagram or a search engine). We collect this information through Google Analytics, as described below.

Allergy and dietary information is sensitive. Our order form has an optional "additional information" field where you can tell us about allergies or dietary needs. We use this information only to prepare your order safely. You do not have to give it to us.

If you give us personal information about another person, such as the person a gift is for, you confirm that you have their permission to do so.

How We Collect Information About You

We collect your information in two ways:

• Directly from you, when you place an order or fill in a form on our Website, or when you contact us by Instagram, email, or text message.
• Automatically, through cookies and similar technologies, including Google Analytics, as described below.

Information You Give Us

The information you give us on our Website or when you place an order may include:

• Information you enter when you place an order or submit a custom order request on our Website.
• Records and copies of your correspondence with us, including emails, Instagram messages, and text messages.
• Details of your orders and payments. Card payments are processed by Square, our payment processor. We never see or store your full card number. If you pay by e-transfer, we see the name and email address attached to the transfer.

Information We Collect Through Cookies and Google Analytics

Our Website and Square checkout use cookies and similar browser storage that are necessary for the Website to work, such as to keep items in your cart, secure the checkout, and protect our Website from malicious traffic. A cookie is a small file placed on your computer or device.

We also use Google Analytics, a web analytics service provided by Google, to understand how visitors use our Website, such as which pages are most popular and how visitors find us. Google Analytics uses cookies to collect information about your visits, including the pages you view, how long you spend on them, your device and browser type, your approximate location, and the website or app that referred you. Google processes this information on our behalf, and it may be stored on servers in the United States. We see this information only in summary reports and do not use it to identify you.

Cloudflare, which delivers and secures our Website, also counts visits to our pages without using cookies.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout. You can also set your browser to refuse cookies, but if you refuse all cookies, some parts of our Website may not work.

We do not use advertising pixels or other technologies to track your activity across other websites.

How We Use Your Information

We use the information we collect about you, or that you give us, to:

• Present our Website and its contents to you.
• Understand how visitors find and use our Website, so we can improve it.
• Prepare, deliver, and process payment for your order.
• Communicate with you about your order, including to confirm details and arrange pickup or delivery.
• Carry out our obligations and enforce our rights under any agreement with you, including for billing and collection.
• Keep business and tax records as required by law.
• Any other purpose with your consent.

We do not currently send newsletters or promotional messages. If we start, we will send them only to people who have signed up to receive them, and every message will include a way to unsubscribe. You can also opt out at any time by emailing us at [email protected]. See Choices About How We Use and Disclose Your Information.

Disclosure of Your Information

We do not sell, rent, or trade your personal information, and we do not share it with other businesses for their own marketing. We may disclose your personal information:

• To the service providers we use to run our business: our payment processor, Square; our website hosting and email providers; our website analytics provider, Google; and, if we start sending newsletters, our email marketing provider. We share only the information each provider needs to provide its service to us. These providers handle your information under their own terms of service and privacy policies. Square also uses payment information for its own purposes, such as preventing fraud, as described in Square's privacy notice.
• To people who help us run Sweets by Steph, including family members and anyone assisting with our Website or social media. They may see your information only as needed to do that work, and we require them to keep it confidential.
• To a buyer or successor if Sweets by Steph is sold or transferred, in which case your information would continue to be used only as described in this policy.
• For any other purpose we tell you about when you give us the information.
• With your consent.

We may also disclose your personal information:

• To comply with a court order, law, or legal process, including a government or regulatory request.
• To enforce any agreement with you, including for billing and collection.
• If we believe it is necessary to protect the rights, property, or safety of Sweets by Steph, our customers, or others.

Transferring Your Personal Information

Some of our service providers, including Square and Google, are located in the United States or store information outside Canada. Messages you send us on Instagram are also stored by Meta outside Canada. While your personal information is outside Canada, it is subject to the laws of that country, which may not protect it in the same way Canadian law does. The courts, law enforcement, and government authorities in that country may be able to access it. We use service providers that protect personal information with safeguards comparable to those required in Canada.

You are welcome to contact us for more information about our service providers outside Canada. See Contact Information and Challenging Compliance.

Choices About How We Use and Disclose Your Information

You have the following choices about your information:

• Cookies and analytics. You can set your browser to refuse all or some cookies, or to alert you when a cookie is being sent. If you do, some parts of our Website may not work properly. You can also opt out of Google Analytics using Google's opt-out browser add-on. See Information We Collect Through Cookies and Google Analytics.
• Promotional messages. If you have signed up for promotional emails or texts from us and no longer want them, you can unsubscribe using the link in any message or by emailing us at [email protected]. This does not affect messages we send you about an order you have placed.

Data Security

We take reasonable steps to protect your personal information from loss and from unauthorized access, use, change, and disclosure. These steps include password protection and, where available, two-step verification on the accounts we use to run our business, and limiting access to your information to the people who need it. Card payments are processed by Square and are encrypted; we never receive or store your full card number. We also keep customer messages on the phone we use for the business, which is passcode protected.

No method of sending or storing information over the internet is completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of information you send to us. You send it at your own risk.

Data Retention

We keep your personal information only as long as we need it for the purposes described in this policy, including to meet any legal, accounting, or tax requirements. We delete customer order information when we no longer need it, generally within two years after your last order with us. Google Analytics information is kept for the period set in our Google Analytics account, which is no longer than 14 months. Records we must keep for tax purposes are kept for as long as the law requires. You can ask us to delete your information sooner (see Accessing and Correcting Your Personal Information).

Children Under the Age of 13

Our Website is not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. Orders for a child, such as a birthday cake, must be placed by a parent or guardian. If we learn that we have collected personal information from a child under 13 without a parent or guardian's consent, we will delete it. If you believe we may have information from or about a child under 13, please contact us at [email protected].

Accessing and Correcting Your Personal Information

It is important that the personal information we hold about you is accurate and current. Please let us know if your personal information changes. By law, you have the right to ask for access to the personal information we hold about you and to ask us to correct it.

To review, verify, correct, or delete your personal information, or to withdraw your consent to our use of it, email us at [email protected]. We may ask you to confirm your identity before we respond. We will respond within 30 days, or let you know if we need more time, as the law allows. We may not be able to change information if doing so would break the law or make the information incorrect. If we do not make a correction you ask for, we will note your request in our records.

In limited cases, the law may allow or require us to refuse access to some or all of your personal information, or we may have already deleted it under our retention practices. If we cannot give you access, we will tell you why, subject to any legal restrictions. Examples of information we may not be able to provide include:

• Information protected by solicitor-client privilege.
• Information that is part of a formal dispute resolution process.
• Information about another person that would reveal their personal information.
• Information that would be prohibitively costly to provide.

Withdrawing Your Consent

You may withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions. To do so, contact us at [email protected]. If you withdraw your consent, we may not be able to complete your order or provide a particular product or service. We will explain the impact at the time to help you decide.

Changes to Our Privacy Policy

If we change this policy, we will post the updated version on this page and update the "last updated" date at the top. If we make a material change to how we handle your personal information, we will let you know by email, if we have your email address, or by a notice on our Website home page, and we will ask for your consent before we collect, use, or disclose your personal information in a new way.

Please check this page from time to time for updates, and let us know if your email address changes.

Contact Information and Challenging Compliance

We welcome your questions, comments, and requests about this policy and our privacy practices. Please contact:

We will respond to any complaint or question about how we handle personal information and our compliance with this policy and privacy law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.