Privacy Notice

Draft notice and privacy contact

This notice is a working draft. The operator’s legal identity, business address and privacy contact email are required before launch, along with review under applicable federal and provincial privacy laws. Contact and complaint procedures must be completed before relying on this as a production notice.

Information and purposes

The marketplace uses account and email-verification information, buyer interests and delivery preferences, shop profiles and operating addresses, listings and images, favourites and collections, email preferences, orders, fulfilment details, payment references and feedback. These support authentication, discovery, purchases, seller eligibility, customer support, fraud prevention and requested notifications.

Seller policy records include your account ID, policy version, explicit seller attestations and server-recorded acceptance time. We retain the exact accepted policy text. These records are not newsletter consent. This feature does not independently verify that a design is human-created or that an address proves Canadian residency.

Moderation records include reports, strikes and seller-visible explanations, internal admin notes, suspension and funds-hold decisions, appeals, supporting files and review history. We use them to investigate policy concerns, review appeals, protect buyers and sellers, and resolve payment obligations. Sellers can view their own case information and evidence; internal admin notes and other users’ private information are not shared with them. Appeal evidence is accessible only to its seller and authorized admins, rather than publicly displayed.

Visibility and service providers

Storefront details, published product content and shop blog posts are public. The testing feedback board is shared with authorized testing/admin viewers and reports can include a signed-in reporter’s email; do not include secrets or sensitive personal information. Private delivery and operating addresses are not published as storefront content.

Order recipients’ names, addresses and necessary order information are shared with the relevant sellers for fulfilment. Stripe processes payments and seller verification under its own notices. Supabase provides account, database and storage services, and the configured SMTP service delivers emails. Service providers may process information outside your province or Canada; applicable protections and provider arrangements require review before launch.

Security, retention and choices

We limit access by role and purpose and use authentication and database access controls, but cannot promise absolute security. Retention must reflect operational needs and legal obligations; a documented retention schedule is required before launch. Deleted public content may remain in backups or legally required transaction records for the applicable period.

You can update profile and delivery information, manage vendor email preferences and request access, correction, deletion or a privacy complaint using the privacy contact required before launch. Requests remain subject to applicable law and necessary transaction records. Essential session storage supports sign-in; optional marketing consent is separate and may be withdrawn without losing the ability to fulfil an existing order.