Privacy policy

Privacy officer

Our person in charge of the protection of personal information makes sure this policy is followed. For any question, request for access or correction, or complaint, write to [email protected]. We answer in writing within 30 days.

What we collect

When you order or create an account: your name, email address and phone number, your delivery and billing addresses, your orders, and the gift message and delivery instructions you give us. We never see your card number: payment is handled directly by Stripe or PayPal.

When you browse: the technical data the site needs to work and stay secure, including your IP address, which we keep only in encrypted form. If you write to us about an allergy, we use that information only to answer you.

Why we use it

To prepare and deliver your orders, send confirmations and receipts, answer your questions, protect the site against fraud and abuse, and meet our tax obligations. We send our newsletter only if you asked for it; every issue lets you unsubscribe in one click.

Cookies and analytics

By default only essential cookies are active: cart, sign-in, security, language and theme. Analytics stay off until you accept them, and you can change your mind at any time. The details are in our cookie policy.

Who we share it with

We never sell your information. We share it only with the providers that help us run the shop, bound by contract to protect it and use it only for us: Supabase (database and accounts), Railway (website hosting), Stripe and PayPal (payment), Resend (email), Cloudflare (bot protection), Upstash (abuse protection) and Google (sign-in with Google, if you choose it).

The courier receives only what is needed to deliver: name, address, phone number and time slot.

Information kept outside Québec

Some of these providers store data outside Québec, notably in the United States. Before entrusting them with any, we assess the privacy factors and make sure by contract that your information is adequately protected there.

How long we keep it

Your account: as long as it is active. Invoices and orders: 6 years, as tax law requires. Searches made on the site: 90 days. Analytics: 14 months. After that, data is deleted or anonymised.

Your rights

You can ask to access your information, correct it or receive it in a common format, withdraw your consent, ask us to delete your account or to de-index information about you.

From your account, on the Privacy page, you can download your data and ask us to delete your account. For any other request, write to our privacy officer. We answer within 30 days.

Security and incidents

Your data is encrypted in transit, and your phone number is also encrypted in our database. Only staff who need it have access, with two-factor authentication. If a confidentiality incident presents a risk of serious injury, we notify the people concerned and the Commission d’accès à l’information.

Complaints

If our answer does not satisfy you, you can contact the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Updates

Any change to this policy is published on this page. Last updated October 18, 2026.