Privacy Policy

Who we are

fyiCanada.ca is operated by Southern East Inc., a federally incorporated Canadian company operating from Ontario. In this policy, “we” and “us” mean Southern East Inc. We decide how and why your personal information is used, so we are responsible for it. Some laws call this the controller. We are accountable for that information under the Personal Information Protection and Electronic Documents Act and applicable provincial privacy law.

Privacy Officer. Rishit Patel is responsible for how Southern East Inc. protects personal information. For people in Quebec, Rishit Patel is also our person in charge of the protection of personal information. Contact: hello@fyicanada.ca or through our contact form, or by mail at Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1. Write “Privacy request” in the message and it gets routed correctly.

What this policy covers. This policy covers the fyiCanada.ca website. If you include information about someone else, for example a colleague in a gift inquiry, we use it only for the purpose you sent it for.

What we collect

Just browsing: nothing that identifies you. No advertising cookies, no tracking profile, and no age or date of birth. You do not need an account to read the site.

Accounts: sign-in is optional. When you create an account, we collect the email address you register with and the information needed to authenticate you. If you set a password, we store a hash of it, not the password itself. We set a session cookie so you stay signed in on that browser. That cookie runs your account. It is not an advertising cookie, and we do not use it to follow you across other websites. Signing in does not ask for your age or date of birth.

Analytics: we use Plausible Analytics to count page views and see which pages and outbound links get used. Plausible does not use cookies, does not store IP addresses, and does not follow you across other websites. What we see is aggregate traffic, not individual people. The script is served from our own domain, so a blocker that allows our site will not hide it from you.

Product submissions: your email address, the product details you type in, and any links or images you give us. We keep the email so we can tell you when your products are live and handle refunds.

Payments: handled entirely by Stripe. We never see or store your card number. Stripe returns us a session reference, a customer reference, and the billing email you used, which we store against your submission.

Contact and correction requests: you can email us at hello@fyicanada.ca or use our contact form. Email is handled through Zoho Mail, hosted in Zoho’s Canadian data centre. The contact form is hosted by Tally. Whatever you send through either, including your email address, goes to that provider and then to us.

Corporate gift inquiries: if you use our gift inquiry form, we collect your name, work email, company, a range for how many gifts, a range for the budget per gift, the date you need them if you give one, and your message. We also store the page you sent the form from and any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term). This is personal information. We use it only to reply to your request and help you find Canadian makers. That is answering what you asked us. It is stored in our database in Canada. Staff who handle the request can see it. We send ourselves an internal Slack alert. The alert holds the inquiry id, a masked email address, the quantity band, the budget band, the needed-by date, the source path, and utm_source. It has no name, no company, and no message. We don’t share your details with a maker unless you agree to an introduction. That introduction is not a partner under “Business and research partners”. A gift inquiry is never shared with a business, research or AI partner, and it is never included in statistics we publish or license.

Server logs: our hosting and content delivery providers keep short lived technical logs, including IP address and user agent, for security, abuse prevention and debugging. We do not use those logs to build a profile of you.

Why we collect it

• To research and publish the product pages you asked us to publish.
• To take payment, issue refunds and keep records for tax purposes.
• To email you about your own submission, and to answer what you ask us.
• To understand which pages are useful and fix the ones that are not.
• To keep the site up and defend it against abuse.
• To create your account, keep you signed in, and protect that account from misuse.

That is the whole list. We do not use your information for advertising, we do not build advertising profiles, and we do not run automated decision making about you.

The only other situations are: when the law requires it; to protect or defend a legal claim; and, from December 1, 2026, a business transfer. A gift inquiry, a contact message and an account all sit on the list above. They are not a separate purpose.

Consent

Submitting a product, sending us a message, or creating an account is your consent to us using that information for the purpose you sent it for. You can withdraw consent at any time by contacting us, and you can ask us to close an account. We still have to keep some records, such as proof of a completed transaction. Withdrawing consent may mean we cannot finish a submission you have paid for, and closing an account removes the login. It does not by itself delete a payment record we are required to keep.

Who else handles it

We do not sell, rent or trade personal information. We never have. We use a small number of service providers who process it on our behalf, under contract, only for the purposes above:

• Supabase for our database, hosted in the Canada Central region.
• Stripe for payment processing.
• Tally for the contact form.
• Zoho Mail for email, hosted in Zoho’s Canadian data centre.
• Plausible Analytics for cookieless traffic measurement.
• Cloudflare for image storage and delivery.
• Our web hosting and content delivery providers.
• Slack for internal alerts. An inquiry alert holds the inquiry id, a masked email address, the quantity band, the budget band, the needed-by date, the source path, and utm_source. It has no name, no company, and no message. See Corporate gift inquiries.

We do not use your personal information to train AI models, including large language models, and we do not let a partner do that. No opt-in program is open. “Do we use personal information to train AI?” says the same thing in more detail.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Information stored outside Canada

Our product database and account records sit in Canada. Some of our service providers, including Stripe, operate or store data outside Canada, mainly in the United States and the European Union. While information is in another country it is subject to that country’s laws, and can in principle be accessed by its courts, law enforcement and national security authorities. We use providers that commit to contractual and technical protections comparable to what Canadian law requires. If you want to know where a specific piece of your information is held, ask us.

Gift inquiries are stored in Canada. The Slack alert may be processed outside Canada. It holds the inquiry id, a masked email address, the quantity band, the budget band, the needed-by date, the source path, and utm_source. It has no name, no company, and no message. We do not send personal information to a business or research partner, in Canada or outside it. From December 1, 2026, a partner still gets only statistics that do not identify anyone, unless you opt in to a program that tells you the information will leave Canada.

How long we keep it

• Submission and payment records: seven years, because Canadian tax rules require it. Closing an account does not shorten that.
• Account information: until you delete the account or ask us to. After that we delete the login details, including the password hash. Session cookies last until you sign out or the session expires.
• Contact form messages and emails: up to two years, so we can follow up on corrections.
• Gift inquiries: up to two years after our last contact about the request. We keep them so we can follow up on the request you sent, not so we can share them.
• Server logs: short lived, typically weeks rather than months, depending on the provider.
• Analytics: aggregate only, with nothing that identifies an individual to retain.

Published product information is not personal information and stays up as part of the catalogue.

Your rights

You can ask us to:

• Tell you what personal information we hold about you and how we use it.
• Correct anything inaccurate or incomplete.
• Delete it, where we are not required to keep it for tax or legal reasons.
• Send you a copy in a structured, commonly used technology format, or transfer it to another organisation where that right applies to you.
• Stop using it, by withdrawing consent.

Email hello@fyicanada.ca and we will respond within 30 days. There is no charge. We may need to confirm your identity first, and we will only ask for what we need to do that. Someone you authorize in writing can ask for you. We may still confirm with you that they may.

If you are not happy with how we handled a privacy request, you can complain to the Office of the Privacy Commissioner of Canada. That office handles complaints under the Personal Information Protection and Electronic Documents Act (PIPEDA). Ontario has no general private-sector privacy regulator, so people in Ontario use that federal office. Residents of Quebec, British Columbia and Alberta may also complain to their provincial regulator.

Quebec residents

Person in charge. Rishit Patel (hello@fyicanada.ca) is the person in charge of the protection of personal information. You can also write to Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1. This page is the public summary of how we govern personal information: what we collect, why, who handles it, how long we keep it, and how to reach the person in charge. There is not a separate governance-policy page.

Purposes and consent. We collect only what we need for the purposes in “Why we collect it”. That is the whole list for personal information. We tell you the purpose before or when we collect it. Creating an account, submitting a product, sending a message, or sending a gift inquiry is consent for that purpose. A new purpose would be asked separately, in clear and simple terms. Sensitive information would need express consent. We do not collect government identity numbers, health information, or similar sensitive information. We will not use your information for a new purpose without a clear yes from you.

Privacy by default. You can read the site without an account. We do not set advertising cookies. Optional sharing and programs are off. None are open.

Identification, location and profiling. We do not use technology that identifies you, locates you, or profiles you. The session cookie only keeps an account signed in. Plausible does not use cookies, does not store IP addresses, and does not follow you across other websites.

Anonymization. Today we do not anonymize personal information to share it. Partner statistics come only from catalogue facts and cookieless traffic totals. Any future anonymizing of personal information would only serve a purpose on the list under “Why we collect it”, and would follow Quebec’s Regulation respecting the anonymization of personal information. Information that is only de-identified, for example a name replaced with a code while we can still link it back, is still personal information. We treat it that way.

Outside Quebec. Some service providers listed above store or process information outside Quebec, including in the United States and the European Union. See “Information stored outside Canada”. Before transferring personal information outside Quebec, we assess the privacy risks as required by Law 25. The contract has to require protection comparable to Quebec law. We do not send personal information to a business or research partner outside Quebec unless you opt in. Gift inquiries stay in our database in Canada and are not sent to partners.

Research. We do not disclose personal information without consent for study, research or statistics. The product catalogue and cookieless traffic totals are not personal information. If Quebec law allowed a disclosure of personal information without consent for research, we would do a privacy impact assessment first and use a written agreement. We do not make that kind of disclosure.

Your rights. You can access and correct your information, withdraw consent, and get your information in a structured, commonly used technological format. You can ask us to stop disseminating information, or to de-index it, where the law gives you that right. You can also ask for information about any decision made solely by automated processing. We do not make decisions about you solely by automated processing. We reply within 30 days. Use the same email as in “Your rights” above.

Complaints. You can complain to the Commission d’accès à l’information du Québec.

French. This policy is published in English. A French version is not on the site.

If you are in the United States, the EEA, the UK or Switzerland

You can use the rights in “Your rights”. We reply within 30 days. We do not sell personal information, and we do not share it for targeted advertising or for advertising that follows you across sites. This site does not use advertising cookies. In the past 12 months we have not sold personal information and have not shared it for that kind of advertising.

If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sale, sharing and targeted advertising. There is no sale or sharing on this site to turn off, so the opt-out is already in effect. Global Privacy Control does not unsubscribe you from email. We do not send marketing email.

There is no separate choices page. That page is for a sale, a share, or an optional program with a switch. None of those exist here. If we ever start a practice that needs one, the page will be on the site before anything changes, and we will say so in this policy first.

We do not knowingly sell or share personal information of anyone under 18. We do not sell or share personal information at all, and we do not target ads at children. See “Children”. We do not offer anything of value in exchange for personal information.

We are based in Canada. For people in the EEA, the UK and Switzerland, the uses in “Why we collect it” are how we provide the site, keep it secure, and answer you. Giving a partner information that identifies you would need your consent. We do not do that. Some service providers are in other countries, as “Information stored outside Canada” explains. You can complain to the data protection authority where you live or work. We would like the chance to help first at hello@fyicanada.ca.

Security

The site runs over HTTPS. Access to the database, account records and submission records is restricted to people who need it. Passwords are stored only as a hash. Payment card data never reaches our servers. No system is perfectly secure, and we will not pretend otherwise. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as the law requires.

Children

The site is not directed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, tell us and we will delete it.

We do not collect your age or date of birth, including when you create an account. Do not create an account if you are under 13. Pages about wine, beer, cider and spirits do not ask you to confirm your age, and signing in is not an age check, because we are not selling those products. If you follow a link to a retailer, that sale and any age check happen on the retailer’s site, under its own privacy policy.

Changes to this policy

When we update this policy, we change the date at the top and post a notice. A new collection, a new purpose, and a new provider are covered by that notice. Material changes get a notice on the site rather than a quiet edit. A new purpose for personal information needs a clear yes from you. Staying on the site, or not replying, is not a yes.

The notice at the top of this page is that notice for the sections that take effect on December 1, 2026. The stricter notice rules below take effect on that date. Until then, the paragraph above is how we change this policy.

The version of this policy from before the October 5, 2026 update is linked under “Past versions”.

Takes effect December 1, 2026.

Small changes. For typo fixes, clearer wording, changes that give you more protection, or a new service provider doing the same kind of job, we update this page and the “Last updated” date.

Material changes. Examples: a new type of partner; a new purpose for using personal information; sharing information that identifies you where we did not before; starting to use your information to train AI; weakening any promise in this policy; or storing your personal information outside Canada beyond the service providers already named.

• We will tell you at least 30 days before the change takes effect. We will show a clear notice on fyiCanada. Where we have your email because you have an account, a product submission, or an inquiry, and the change affects that information, we will email you too. The notice explains what is changing, why, and what your choices are.
• Information we already have. A material change applies only to information we collect after it takes effect. We will use information we already hold in a materially new way only if you agree first, by an action such as ticking a box or tapping “Yes”. Staying on fyiCanada, or not replying, does not count as agreeing.
• If you do not agree, we will keep handling your existing information under the earlier version. You can also ask us to close your account at any time.

The purpose list under “Why we collect it” stays the whole list for personal information, unless you agree to a program. A business transfer is the other situation named under that list. If the law makes us change something faster, we will give as much notice as we can.

What takes effect December 1, 2026

Takes effect December 1, 2026.

The sections under this heading take effect on December 1, 2026. Before that date, they do not apply. A business transfer, named under “Why we collect it”, is the extra situation from that date. Personal information stays out of partner sharing, and stays out of a partner’s hands outside Canada, unless you opt in. Gift inquiries are never part of partner sharing.

Statistics and anonymized information

Partner statistics come only from catalogue facts and cookieless traffic totals. For anonymizing personal information, see Anonymization under “Quebec residents”.

Takes effect December 1, 2026.

What this is. From December 1, 2026, we may publish or share statistics, or other information that does not identify anyone. For example: the most-viewed product category in a month, or how many products in the catalogue are made in one province.

What is not personal information. The product catalogue, including product names, scores and public origin facts, is not personal information. Cookieless traffic totals are not personal information. Publishing or sharing those does not identify you. Partner statistics come from the catalogue and from those traffic totals. We do not build them from accounts, submission emails, payment records, contact messages, gift inquiries, or server logs.

If we ever anonymize personal information. Any future anonymizing of personal information would only serve a listed purpose and would follow the Quebec rules, as Anonymization under “Quebec residents” describes. If we did that, we would remove names, contact details, account IDs and other direct identifiers, combine information from many people, and refuse any figure based on fewer than 10 people. Before release we would check that no one can reasonably be identified from the result, on its own or combined with other information that is reasonably available. We would record what we did and repeat the check. In Quebec we would do it only for serious and legitimate purposes, under the anonymization regulation, and we would keep a register. Gift inquiries would still be excluded. A new use of personal information we already hold would still need your agreement, under “Changes to this policy”.

Our commitments. We keep shared statistics in non-identifying form. We will not try to re-identify anyone, except to test that our methods work. We do not use them to make decisions about you or to target you with ads or offers.

How we use them. We use them to run and secure fyiCanada, to fix bugs, to measure which pages get used, to build features of fyiCanada, to publish research and reports, and to share or license them with the partners in the next section. Anyone who receives them must agree in writing not to re-identify anyone, not to combine them with other data to do that, and not to pass them on without the same terms.

De-identified information is different. If we replace a name with a code and the information can still be linked back to you, it is still personal information. It stays on the purpose list above. We do not give it to partners unless you have opted in under “Programs you choose to join”. That switch is off.

Business and research partners

Takes effect December 1, 2026.

Service providers who run the site for us are listed under “Who else handles it”. They are not the partners in this section. They still act only on our instructions.

We may work with business and research partners, such as universities and research groups, analytics and market-research firms, and companies that build, test or supply data for AI and machine-learning systems. By default, partners receive only the statistics and anonymized information described above. That information does not identify you. It does not include gift inquiries.

We will not give a partner information that identifies you for the partner’s own use, including training its AI models, unless you have opted in. Personal information stays in Canada unless you opt in to a program that says it will leave Canada. Our named service providers are separate. Some of them already process information outside Canada, and this section does not change that.

Every partner signs a written agreement. It limits use to the stated purpose, bans re-identification and onward sale, requires security and deletion, and lets us check compliance.

Before any sharing starts, we will name on this page the types of partners we actually work with and what they receive. We do not share personal information with any business or research partner today. Sharing statistics that do not identify anyone is not a sale of personal information. We do not sell, rent or trade personal information. We never have.

Programs you choose to join

Takes effect December 1, 2026.

We may offer optional programs. For example, contributing product examples to help build or test AI tools, or being introduced to a partner’s research study. The partner may pay you directly. We do not offer that today.

Off unless you turn it on. Before you join, we will show you a separate screen that says who the partner is, exactly what we will share, why, how long the partner keeps it, whether it leaves Canada, and whether you will be paid. Nothing is pre-ticked. Saying no does not change how fyiCanada works for you. Gift inquiries are never part of these programs.

You can leave at any time by emailing hello@fyicanada.ca. When a program exists, the same control will be on the site, and leaving will be as easy as joining. Leaving stops future sharing. We will also ask the partner to delete what it received, as our agreement with it requires. If your information has already been used to train an AI model, the partner may not be able to remove it from that model. If that applies, we will say so on the sign-up screen.

If you sign up with a partner directly, the partner’s terms and privacy policy apply to what you give it. A partner cannot send you marketing email because you agreed to something with us. It has to ask you itself.

Do we use personal information to train AI?

These points are already true:

• We do not sell personal information to train AI models, including large language models.
• We do not use your personal information to train AI models.
• We do not let anyone else train AI models on information that identifies you.

Takes effect December 1, 2026.

From December 1, 2026, there is one exception to the last point. If you opt in under “Programs you choose to join”, we share only what you tell us to. Gift inquiries are never included. No such program is open.

This site does not connect an AI assistant on your behalf. If we add that later, it would receive information only because you asked us to send it, and we would say so here first. That assistant’s own policy would decide what it does with the information.

Product pages, scores and other catalogue pages are public. Search engines and other crawlers can read them. Your account email, submission email, payment details, contact messages and gift inquiries are not published on those pages.

If our business changes hands

Takes effect December 1, 2026.

If Southern East Inc., or fyiCanada, is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy or insolvency, personal information may be shared with the other parties and their advisers.

• Before a deal closes, we share only what is needed to evaluate it, with direct identifiers removed where we can. If it can still be linked back to you, it is still personal information. We share it under a confidentiality agreement that limits use to the deal and requires return or deletion if the deal does not go ahead. We keep that information in Canada. We do not send it outside Canada unless you agree, except where a named service provider already processes it outside Canada as this policy describes.
• After a deal closes, the new owner may use your information only as this policy describes. A material change has to follow the changes section below: at least 30 days’ notice, and your agreement before any new use of information the owner already holds. If the new owner would store your personal information outside Canada, beyond the service providers already named, that needs your agreement before it applies to information we already hold.
• We will tell you within 30 days after a closing in which your information changes hands. We will give you the new owner’s name and contact details. You can ask us to delete what we are not required to keep, before or after.
• A deal whose main purpose is selling personal information is not a business transfer. The rest of this policy applies to it.
• Gift inquiries get the same protections. They are not sold. They stay in Canada unless you agree otherwise. Where we can, we remove direct identifiers before anyone evaluates a deal. We will tell you if a gift inquiry changes hands. The transfer is not a sale of that inquiry, and it does not give the inquiry to a business, research or AI partner.

Contact

Privacy questions, access requests, deletion requests and complaints go to hello@fyicanada.ca or through our contact form. The Privacy Officer is Rishit Patel. Mail: Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1.

Past versions

Privacy policy before the October 5, 2026 update. That copy was last updated September 27, 2026.