Privacy Policy

Who is responsible for your information

fyiCanada.ca is operated by Southern East Inc., a federally incorporated Canadian company operating from Ontario. We are the organisation accountable for the personal information described here, under the Personal Information Protection and Electronic Documents Act and applicable provincial privacy law.

Our Privacy Officer is reachable at hello@fyicanada.ca or through our contact form. Write “Privacy request” in the message and it gets routed correctly.

What we collect

Just browsing: nothing that identifies you. No advertising cookies, no tracking profile, and no age or date of birth. You do not need an account to read the site.

Accounts: sign-in is optional. When you create an account, we collect the email address you register with and the information needed to authenticate you. If you set a password, we store a hash of it, not the password itself. We set a session cookie so you stay signed in on that browser. That cookie runs your account. It is not an advertising cookie, and we do not use it to follow you across other websites. Signing in does not ask for your age or date of birth.

Analytics: we use Plausible Analytics to count page views and see which pages and outbound links get used. Plausible does not use cookies, does not store IP addresses, and does not follow you across other websites. What we see is aggregate traffic, not individual people. The script is served from our own domain, so a blocker that allows our site will not hide it from you.

Product submissions: your email address, the product details you type in, and any links or images you give us. We keep the email so we can tell you when your products are live and handle refunds.

Payments: handled entirely by Stripe. We never see or store your card number. Stripe returns us a session reference, a customer reference, and the billing email you used, which we store against your submission.

Contact and correction requests: you can email us at hello@fyicanada.ca or use our contact form. Email is handled through Zoho Mail, hosted in Zoho's Canadian data centre. The contact form is hosted by Tally. Whatever you send through either, including your email address, goes to that provider and then to us.

Corporate gift inquiries: if you use our gift inquiry form, we collect your name, work email, company and what you tell us about the order (how many gifts, budget per gift, the date you need them and your message), plus the page you sent it from and any campaign tags in the link. We use it only to reply to your request and help you find Canadian makers. It is stored in our database in Canada. We send ourselves an internal alert through Slack that shows only a masked version of your email address. We don't share your details with a maker or gifting partner unless you agree to an introduction.

Server logs: our hosting and content delivery providers keep short lived technical logs, including IP address and user agent, for security, abuse prevention and debugging. We do not use those logs to build a profile of you.

Why we collect it

• To research and publish the product pages you asked us to publish.
• To take payment, issue refunds and keep records for tax purposes.
• To email you about your own submission, and to answer what you ask us.
• To understand which pages are useful and fix the ones that are not.
• To keep the site up and defend it against abuse.
• To create your account, keep you signed in, and protect that account from misuse.

That is the whole list. We do not use your information for advertising, we do not build advertising profiles, and we do not run automated decision making about you.

Consent

Submitting a product, sending us a message, or creating an account is your consent to us using that information for the purpose you sent it for. You can withdraw consent at any time by contacting us, and you can ask us to close an account. We still have to keep some records, such as proof of a completed transaction. Withdrawing consent may mean we cannot finish a submission you have paid for, and closing an account removes the login. It does not by itself delete a payment record we are required to keep.

Who else handles it

We do not sell, rent or trade personal information. We never have. We use a small number of service providers who process it on our behalf, under contract, only for the purposes above:

• Supabase for our database, hosted in the Canada Central region.
• Stripe for payment processing.
• Tally for the contact form.
• Zoho Mail for email, hosted in Zoho's Canadian data centre.
• Plausible Analytics for cookieless traffic measurement.
• Cloudflare for image storage and delivery.
• Our web hosting and content delivery providers.
• Slack for internal alerts. Alerts about inquiries include only a masked email address.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Information stored outside Canada

Our product database and account records sit in Canada. Some of our service providers, including Stripe, operate or store data outside Canada, mainly in the United States and the European Union. While information is in another country it is subject to that country’s laws, and can in principle be accessed by its courts, law enforcement and national security authorities. We use providers that commit to contractual and technical protections comparable to what Canadian law requires. If you want to know where a specific piece of your information is held, ask us.

How long we keep it

• Submission and payment records: seven years, because Canadian tax rules require it. Closing an account does not shorten that.
• Account information: until you delete the account or ask us to. After that we delete the login details, including the password hash. Session cookies last until you sign out or the session expires.
• Contact form messages and emails: up to two years, so we can follow up on corrections.
• Gift inquiries: up to two years after our last contact about the request.
• Server logs: short lived, typically weeks rather than months, depending on the provider.
• Analytics: aggregate only, with nothing that identifies an individual to retain.

Published product information is not personal information and stays up as part of the catalogue.

Your rights

You can ask us to:

• Tell you what personal information we hold about you and how we use it.
• Correct anything inaccurate or incomplete.
• Delete it, where we are not required to keep it for tax or legal reasons.
• Send you a copy in a structured, commonly used technology format, or transfer it to another organisation where that right applies to you.
• Stop using it, by withdrawing consent.

Email hello@fyicanada.ca and we will respond within 30 days. There is no charge. We may need to confirm your identity first, and we will only ask for what we need to do that.

If you are not happy with how we handled a privacy request, you can complain to the Office of the Privacy Commissioner of Canada. Residents of Quebec, British Columbia, Alberta and Ontario may also have recourse to their provincial regulator.

Quebec residents

Quebec’s Law 25 gives you additional rights, including the right to be informed when your information is used to make an automated decision, the right to data portability, and the right to ask that information be de-indexed or deleted in defined circumstances. We do not make automated decisions about individuals. Our Privacy Officer, named above, is the person accountable for Law 25 compliance. Address Law 25 requests the same way as any other privacy request.

Security

The site runs over HTTPS. Access to the database, account records and submission records is restricted to people who need it. Passwords are stored only as a hash. Payment card data never reaches our servers. No system is perfectly secure, and we will not pretend otherwise. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as the law requires.

Children

The site is not directed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, tell us and we will delete it.

We do not collect your age or date of birth, including when you create an account. Do not create an account if you are under 13. Pages about wine, beer, cider and spirits do not ask you to confirm your age, and signing in is not an age check, because we are not selling those products. If you follow a link to a retailer, that sale and any age check happen on the retailer’s site, under its own privacy policy.

Changes to this policy

If we start collecting something new, or add a service provider that changes the picture, we will update this page and change the date at the top. Material changes get a notice on the site rather than a quiet edit.

Contact

Privacy questions, access requests, deletion requests and complaints go to hello@fyicanada.ca or through our contact form.