Privacy Policy

Email address, name, and shipping address, collected at checkout.

Order history and order status.

Account details, if you create an account.

Referral activity, if you participate in the referral programme.

Marketing consent records, if you opt in at checkout: email address, date and time, IP address, and the wording of the consent shown to you.

Basic technical information generated by hosting and security infrastructure.

Payment card details are collected and held exclusively by Stripe. We never see or retain them.

To process and fulfil your order, calculate applicable sales tax, arrange shipping, send transactional email, respond to support enquiries, administer accounts and the referral programme, send marketing email where you have opted in, and meet accounting and tax obligations.

We share personal information with the following providers, only as needed to run the business:

Stripe — payment processing and tax calculation. Shared: name, email, billing and shipping address, payment details.

Supabase — database and account authentication. Shared: email, account details, order records.

Vercel — website hosting. Shared: technical request data.

Resend — transactional and marketing email. Shared: name, email address.

Stallion Express — shipping labels and carrier handoff. Shared: name, shipping address, description of contents.

Stallion Express passes your name and address to the delivering carrier — which may include Canada Post, UniUni, Intelcom, Purolator, FleetOptics, or ICS — in order to complete delivery.

Some providers store or process data outside Canada, including in the United States. Information held in another country may be accessible to that country’s authorities under its laws.

Order confirmations and shipping notifications are transactional and are sent to every buyer.

We send marketing email only to people who have opted in at checkout. Every marketing message identifies us and carries an unsubscribe link. You may withdraw consent at any time, and we act on withdrawals within ten business days. We record the date, time, and wording of the consent given, as required under Canada’s anti-spam legislation.

We do not sell, rent, or trade personal information. We do not run third-party advertising pixels on the site.

Order and transaction records are retained for seven years to meet accounting and tax requirements. Marketing consent records are retained for three years after consent is withdrawn. Account records are retained until the account is deleted.

Access to personal information is limited to those who need it to operate the business. Payment data never reaches our systems. No system is perfectly secure, and we cannot guarantee absolute security.

Under PIPEDA you may request access to the personal information we hold about you, request correction of inaccuracies, withdraw consent to marketing, and request deletion where we are not required to retain the information. Write to hello@thevaultdrop.ca. We respond within thirty days.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

We may update this policy. Material changes will be reflected in the “last updated” date.

13289109 Canada Inc., operating as The Vault Drop

Toronto, Ontario, Canada

hello@thevaultdrop.ca