Privacy Policy

We collect information you provide directly when you:

• Create an account (name, email address)
• Place an order (name, shipping address, email address)
• Subscribe to our newsletter (email address only)
• Contact us

We do not store your payment information. All payments are processed securely by Stripe. Please refer to Stripe's Privacy Policy for details on how they handle your payment data.

When you sign in with Google, we receive your name and email address from Google. We do not receive your Google password or payment details.

We use your information solely to:

• Process and fulfil your orders
• Send you order confirmation and shipping notifications
• Respond to your questions or support requests
• Maintain your account
• Send marketing emails (newsletter, product updates, occasional offers) — only if you have explicitly opted in by subscribing to our newsletter

We do not sell, trade, or rent your personal information to third parties. We do not use your information for advertising or marketing without your explicit consent.

We share your information only with trusted third-party service providers who assist us in operating our store:

• Stripe — payment processing (receives your payment details directly; we never see your card number)
• Google — authentication (if you choose to sign in with Google)
• Resend — email delivery (order confirmations, shipping notifications, and newsletter emails for opted-in subscribers)
• Vercel — hosting and infrastructure
• Google Analytics 4 — aggregate site analytics (page views, device type, approximate location). IP addresses are anonymised by default and we have not enabled Google Signals or advertising features.

Each of these providers is bound by their own privacy policies and is not permitted to use your data for any purpose other than providing their service to us.

We may disclose your information if required by law or to protect the rights, property, or safety of Oshapaws, our customers, or others.

We send marketing emails (newsletters, product updates, occasional offers) only to people who have explicitly subscribed by entering their email address into a signup form on our site. This is express consent under Canada's Anti-Spam Legislation (CASL).

When you subscribe, we store your email address, the date you subscribed, and the page you subscribed from (so we can understand what content readers find useful). We may also issue you a one-use welcome discount code linked to your subscription.

Every marketing email we send includes a one-click unsubscribe link in the footer and supports the standard List-Unsubscribe header so your email client can unsubscribe you automatically. You can also visit our contact form at any time to request removal. We honour unsubscribes within 48 hours, well inside the 10-business-day window CASL requires.

Unsubscribing only removes you from marketing emails. We will still send you transactional emails (order confirmations, shipping notifications) related to any orders you place, since these are required to deliver the service you've purchased.

We retain your personal information for as long as your account is active or as needed to fulfil orders and comply with our legal obligations. Order records are retained for a minimum of seven years in accordance with Canadian tax and accounting requirements. You may request deletion of your account at any time (see Section 6).

We use essential cookies for authentication (NextAuth) and shopping cart state. These are required for signing in and placing orders.

We also use Google Analytics 4 to understand how visitors use our site (which pages are popular, how people arrive, what device they use). Google Analytics sets first-party cookies to measure visits in aggregate. We do not use this data to identify individual visitors and we do not run advertising or remarketing features.

You can opt out of Google Analytics by installing Google's opt-out browser add-on or by enabling “Do Not Track” / blocking third-party cookies in your browser. Disabling essential cookies will prevent you from signing in or placing orders.

Under PIPEDA, you have the right to:

• Know what personal information we hold about you
• Request a copy of your personal information
• Correct inaccurate information
• Withdraw consent and request deletion of your account and data

To exercise any of these rights, please use our contact form. We will respond within 30 days.

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. Our site is served over HTTPS. Payment data is handled entirely by Stripe and never touches our servers. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of our store after changes constitutes acceptance of the updated policy.