When we say “personal information,” we mean information that identifies or can reasonably be linked to you. We may collect:

• Contact details: name, billing/shipping address, email, phone.
  
• Financial & transaction details: payment method, payment confirmations, and records of purchases, returns, exchanges, or cancellations.
  
• Account information: login, password, preferences, saved items (e.g., cart, wishlist).
  
• Communications: information you include in messages to us (e.g., support requests, reviews).
  
• Device & usage data: IP address, device/browser type, identifiers, pages viewed, referring pages, date/time, and actions on the Site.
  
• Inferences: preferences or interests derived from the above, where permitted by law.
  
  

Sources:

• Directly from you (checkout, account, forms, support).
  
• Automatically through cookies and similar technologies.
  
• Service providers/partners (e.g., analytics, ads, payments, shipping), and other third parties as permitted by law.

Depending on how you interact with us, we use personal information to:

• Provide, tailor, and improve the Services: process payments, fulfill/ship orders, support returns/exchanges, maintain your account, remember preferences, recommend products, and improve Site functionality and experience.
  
  
• Marketing and advertising: send promotional messages (email/SMS/post) with your consent where required; show you relevant offers, including retargeting and measurement on other sites/apps.
  
  
• Security and fraud prevention: authenticate accounts, detect and prevent fraud, abuse, or security incidents.
  
  
• Communications: respond to your inquiries and send important service messages (e.g., order and shipping updates).
  
  
• Legal reasons: comply with law, respond to lawful requests, enforce our terms, and protect our rights and users.

We use cookies and similar technologies to operate the Site and, with your consent where required, for analytics and advertising.

Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand aggregate usage and improve the Site. GA4 provides regional privacy controls and limits the collection and retention of personal data. Opt-out here.

Session analytics (Lucky Orange)

We use Lucky Orange for user-experience analytics (e.g., heatmaps and session replays) to help us improve usability. Lucky Orange may set cookies and collect usage data (e.g., clicks, scrolls, pages visited). Sensitive inputs are configured to be masked. You can learn more or opt out via Lucky Orange’s privacy/opt-out tools.

Advertising & measurement

We may use platforms such as Meta (Facebook/Instagram) and Google Ads to show relevant offers and measure effectiveness. You can manage interest-based advertising via platform settings and industry opt-outs (e.g., DAA/NAI), and via our Privacy Choices / Do Not Sell or Share My Personal Information link in the footer (where available).

Cookie Policy & Cookie Settings

For details on specific cookies and to change your preferences at any time, visit our Cookie Policy and Cookie Settings. In jurisdictions that require it (e.g., the UK and Québec), we only set non-essential cookies after you give consent.

Signals (GPC and Do Not Track)

We honour recognized browser-based opt-out signals, such as Global Privacy Control (GPC), where required by law and treat them as requests to opt out of targeted advertising and the “sale” or “sharing” of personal information. Other than recognized opt-out signals like GPC, we do not respond to ‘Do Not Track’ (DNT) signals.

Payments are processed by Shopify Payments and/or other payment gateways such as Sezzle, and PayPal. We do not store full payment card numbers; our providers use tokenization and other safeguards to enable secure processing and refunds.

We apply reasonable technical and organizational measures to protect personal information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please use caution when sharing information online.

We may disclose personal information in the following circumstances:

• Service providers: to vendors who perform services for us (e.g., store platform/hosting, payments, data analytics, ads/measurement, email/SMS, fulfillment/3PL, IT/security).
  
• Business and marketing partners: to help us provide marketing services and advertisements.
  
• With your direction or consent: e.g., social logins, promotions, or when you ask us to share with a third party.
  
• Within our corporate group: with affiliates as permitted by law.
  
• Business transactions: in connection with a merger, acquisition, financing, or sale of assets.
  
• Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect our rights, property, or users.

Our store is hosted on Shopify. Shopify collects and processes personal information about your use of the Services to operate, protect, and improve the Shopify platform. Some enhanced platform features may use information from your interactions with our store and other merchants. For those platform-level uses, Shopify is independently responsible for that processing, including responding to privacy requests related to such processing.

To learn more or exercise rights with Shopify, please see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

We are based in Canada and use service providers located in Canada, the United States, the United Kingdom, and other countries. Where required, we rely on recognized transfer mechanisms (e.g., Standard Contractual Clauses and, for UK–US transfers, the UK-US Data Bridge) and conduct transfer assessments as appropriate.

We keep personal information only as long as necessary for the purposes described in this Policy—for example, to maintain your account, fulfill orders, comply with legal obligations (e.g., tax/audit), resolve disputes, and enforce policies. How long we retain information depends on factors such as the type of data and our legal and operational needs.

Canada (PIPEDA)

You may access and correct your personal information. Breach notifications: If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible, and maintain breach records for at least two (2) years.

Québec (Law 25)

For visitors and customers in Québec, we request opt-in consent for non-essential cookies. Before transferring personal information outside Québec, we assess the privacy protections in the destination and implement appropriate safeguards. You may have additional rights (e.g., data portability). Contact us to exercise your rights.

United States (state privacy laws, e.g., CA/CPRA, CO)

Depending on your state, you may have rights to access, delete, correct, portability, and to opt out of the sale or sharing of personal information and targeted advertising. We honor recognized browser-based opt-out signals (e.g., GPC) where required.

To exercise rights, use our Privacy Choices / Do Not Sell or Share My Personal Information link (footer) or email privacy@encircled.ca. Authorized agents may submit requests as permitted by law. We will not discriminate against you for exercising your rights.

Right to appeal: If we decline to act on your request, you may appeal by emailing privacy@encircled.ca with the subject line “Privacy Appeal.” We will explain any action taken (or not taken) and our reasons.

United Kingdom (UK GDPR)

We process personal data under legal bases including performance of a contract, consent, and legitimate interests (e.g., Site functionality, fraud prevention, analytics). UK individuals can request access, correction, deletion, objection, and withdrawal of consent. UK data may be transferred internationally with appropriate safeguards (e.g., SCCs, UK-US Data Bridge). You may lodge a complaint with the ICO.

Australia

Depending on your circumstances, you may have rights under Australian privacy laws. Regardless, we apply this Policy to Australian customers and handle personal information responsibly. Contact us to exercise rights.

Our Services are intended for general audiences and are not directed to children under 13. We do not knowingly collect personal information from children under 13. As of the date of this Policy, we do not have actual knowledge that we “sell” or “share” personal information of individuals under 16. If you are a parent or guardian and believe your child has provided personal information, please contact us to request deletion.

The Services may link to third-party websites or include social media features. Your interactions with those sites/features are governed by the third party’s privacy policies, not ours. We are not responsible for the privacy or security of those sites.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. We will post updates on this page and update the “Last updated” date. If changes are material, we will provide additional notice (e.g., a banner or email).

Encircled Inc. Attn: Data Privacy Officer / Privacy Officer (Kristi Soomer, CEO)

205-105 Brockhouse Road

Toronto, ON M8W 2W8, Canada

Email: privacy@encircled.ca