Privacy Policy

We are headquartered in Brampton, Ontario, Canada, and currently operate in Canada while preparing to launch in more countries. This Policy explains what personal information we collect, why, who we share it with, how long we keep it and your choices.

This Policy is governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. When we launch in a new country, we will publish any additional local terms. Commercial messages are covered in section 6.

It applies to customers, partner store staff using the merchant portal and anyone who contacts us. Please read it with our Terms & Conditions, Cookie Policy and Refund & Cancellation Policy.

Information you give us

• •Account details — your name, email address and, if you choose to sign in by phone, your mobile number and country code. A password is stored only if you create one; sign-in by email link, by SMS code or with Google does not create one.
• •Profile details you choose to add — profile photo, gender and date of birth. These are optional and the Platform works without them.
• •Pickup location — the address or map point you set as your pickup area, so we can show you bags near you.
• •Order information — the bags you reserve, quantities, order notes, your pickup code and your cancellation reason if you cancel.
• •Payments — your card is entered directly into Stripe's payment form and is never sent to or stored on our servers. We keep only the card brand, the last four digits and Stripe's payment reference, so you can reconcile a charge and we can investigate a dispute.
• •Messages you send us — the contents of the Contact Us form, including a phone number and address if you provide them, and any support conversation.
• •Reviews and favourites you choose to leave or save, and the stores you follow.
• •Merchant users additionally provide business details, store address and opening hours, contact numbers, staff accounts, payout bank details and business-verification (KYC) documents.

Information we collect automatically

• •Approximate location from your IP address, used to confirm you are in a country we serve. This is resolved by ipapi.co, with ipinfo.io as a fallback.
• •Precise location, only if you grant your browser's or device's location permission. You can refuse, and set your pickup area manually instead.
• •Device and usage information — browser type, device type, pages visited and approximate time of visit, used to keep the service running and secure.
• •A push-notification token, only if you enable notifications.
• •Cookies and similar local storage — see section 9 and our Cookie Policy.

What we do not collect

• •We do not collect your full card number, expiry date or CVC — those go directly to Stripe.
• •We do not buy personal information from data brokers, and we do not build advertising profiles.
• •We do not knowingly collect information from children — see section 12.

In most cases we rely on your consent. Creating an account, placing an order or contacting us is your consent to use the information those actions require. Where information is plainly necessary to provide something you asked for — an address to find nearby bags, an email address to send your order confirmation — consent is implied by the request itself.

For anything not necessary to the service, we ask for express consent: precise device location, push notifications and promotional email are all off unless you turn them on.

You can withdraw consent at any time, subject to legal and contractual limits. Withdrawing consent for something the service depends on may mean we can no longer provide that part of the service — for example, we cannot deliver an order confirmation without an email address. Withdrawing consent does not affect anything already done on the basis of it, and it does not require us to delete records we are legally obliged to retain.

The store you order from

When you reserve a bag, the store sees your first name, your order, your pickup window and your pickup code, so they can set your bag aside and hand it to the right person. They do not receive your email address, your home address or your payment details. If you message a store about an order, the store sees the messages you send.

Service providers who process data on our behalf

• •Stripe — payment processing and refunds (card data goes directly to Stripe; we never receive it).
• •Amazon Web Services — hosting and databases, in the AWS Canada (Central) region.
• •Google — delivery of transactional emails, such as sign-in links and order confirmations.
• •Twilio — delivery of one-time SMS sign-in codes, when you sign in by phone.
• •Google — Firebase Cloud Messaging for push notifications, Google Maps for maps and address autocomplete, and Google Sign-In if you choose it.
• •Google — Tag Manager, to understand how the website is used. It loads only after you accept analytics cookies.
• •OpenStreetMap / Nominatim — converting an address you type into map coordinates, and back.
• •ipapi.co and ipinfo.io — approximate country from your IP address.

Other circumstances

• •Professional advisers — our accountants and lawyers, under a duty of confidentiality.
• •Legal and safety — where we are required by law, court order or a lawful request from a public authority, or where disclosure is necessary to investigate a food-safety incident, fraud, or a threat to someone's safety.
• •A business transfer — if Bestby Bites is acquired or merges, personal information may transfer to the acquirer, who would remain bound by this Policy or give you notice of a new one.

International data transfers

Some providers above process data in the United States or other countries. While your information is abroad, it is subject to local laws and may be accessible to courts, law enforcement or national security authorities there. We use providers that offer contractual protections comparable to Canadian standards, and we remain accountable for your information wherever it is processed.

Service messages

Sign-in links, order confirmations, pickup reminders, cancellation and refund notices are service messages about something you actively did. They are not marketing, and we send them for as long as you use the Platform.

Promotional messages

Marketing email is sent only if you have opted in. Every commercial message carries an unsubscribe link that works in one click without signing in, as CASL requires, along with our name and mailing address. You can also change what you receive at any time under Notification Settings in your account.

Unsubscribing

Unsubscribing from promotional email stops marketing only. You will still receive messages about orders you place — a confirmation, a pickup reminder, a cancellation — because without them you could not collect food you have paid for.

SMS and push

SMS is used only to deliver a one-time sign-in code you requested. Push notifications are sent only if you enable them, and can be turned off in your device settings or in Notification Settings.

We use a small number of cookies and browser storage entries. The essential ones keep you signed in (an HTTP-only refresh cookie that JavaScript cannot read, plus a short-lived access token in browser storage), remember the country and pickup area you chose, and remember whether you have accepted this notice. These are necessary for the Platform to function and cannot be switched off.

Anything that is not strictly necessary is set only after you accept it in the cookie banner, and you can change your mind at any time.

We do not use advertising or cross-site tracking cookies. Our Cookie Policy explains each category we use, what it is for and how long it lasts.

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires. We will tell you what happened, what information was involved, what we have done about it and what you can do to protect yourself.

We maintain records of every breach of security safeguards, whether or not it triggers notification, and we keep them for 24 months.

The Platform is not intended for children under 13, and we do not knowingly collect their personal information. Users between 13 and the age of majority in their province should use the Platform with a parent or guardian's involvement, and only a person who can enter a binding contract may make a purchase.

If you believe a child has given us personal information, write to support@bestbybites.com and we will delete it.

Bestby Bites Inc. is accountable for the personal information in its custody, including information handled by the service providers named in section 5. Our Privacy Officer is responsible for compliance with this Policy and can be reached at support@bestbybites.com.

If you have a concern, tell us first — we will acknowledge it within 5 business days and respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376, and, depending on your province, to your provincial privacy regulator.

We may update this Policy as the Platform changes. The date at the top of this page always reflects the current version.

If a change materially affects how we handle your personal information, we will tell you directly — by email or by a notice in the Platform — before it takes effect, and where the law requires it we will ask for your consent again.

This Policy is governed by the laws of the Province of Ontario and the applicable federal laws of Canada, subject to any mandatory laws of your country. This does not affect your right to complain to a privacy regulator.

Privacy Officer

support@bestbybites.com

General support

support@bestbybites.com

Mailing address

Bestby Bites Inc., Brampton, Ontario, Canada