Privacy Policy

Effective date: [effective date]. See the legal draft notice on our Terms & Conditions page — the same notice applies here.

Who we are

This store is operated by Cocoa Creation, an independent artist based in Canada. For privacy questions, contact [privacy contact email].

Information we collect

• Account details you provide: name, email, phone.
• Shipping and billing addresses.
• Order and Mail Club subscription history.
• Payment information processed by Stripe and PayPal — we never store your full card number.
• Support messages you send us.
• Newsletter sign-up and consent records.
• Basic analytics and cookie data (see below).

How we use it

We use this information to process orders and subscriptions, ship Mail Club editions and shop products, provide customer support, detect and prevent fraud, and — where you have consented — send newsletter updates. Where required, our legal basis is contract performance, consent, or legitimate business interest.

Payment processors

Payments are processed by Stripe and PayPal. Sensitive payment details (full card numbers, PayPal login credentials) are handled directly by those providers under their own privacy policies — we do not store full card credentials on our servers.

Retention

We retain order, subscription, and payment records for as long as needed for accounting, tax, and legal purposes, and account data for as long as your account remains active or as required by law.

Service providers and international processing

We share data with the service providers needed to run the store — payment processors, transactional email delivery, and hosting/ database infrastructure. Some of these providers may process data outside Canada.

Cookies and analytics

We use cookies and similar technologies for essential site functionality (cart, login) and, where enabled, basic analytics. [Specific analytics/cookie tools to be confirmed.]

Security

We use reasonable technical and organizational safeguards to protect your information, including encrypted transport and access controls on our systems.

Your rights

Depending on your location, you may have the right to access, correct, or request deletion of your personal information, and to lodge a complaint with a privacy regulator. Contact [privacy contact email] to exercise these rights.