What we collect, and why

Flare Craft Fire Cider, hand-bottled at 20 Roy Blvd Unit 34, Brantford, Ontario N3R 7K2. You can reach us at flaretonic1@gmail.com, which is read by a person and is the address for anything on this page, including telling us to delete what we hold about you.

Only what a particular thing you did actually needs.

• When you order: your name, email, street address, city, province and postal code, your phone number if you give one, and what you bought. We ask for the address because a collection has to be tied to a real person, and we need some way to reach you if a batch runs late.
• When you pay: nothing at all. Your card details go straight from your browser to Stripe. They never touch our servers and they're never in our database. What comes back to us is a confirmation that the payment worked, plus the last few digits Stripe chooses to show us.
• When you sign up for batch drops: your email address, and nothing else.
• When you write to us: your name, your email, whichever reason you picked, and your message.
• When you enter a draw at a booth: your name and email, which market you were standing at, and two separate yes-or-no answers: whether we can photograph you, and whether we can email you. Both start as no and stay no unless you tick them.
• When you leave a review: the display name you type, your rating, and what you wrote. We read every one before it goes up.
• When you scan a code on a card or a sign: which code it was, the time, the page you came from and what browser you used. No name is attached to a scan, so we can't tell who scanned what.

We also hold the network address a request came from for a few minutes, which is what stops one script hammering a form ten thousand times. It isn't used for anything else.

Four companies, each doing one job. We don't sell, rent or trade your information to anybody, for any purpose, ever.

• Stripe takes the payment. They see your card and your billing details. We don't.
• Resend sends your order confirmation and holds the batch-drop list. Every email they send for us carries an unsubscribe link that works.
• Vercel hosts the site and counts page views. The counting is anonymous and sets no advertising cookies. It tells us a page was looked at, not who looked at it.
• Our database provider stores the orders, signups, messages and reviews on servers we rent.

Some of them operate outside Canada, so your information can end up stored or handled in another country and reachable by that country's courts. We'd rather say that plainly than bury it in a sentence nobody finishes.

Orders stay as long as we need them for our books and for anyone who comes back a year later with a question about a batch. Signups stay until you unsubscribe. Messages stay until they're dealt with and a sensible while after that. Scans are counts, and they're kept as counts.

If you'd rather we held none of it, say so. We'll delete everything we're not legally required to keep, and tell you what that was.

Canada's federal privacy law gives you the right to ask what we hold about you, to have it corrected, to have it deleted, and to withdraw a consent you gave us, including the photo and email boxes from a booth. One email does all of it, and we'll answer inside thirty days.

If we handle that badly you can complain to the Office of the Privacy Commissioner of Canada. We'd much rather you told us first.

The shop sets no advertising or tracking cookies, so there's no banner here to click away. The one cookie the site does set is the session that keeps us logged in to our own admin pages, and you'll never be handed it.

Flare isn't sold to or marketed at children, and the booth draw is eighteen and over. We don't knowingly collect anything from a child, and if we ever did, write to us and it goes.

When this page changes, the date at the top changes in the same edit. There's no archive of old versions, so if something here matters to you, save a copy.

The other half of the paperwork is on the terms page.