The short version
We collect your name, email, shipping address and phone number so we can send you coffee and tell you where it is. We don't sell it, we don't trade it, and we don't use it to advertise to you anywhere else.
We never see your card number. Stripe handles that.
What we collect
- When you order: your name, email, shipping address, phone number, and any delivery note you write
- When you send a wholesale enquiry: your name, business, email, phone and whatever you tell us about your property
- When you email us: your email and whatever's in the message
- When you visit: anonymous, cookieless page analytics: no profile, no cross-site tracking, nothing that identifies you
Your payment card details are entered on Stripe's own checkout and never touch our systems. We can see the last four digits and the card brand; we cannot see the number.
Why we collect it
To take and fulfil your order, to email you a confirmation and a tracking link, to manage your subscription if you have one, to answer you when you write to us, and to keep the business records the law requires us to keep.
That's the whole list. We don't profile you and we don't build an advertising audience out of you.
Who we share it with
- Stripe: payments, subscriptions, and the account page where you see your orders
- Resend: sending your confirmation and shipping emails
- Vercel: hosting this website and its cookieless analytics
- Our shipping carrier: your name and address, so they can deliver the parcel
That's everyone. Each one gets the minimum they need to do their job. We don't sell personal information to anybody, for any purpose.
Where it's stored
Some of our service providers store and process data on servers outside Canada, including in the United States. While it's there it's subject to the laws of that country, which can include lawful access by foreign authorities. We tell you this because Canadian privacy law requires it, and because you should know.
We choose providers with real security practices and contractual privacy obligations, and we keep the amount of information that leaves Canada to the minimum needed to ship your order.
How long we keep it
Order records are kept for seven years, because tax law requires it.
Wholesale and general enquiries are kept for two years, then deleted.
If you cancel a subscription we keep the order history, because it's a business record, but you can ask us to remove everything that isn't legally required.
Cookies
This site sets no advertising or tracking cookies. Our analytics are cookieless and don't identify you.
Stripe's checkout and account pages set their own cookies to keep you signed in and to prevent fraud. Those are Stripe's and are governed by Stripe's privacy policy.
Your rights
Under Canadian privacy law you can ask us what personal information we hold about you, ask us to correct it, ask us to delete anything we're not legally required to keep, and withdraw consent for us to use it, though if you withdraw consent we may not be able to complete an order.
Email support@overpourcanada.ca and we'll answer within 30 days. There's no charge and you don't need a reason.
If you're not happy with how we've handled it, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Security
The site runs entirely over HTTPS. Payment data never reaches us. Access to order information is limited to the three people who run Overpour, each with their own account.
No system is perfect. If we ever have a breach that creates a real risk of significant harm to you, we'll tell you and the Privacy Commissioner, as the law requires.
Children
This site isn't aimed at children and we don't knowingly collect information from anyone under 16.
Changes
If we change this policy we'll update the date at the top. If the change is significant, we'll email anyone it affects rather than quietly editing the page.