Privacy Policy

This draft describes how [LEGAL ENTITY NAME], operating as PepChat ("PepChat", "we", or "us"), handles personal information through this website and related store services. It is written for a Canadian audience and is intended to reflect the principles in Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), including accountability, meaningful consent, limited collection, and appropriate safeguards.

Depending on the service you choose to use, we may collect:

• Your name, email address, selected subject, optional order number, and message when you use the contact form.
• Your email address and consent preferences when you join the newsletter.
• Order, billing-contact, and shipping details needed to process and deliver an order, such as your name, email, phone number, address, ordered items, and transaction status.
• Basic technical and security information, such as IP address, browser details, request logs, and cookie or similar identifiers used to operate and protect the site.

Payment card entry is handled in Gatewaylinx's hosted iframe. Card data is sent directly to the payment processor and never touches PepChat's website or servers. We may receive limited payment results, such as a transaction identifier, status, and card brand or last four digits, where provided by the processor.

We use personal information to answer requests, provide newsletters you asked for, create and fulfill orders, take payment, send transactional messages, prevent fraud and abuse, troubleshoot and secure the service, keep required business records, and meet legal obligations. We do not sell personal information. Marketing email should include a way to unsubscribe.

We use service providers only as needed to run the store: Medusa Cloud for commerce hosting, Cloudflare for site delivery and security, Gatewaylinx for payment processing, Canada Post for shipment fulfillment and tracking, and Amazon SES for email delivery. These providers receive the information needed for their role and may process it in Canada or other countries, where it can be subject to local law. We may also disclose information when legally required, to protect the service or people, or as part of a business transfer subject to appropriate safeguards.

We intend to keep personal information only as long as needed for the purposes above, including customer support, fraud prevention, tax and accounting records, dispute handling, and other legal requirements. Retention periods may differ by record type and remain to be finalized before this policy takes effect. We use reasonable administrative, technical, and organizational safeguards, but no internet service can promise absolute security. When information is no longer required, it should be deleted, destroyed, or anonymized securely.

You may ask to access or correct your personal information, withdraw consent where applicable, unsubscribe from marketing, or ask questions about our privacy practices. Some information may need to be retained where law permits or requires it. Send a request through our contact page. The name and direct contact details of [PRIVACY OFFICER OR RESPONSIBLE ROLE] will be added following legal review. We may need to verify your identity before completing a request.

This is a working draft, not an effective policy. It will be reviewed and may change before launch. The approved version will state its effective date and explain material updates where appropriate.