Privacy Policy

Effective date: Pending Jacob's confirmation of the launch date.Last updated: Pending Jacob's confirmation of the launch date.Review schedule: We review this Privacy Policy at least annually and update it as needed.

1. About This Privacy Policy

Shack In The Back Designs respects the privacy of customers and visitors to its website.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• visit or use shackintheback.ca;
• browse our catalogue and submit an order request;
• pay an invoice through Square;
• purchase products through our Etsy shop;
• purchase products at in-person markets;
• request a custom, personalized, or made-to-order item;
• contact us by email, contact form, social media, or other communication method;
• submit a review, photograph, comment, or other content; or
• sign up to receive marketing communications.

In this Privacy Policy, "we", "us", and "our" mean Shack In The Back Designs.

Our products include handmade crochet critters, 3D-printed creatures and articulated figures, laser-engraved items, customized products, and other handmade or technology-crafted goods.

2. Personal Information We Collect

"Personal information" generally means information about an identifiable individual. We collect only information reasonably required for identified business purposes.

Depending on how you interact with us, we may collect the following categories of personal information, including personal information you provide voluntarily and information collected automatically when you use our website.

We collect personal information such as your name and email address, order-request details submitted voluntarily, and (where applicable) shipping information, plus usage data such as IP address, browser type, device information, pages visited, time spent, and interactions with our site. Payment information is collected and processed by Square when an invoice is paid.

2.1 Contact information and identifiers you provide

This may include:

• name;
• email address; and
• other identifiers you choose to provide voluntarily (for example, information you include when you contact us).

2.2 Order-request and transaction information

This may include:

• item(s) requested and options;
• quantity;
• customisation notes and personalization details;
• shipping or local pickup preference (as submitted through the order request form);
• communications about an order request or order; and
• invoice and payment status information we receive from Square after an invoice is paid (for example, confirmation of payment, invoice number, date, amount, and applicable taxes).

Payment information is collected and processed by Square when an invoice is paid.

2.3 Shipping and delivery information

To fulfil an order shipped within Canada, we may collect and share:

• recipient name;
• delivery address;
• postal code;
• telephone number or email address, where required by a carrier;
• delivery instructions; and
• tracking or delivery information.

2.4 Payment information

Payments may be processed by Square, Etsy, or another payment processor.

When you pay a Square invoice, Square collects and processes payment information (which may include payment-card details or other payment-method details, billing information, transaction information, and fraud-prevention information) under Square's own terms and privacy policies.

We generally do not need to collect or retain complete payment-card numbers.

Payment processors may handle payment information under their own privacy policies and terms. We encourage customers to review the applicable processor's privacy policy.

2.5 Information submitted with custom or personalized orders

If you request a custom or personalized product, we may collect:

• names, dates, messages, quotations, or other text;
• photographs;
• logos;
• artwork;
• design files;
• measurements;
• colour and style preferences;
• information about the intended recipient; and
• other instructions needed to create the item.

You should not provide sensitive personal information, government identification, financial account information, medical information, or information about another person unless it is necessary for the requested service and you are authorized to provide it.

2.6 Reviews, photographs, and user-submitted content

If you submit a review, photograph, video, comment, testimonial, or other content, we may collect:

• your name or username;
• the content you submit;
• photographs or videos;
• the date and time of submission; and
• information you include in the content.

Please avoid including personal information about other individuals, particularly children, unless you have their permission or the permission of their parent or guardian.

2.7 Communications and customer-service information

When you contact us, we may collect:

• the contents of your message;
• your name and contact information;
• order or transaction details;
• information needed to resolve an inquiry; and
• records of our communications with you.

2.8 Technical and usage information

When you visit our website, we or our service providers may collect information such as:

• IP address;
• browser type and version;
• device information;
• device type;
• operating system;
• approximate location;
• pages visited or viewed;
• links clicked and interactions with our site;
• time spent on pages;
• referring website;
• date and time of access;
• website interaction information; and
• error and diagnostic information.

Some of this information may be personal information, depending on how it is collected and combined.

3. How We Collect Personal Information

We may collect personal information:

• directly from you when you submit an order request through our website;
• when you submit a custom-order request;
• when you contact us;
• when you sign up for marketing communications;
• when you submit a review, photograph, or other content;
• through Square when an invoice is paid;
• through Square, Etsy, or another platform when you purchase our products;
• through payment processors;
• through shipping and delivery providers;
• through cookies and similar technologies (subject to your cookie-consent choices, where applicable);
• from publicly available sources, where permitted by law; and
• from another person where that person is authorized to provide the information.

Where practical, we will explain the purpose for collecting personal information at or before the time it is collected.

4. How We Use Personal Information

We may use personal information for the following purposes:

4.1 Processing and fulfilling orders

We use personal information to:

• review and respond to order requests submitted through our website;
• prepare and send Square invoices by email;
• confirm payment status through Square once an invoice is paid;
• provide order receipts, confirmations, and updates;
• prepare, customize, and produce products;
• arrange shipping and delivery;
• provide tracking information;
• manage returns, exchanges, refunds, and warranty or product concerns;
• prevent fraud and unauthorized transactions; and
• maintain business and transaction records.

4.2 Customer service and communications

We may use personal information to:

• respond to questions and requests;
• communicate about an order or custom project;
• provide customer support;
• resolve complaints;
• confirm identity where reasonably necessary; and
• maintain records of our communications.

4.3 Custom, personalized, and made-to-order products

We use information supplied for a custom or personalized order to:

• understand your instructions;
• create or customize the requested product;
• communicate about design choices or approvals;
• confirm measurements, colours, wording, or other specifications;
• estimate production timelines; and
• complete the order.

4.4 Website operation and improvement

We may use technical and usage information to:

• operate and maintain the website;
• remember your preferences (where enabled by cookies you consent to, if applicable);
• understand how visitors use the website (for example, through analytics cookies where you consent);
• improve website content, products, and services;
• diagnose technical problems;
• protect the website and our systems; and
• measure the effectiveness of the website and marketing efforts using analytics data (where you consent to analytics cookies).

4.5 Marketing

We may use personal information to send marketing communications, such as:

• newsletters;
• new-product announcements;
• event announcements;
• special offers;
• promotions; and
• information about Shack In The Back Designs.

We will send commercial electronic messages only where we have the required consent or another lawful basis under applicable law (including CASL, where applicable). Each marketing message should include the required identification information and a functional unsubscribe mechanism.

We will send promotional emails only with consent.

You may withdraw consent to marketing communications at any time by using the unsubscribe link in the message or by emailing us at shackinthebackdesigns@gmail.com.

Withdrawing consent to marketing does not affect our ability to send non-promotional communications reasonably required to complete or administer an order.

4.6 Legal, accounting, and business purposes

We may use personal information to:

• comply with tax, accounting, legal, regulatory, and insurance requirements;
• establish, exercise, or defend legal claims;
• enforce our agreements, policies, and terms;
• protect our rights, property, customers, staff, and the public;
• investigate suspected fraud, misuse, or unlawful activity;
• complete a business sale, restructuring, financing, or similar transaction; and
• use it for another purpose permitted or required by law.

5. Consent

5.1 Consent for collection, use, and disclosure

Where required by law, we will obtain your consent before collecting, using, or disclosing personal information.

Consent may be express or implied, depending on the circumstances and applicable law. For example:

• by placing an order, you consent to our collecting and using information needed to process and fulfil the order;
• by providing a shipping address, you consent to our disclosing it to the applicable shipping or delivery provider;
• by requesting customer service, you consent to our using the information needed to respond;
• by subscribing to marketing communications, you provide express consent to receive those communications; and
• by submitting a review or photograph, you consent to our using the submitted content as described when you submit it.

We will not require consent for collection, use, or disclosure beyond what is reasonably necessary to provide a requested product or service, except where permitted by law.

5.2 Withdrawing consent

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

To withdraw consent, contact us using the details in Section 15. Withdrawal of consent may prevent us from processing an order, completing a custom project, providing a requested service, or maintaining records required by law.

We may continue to use or disclose information without consent where permitted or required by law, including for legal, accounting, fraud-prevention, security, or transaction-record purposes.

5.3 Consent for marketing

Marketing consent will be collected separately where required. (The exact marketing sign-up method is to be confirmed.)

We will maintain appropriate records of marketing consent and unsubscribe requests.

6. Disclosure to Service Providers and Other Third Parties

We may disclose personal information to service providers that help us operate the business. These providers may process personal information only for purposes connected with their services and may be located in Canada or other countries.

We do not sell personal information. We may share personal information with service providers (such as payment processors, shipping companies, and IT support) and with legal authorities where required by law or to protect our rights.

6.1 Square

Square may process information in connection with:

• invoicing and invoice payment processing;
• digital receipts;
• refunds;
• fraud prevention;
• order administration; and
• related Square services.

Square may process information under its own terms and privacy policies. Customers should review Square's applicable privacy notices for further information.

6.2 Etsy

When you purchase through our Etsy shop, Etsy may collect and process personal information in accordance with Etsy's terms and privacy policy.

Etsy may provide us with information needed to fulfil and support an order. We will use that information only for purposes permitted by law, Etsy's applicable rules, and the customer's reasonable expectations.

Customers who purchase through Etsy should also review Etsy's Privacy Policy and applicable seller or marketplace terms.

6.3 Payment processors and financial institutions

Payment information may be disclosed to:

• Square;
• Etsy Payments;
• CraftedCanadian (for marketplace orders, where applicable);
• credit-card networks;
• banks and financial institutions;
• fraud-prevention providers; and
• other payment processors selected by the customer or required to complete a transaction.

6.4 Canada Post and shipping carriers

We may disclose delivery information to Canada Post and other shipping or courier providers to arrange delivery, tracking, address verification, delivery notifications, or claims handling.

These providers may handle information under their own privacy policies and terms.

6.5 Website, hosting, technology, and analytics providers

We may disclose technical information and other personal information to providers that assist with:

• website hosting;
• website security;
• data storage;
• analytics;
• email delivery;
• customer communications;
• fraud detection;
• technical support; and
• website maintenance.

Analytics provider used: Google Analytics (Google Analytics 4), activated only with your consent as described in Section 7.

6.6 Professional advisers and authorities

We may disclose personal information to:

• accountants;
• bookkeepers;
• lawyers;
• insurers;
• auditors;
• government agencies;
• regulators;
• law-enforcement authorities; and
• courts or dispute-resolution bodies,

where reasonably necessary or legally required.

6.7 Business transactions

If Shack In The Back Designs is involved in a sale, merger, restructuring, financing, insolvency proceeding, or other business transaction, personal information may be disclosed to the parties involved, subject to applicable confidentiality and privacy requirements.

6.8 We do not sell personal information

We do not sell personal information for money.

We may disclose personal information to service providers (for example, payment processors, shipping companies, and IT support) so they can provide services to us, and to legal authorities where required by law or where necessary to protect our rights, property, customers, staff, or the public.

We also do not knowingly share personal information for cross-context behavioural advertising unless this policy is updated to explain that practice and any required consent or opt-out rights.

7. Cookies and Similar Technologies

Our website and third-party services may use cookies, pixels, tags, local storage, device identifiers, and similar technologies.

We use cookies and similar technologies to enhance your browsing experience, enable essential site functions, and (where you consent) analyse site traffic.

We use a cookie consent banner. Non-essential cookies (including analytics cookies) are not set unless and until you consent.

On our website, the only non-essential cookie category in use is Analytics, and the only analytics tool used is Google Analytics (Google Analytics 4). We do not use advertising, marketing, remarketing, or social-media tracking cookies. The cookie consent banner applies to the cookie categories we use on this website and does not "block" categories that are not in use.

These technologies may be used for:

• essential website functions (for example, basic site operation, submission of the order-request form, and security);
• analytics (where you consent);
• website security;
• fraud prevention; and
• improving website performance.

7.1 Essential technologies

Essential cookies may be necessary for the website, submission of the order-request form, security, or other requested services to operate.

These technologies generally cannot be disabled without affecting website functionality and are not gated by the cookie consent banner.

7.2 Analytics technologies (Google Analytics 4)

We use Google Analytics (Google Analytics 4) to help us understand how visitors use our website (for example, pages viewed and basic interaction information). Google Analytics is gated behind our cookie consent banner: if you do not consent to analytics cookies, Google Analytics must not load and must not set analytics cookies.

When analytics consent is given and Google Analytics is enabled, Google Analytics may set the following cookies by default:

• _ga (default expiration: 2 years; used to distinguish unique users); and
• ga_<container-id> (default expiration: 2 years; used to persist session state for the specific measurement ID). (The container ID value is to be added when the Google Analytics property is connected.)

The default expiration periods can be changed in Google Analytics settings. Web browsers may also cap the lifespan of first-party cookies for some users (for example, Chrome may cap at up to 400 days and Safari may cap at 7 days), which may reduce actual cookie duration regardless of our settings.

Before you consent, the Google Analytics tag does not load at all, so no analytics cookies are set and no analytics data is sent. We do not use Google Consent Mode or cookieless pings.

The user-level and event-level data-retention setting in our Google Analytics property is 2 months.

Our Google Analytics property is not linked to Google Ads. If that ever changes, additional advertising cookies may be set, and we will update this Privacy Policy and the cookie consent banner before using those features.

7.3 Advertising and social-media technologies

We do not use advertising, remarketing, or social-media tracking cookies on our website. If this ever changes, we will update this Privacy Policy and the cookie consent banner and obtain any required consent.

7.4 Managing cookies

You can control cookies through your browser settings and through our website's built-in cookie consent banner.

Your analytics choice is stored using the website's built-in cookie banner and can be changed or withdrawn by using the banner again. A "Cookie settings" link in the footer of every page re-opens the banner at any time.

For more information, please see our Cookie Policy.

Disabling some cookies may affect website operation or functionality.

8. Cross-Border Processing and Storage

Because we use service providers such as Square, Etsy, CraftedCanadian, payment processors, website providers, analytics providers, and shipping providers, personal information may be processed, stored, or accessed outside Ontario or Canada.

(Whether Square stores or processes personal information outside Canada is being confirmed for the PIPEDA cross-border disclosure.)

When personal information is processed outside Canada, it may be subject to the laws of the country where it is processed. This may include lawful access by courts, law-enforcement agencies, or national-security authorities in that country.

We remain responsible for personal information under our control and will take reasonable steps to use service providers that provide an appropriate level of protection, contractual safeguards, confidentiality obligations, and security measures.

By using our website or providing personal information, you acknowledge that your information may be processed in other jurisdictions as described in this Privacy Policy.

9. Retention of Personal Information

We retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, comply with legal and accounting obligations, resolve disputes, enforce agreements, maintain business records, and protect our legitimate interests.

When personal information is no longer required, we will take reasonable steps to securely destroy, erase, or anonymize it.

We may retain information longer where necessary to comply with law, respond to an unresolved complaint or request, establish or defend a legal claim, or preserve evidence.

10. Accuracy and Correction

We try to keep personal information accurate, complete, and up to date for the purposes for which it is used.

You may ask us to correct personal information that is inaccurate, incomplete, or out of date. If we reasonably determine that a correction is required, we will update our records and, where appropriate, notify relevant service providers or third parties that received the incorrect information.

11. Security Safeguards

We use reasonable physical, technical, and organizational safeguards appropriate to the sensitivity of the information and the circumstances.

These safeguards may include:

• limiting access to personal information to people who need it;
• using passwords, authentication, and access controls;
• using reputable payment, website, and hosting providers;
• using secure connections where available;
• keeping devices and software reasonably up to date;
• avoiding unnecessary collection of payment information;
• securely storing paper records;
• securely destroying records that are no longer required;
• training individuals who handle personal information; and
• investigating and responding to suspected privacy incidents.

No method of transmission or storage is completely secure. We cannot guarantee that personal information will never be lost, intercepted, misused, or accessed without authorization.

If we experience a privacy breach that creates a real risk of significant harm, we will take steps required by applicable law, which may include containment, investigation, notification, and reporting.

12. Children's Privacy and Children's Products

Some of our products may be intended for children or may contain small parts. Product listings may include age recommendations, including:

• Ages 6+; or
• Ages 3+ with adult supervision,

as applicable to the product.

Product age labels and safety instructions should be followed. Adult supervision is recommended for products containing small parts, moving parts, craft materials, tools, or other potential hazards.

We do not knowingly collect personal information directly from a child for marketing purposes.

If a child wishes to place an order or submit personal information, a parent or legal guardian should assist with the transaction and provide any required consent.

If you believe that a child has provided personal information to us without appropriate permission, contact us at shackinthebackdesigns@gmail.com. We will review the request and take reasonable steps to delete the information where required by law.

A parent or guardian's request to delete information may be subject to legal, accounting, transaction-record, safety, or dispute-related exceptions.

13. Your Privacy Rights

Depending on where you live and which privacy laws apply, you may have the right to:

• ask whether we hold personal information about you;
• request access to your personal information;
• ask how we collect, use, disclose, and retain your information;
• request correction of inaccurate or incomplete information;
• withdraw consent to optional uses, such as marketing;
• request deletion of personal information, subject to legal and reasonable exceptions;
• ask us to explain how a privacy concern was handled;
• complain to the applicable privacy regulator; and
• exercise additional rights available under the law of your province, territory, or country.

We may need to verify your identity before responding to a request. We may also ask for information needed to locate the relevant records.

We will not use identity-verification information for unrelated purposes and will securely delete it when it is no longer required, subject to applicable retention obligations.

13.1 Access requests

To request access to your personal information, contact us using the information in Section 15.

We will respond within the time required by applicable law. Under PIPEDA, access requests are generally answered within 30 days, subject to permitted extensions and exceptions.

13.2 Correction requests

If information is inaccurate or incomplete, tell us what should be corrected and provide any supporting information reasonably required.

13.3 Deletion requests

You may ask us to delete personal information. We will assess the request under applicable law.

We may be required or permitted to retain information for purposes such as:

• tax and accounting records;
• transaction records;
• legal claims;
• fraud prevention;
• safety investigations;
• security;
• dispute resolution;
• regulatory compliance; or
• maintaining a record of an access, correction, or deletion request.

13.4 Marketing opt-out requests

You may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link in the message (included in every marketing email); and/or
• emailing us at shackinthebackdesigns@gmail.com and asking to unsubscribe.

We will process unsubscribe requests within the time required by applicable law (including CASL, where applicable).

13.5 Complaints

If you have a concern about our privacy practices, please contact us first so that we can investigate and attempt to resolve it.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction over your situation.

14. Third-Party Websites and Platforms

Our website, social-media pages, product listings, emails, and communications may contain links to or integrations with third-party websites and platforms, including Square, Etsy, CraftedCanadian, payment services, shipping providers, and social-media services.

This Privacy Policy does not govern the privacy practices of those third parties. Their collection, use, storage, and disclosure of personal information are governed by their own policies and terms.

We encourage you to review the privacy policies of any third-party service you use. If you purchase through a third-party marketplace (such as Etsy or CraftedCanadian), that platform's privacy policy will also apply to information they collect and process.

15. Contact Information

For questions, complaints, access requests, correction requests, deletion requests, or consent withdrawals, contact:

Shack In The Back Designs164 Andrew St Newcastle, Ontario Canada

Email: shackinthebackdesigns@gmail.comWebsite: https://shackintheback.caPrivacy contact: Jacob Campbell

Please include enough information for us to understand and respond to your request, but do not send payment-card numbers, passwords, government identification numbers, or other unnecessary sensitive information by email.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

• our products or services;
• our website;
• payment, shipping, analytics, or marketing providers;
• applicable laws;
• our information-handling practices; or
• business operations.

The updated version will be posted on shackintheback.ca with a revised "Last updated" date.

If a change materially affects how we use personal information, we will provide any notice or obtain any consent required by applicable law.