Privacy Policy

Last updated 2026-08-03 · Effective immediately

What this policy covers

This policy describes the personal information that Trading & Chill ("we", "us", "our") collects from customers who buy from our store, why we collect it, how long we keep it, and who has access to it. We are committed to handling your information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law.

What we collect

• Order information: your email address, shipping address, phone number (optional), and order contents — needed to fulfil and ship your order and send receipts.
• Payment information: handled entirely by Stripe; we never see your card number. Stripe's privacy policy applies to data they collect.
• Back-in-stock signups: the email you enter when a card is sold out — used only to email you when that card returns.
• Authentication: if you sign in with a magic link, we store a session cookie (tc_sid) on your device for 7 days. It is strictly necessary for the service and is not used for tracking.
• Cart / preferences: stored in your browser's localStorage; we do not sync these to our servers unless you sign in.
• Server logs: standard request logs (IP, user agent, timestamp) retained for 30 days for abuse detection.

Why we collect it

• To fulfil and ship your order and send transactional emails (order confirmation, shipping notification, restock alerts you opted into).
• To respond to support requests.
• To detect fraud and abuse (e.g. card-testing attacks on checkout).
• To comply with tax, accounting, and legal record-keeping obligations (order records are kept per CRA requirements, even after you delete other data).

Who has access

• Jorge (the owner, hobby seller) — full access to order data via the admin dashboard.
• Stripe — payment processing. Stripe privacy policy.
• Resend — outbound email delivery. Resend privacy policy.
• Vercel — hosting and serverless functions. Vercel privacy policy.
• Scryfall — Magic card data and images (no customer data sent; just public card lookups by UUID).

We do not sell, rent, or trade your personal information. We do not run third-party advertising trackers.

Your rights (PIPEDA)

• Access the personal information we hold about you (we'll send a JSON export within 30 days of request).
• Correct any inaccurate information.
• Withdraw consent for optional uses (we don't send marketing email; you'll only get transactional).
• Lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

To exercise any of these rights, email info@tradingandchill.com. We respond within 30 days.

Delete your data

Enter the email you used and we'll remove your back-in-stock signups and any saved carts tied to that email. Order records are kept for tax/accounting purposes and cannot be deleted here.

Data retention

• Order records: kept per CRA / tax record-keeping requirements.
• Back-in-stock signups: kept until notified, deleted, or your delete request.
• Cart / wishlist (localStorage): clear these anytime via your browser settings.
• Server logs: 30 days, then deleted.

Contact

Business address: 34-1600 Culver Dr, London, ON N5V 3H5, Canada. Privacy officer: Jorge Quijano, reachable at info@tradingandchill.com.