Privacy Policy

Last updated: September 20, 2026

Who we are

Velvea operates velvea.ca from 5105 Hurontario Street, Mississauga, ON L4Z 0C9, Canada. We are responsible for the personal information we collect, and we handle it in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). Privacy questions go to giftsvelvea@gmail.com.

What we collect

When you order: your name, email address and phone number; the recipient's name, delivery address and phone number; your gift message and delivery notes; and what you ordered. Your card details go directly to Stripe, our payment processor. We never see or store your full card number.

When you create an account: your name, email address and a password, which we store only as a one-way hash. Your order history is linked to your account.

When you contact us or request a quote: whatever you include in your message, and your company details for corporate inquiries.

Automatically: your IP address and basic request details, which we use for security, fraud prevention and rate limiting, and anonymous, aggregated page-view statistics as described under Cookies below.

Information about gift recipients

When you send a gift, you give us the recipient's name, address and phone number. We use these only to deliver the basket and to contact the recipient about that delivery. We do not add recipients to any marketing list. By providing their details you confirm that you are entitled to share them with us for this purpose.

How we use your information

We use personal information to:

• prepare, deliver and support your order, and send you order-related emails such as confirmations, shipping and delivery notices;
• operate your account and let you see your orders;
• answer your questions and resolve problems;
• prevent fraud and protect the site;
• meet our legal obligations, including tax and accounting records;
• send occasional marketing emails, but only if you have expressly opted in. Every marketing email has an unsubscribe link, and you can opt out at any time.

We do not sell personal information, and we do not share it with third parties for their own marketing.

Service providers

We rely on a small number of providers to run the store. Each receives only the information it needs to do its job and is bound to protect it:

• Stripe processes payments and handles your card details.
• Resend delivers our transactional and marketing emails.
• Vercel hosts the website and provides cookieless analytics.
• Google Analytics measures how the site is used, only after you accept analytics cookies in the banner. IP addresses are anonymised and advertising features are turned off.
• Neon hosts our database.
• Cloudinary stores and serves product images.
• Upstash provides rate limiting; it receives your IP address for a few minutes to stop abuse.
• Cloudflare Turnstile provides bot protection on our public forms; it receives your IP address and browser signals.
• Delivery partners and couriers receive the recipient's name, address and phone number for orders they carry.

Some of these providers store data in the United States. Information held there may be subject to the laws of that country. We choose providers with strong security practices and contractual privacy commitments.

Cookies and similar technologies

We keep this minimal. A secure session cookie keeps you signed in to your account. Your browser's local storage remembers your cart and preferences on your own device. We use Vercel Analytics, which measures page views without cookies and does not identify or track individual visitors across sites. Cloudflare Turnstile may set a short-lived cookie on the forms it protects while it checks that you are not a bot. We do not use advertising cookies or trackers.

If you accept analytics cookies in the banner shown on your first visit, Google Analytics sets cookies that recognise your browser on return visits so we can see which pages and baskets are popular. Until you accept, Google Analytics runs without cookies and cannot recognise you. You can change your choice at any time by clearing this site's data in your browser, which brings the banner back.

How long we keep information

Order records are kept for seven years to meet Canadian tax and accounting requirements. Account information is kept until you ask us to delete your account. Contact and quote messages are kept for as long as needed to deal with them and for a reasonable period afterwards. Information we no longer need is deleted or anonymized on request or during periodic review.

How we protect it

All traffic to velvea.ca is encrypted. Passwords are hashed and never stored in plain text. Access to customer data inside Velvea is limited to the people who need it to fulfil orders and support customers. No system is perfectly secure, but if a breach ever affected your information we would notify you and the Privacy Commissioner as the law requires.

Your rights and choices

You can ask to see the personal information we hold about you, have it corrected, or have it deleted, subject to the records we are legally required to keep. You can withdraw consent to marketing at any time by using the unsubscribe link or emailing us. To make any request, write to giftsvelvea@gmail.com. We will respond within 30 days.

If you are not satisfied with how we have handled your information, you may complain to the Office of the Privacy Commissioner of Canada.

Children

Our site is intended for adults. We do not knowingly collect personal information from anyone under 16, and we will delete it if we learn we have.

Changes to this policy

We may update this policy as our practices or the law change. The date at the top shows the latest revision. Significant changes will be announced on the site.

Contact

For privacy questions or requests, email giftsvelvea@gmail.com.