Privacy policy

Scope and who we are

This policy applies to personal information handled by Anavrin Digital Services Inc., operator of the Arts & Crafts brand (Arts & Crafts, we, us, or our), through this website, our direct customer support, retail and wholesale inquiries, and direct orders that link to this policy.

For Canadian privacy law, the organization responsible for the personal information described here is Anavrin Digital Services Inc.. Our accountable privacy role is the Privacy Contact. Submit a request through our Support page and select Privacy request from the subject menu. No customer account is required. The request will be assigned internally to the person designated to oversee privacy compliance, whose name or title will be made available on request.

This policy does not govern information that Amazon or another marketplace collects as an independent business when you purchase there. Review the privacy policy shown by that marketplace. It also does not cover an external website merely because we link to it.

Information we collect

The information we collect depends on how you interact with us and which storefront features are enabled.

Direct website payments are processed through Shopify Payments. Shopify and its payment-processing partners process full card or financial credentials, transaction information, and fraud signals as needed to provide the payment service and meet their legal obligations. We do not store complete payment-card numbers on our own systems.

Shopify is our primary customer and order system, and we do not intend to maintain an independent customer database or CRM. Information is still collected and processed on our behalf for our store, and authorized Arts & Crafts users may access order, customer, delivery, wholesale, and support information through Shopify administration tools. Limited information is also provided to payment processors, carriers, fulfilment providers, and other providers when necessary to complete a transaction or respond to a request. Using Shopify does not transfer our merchant responsibilities to Shopify.

Please do not send government identification, health information, precise geolocation, account passwords, or other sensitive personal information unless we specifically request it for a lawful and necessary purpose.

Where information comes from

• Directly from you, such as when you place an order, submit a wholesale or support form, or contact support.
• Automatically from your browser or device, using essential server logs, cookies, and similar storefront technologies.
• From service providers, such as Shopify, Shopify Payments and its payment-processing partners, fraud-prevention services, carriers, fulfilment providers, and configured customer-support tools.
• From marketplaces or partners, when they are permitted to provide information needed to fulfil an order or resolve a support issue.
• From public or lawful business sources, if needed to prevent fraud, verify a business customer, or protect legal rights.

How we use information

• provide the website, shopping cart, checkout, and requested services;
• process payment, accept or decline orders, arrange delivery, and handle returns or refunds;
• answer questions, provide product and safety information, and resolve support issues;
• authenticate users, detect fraud or misuse, secure systems, debug, and prevent incidents;
• maintain tax, accounting, warranty, product-safety, consent, and business records;
• maintain website performance, troubleshoot errors, and improve security and usability;
• establish, exercise, or defend legal claims and comply with lawful requests; and
• support a corporate transaction such as a financing, merger, acquisition, or sale.

We will not use personal information for a materially different purpose without providing any notice or consent required by law.

Consent and legal grounds

In Canada, we collect, use, and disclose personal information with meaningful consent, unless law permits or requires otherwise. We identify purposes at or before collection and use an appropriate form of consent considering the sensitivity of the information and your reasonable expectations. The notice presented at the point of collection will explain the relevant purpose in plain language instead of relying on this policy alone.

We do not offer customer accounts. Optional newsletter, promotional messaging, or analytics features may be added to the storefront. When one is available, the notice presented at sign-up or through Shopify's privacy controls will identify the relevant purpose and choice, and this policy will be updated if the provider or processing practice materially changes.

You may withdraw consent for optional processing at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already lawfully completed and may prevent us from providing a feature that depends on that information.

Where another legal framework uses different grounds, we may process information as needed to perform a contract with you, comply with law, protect legitimate business and security interests, or act with your consent, as applicable.

How we disclose information

We may disclose personal information to the following categories of recipients, only for relevant purposes:

• commerce and hosting providers that operate the storefront and technical infrastructure;
• payment and fraud providers that authorize transactions and assess risk;
• warehouses, carriers, customs brokers, Shopify shipping tools, and fulfilment partners selected for an order based on its destination, size, cost, availability, and delivery requirements;
• support and communication providers that perform configured order or customer-service functions for us;
• professional advisers, including accountants, insurers, auditors, and legal counsel;
• government, regulatory, law-enforcement, or other parties where disclosure is required or permitted by law or necessary to protect rights, safety, and security; and
• transaction participants and successors in a proposed or completed financing, reorganization, merger, acquisition, sale, or transfer, subject to appropriate protections.

Service providers may use personal information only as allowed by their contracts, our instructions, their own lawful independent responsibilities, and applicable law.

Shopify, payments and marketplaces

Our direct storefront uses Shopify. For customer personal information processed to operate our store, Arts & Crafts generally determines the business purpose and Shopify generally processes the information as our service provider. Shopify may also act independently for fraud, security, payment, network, or other platform functions described in Shopify's privacy materials and Data Processing Addendum.

Direct website payments are processed through Shopify Payments. Shopify and its payment-processing partners process payment, identity, transaction, device, and fraud information under their own legal obligations and service terms. Shopify is also the primary system holding our direct-store customer and order records.

We arrange fulfilment using our own operations and the carrier, Shopify shipping tool, warehouse, or fulfilment provider that is appropriate for the order. Only the information reasonably needed to prepare, route, deliver, support, or return the order is provided.

We do not offer customer accounts. We use Shopify's Customer Privacy settings to manage notices and choices for optional newsletter, marketing, analytics, and similar storefront features that may be offered. Installed services are reviewed so this policy and the applicable privacy controls remain consistent with our active practices and markets.

If you buy through Amazon or another marketplace, that marketplace independently collects and uses information for the marketplace transaction. We may receive limited order or support information where permitted.

Cookies and tracking technologies

A Shopify storefront uses cookies and similar technologies to remember a cart, keep a session secure, operate checkout, load storefront features, prevent fraud, and provide requested functions. We may also use optional analytics, such as Google Analytics or another measurement service, to understand website traffic, page performance, and how visitors use the storefront.

We review Shopify Customer Privacy settings and installed services to confirm which technologies are active. Where applicable, non-essential analytics will follow the consent or opt-out choice presented through the storefront. Advertising pixels or targeted advertising are not part of the analytics permission described here and would require separate disclosure and controls before use. You can adjust browser settings to block or delete cookies, although essential storefront or checkout functions may not work properly.

Sale, sharing and targeted advertising

This section is about the sale or sharing of personal information, not promotional events, product discounts, or seasonal sales. We do not sell personal information, enable advertising pixels, or use personal information for cross-context behavioural or targeted advertising.

Optional analytics used to understand aggregate storefront traffic and performance is not used by us for cross-context behavioural advertising. If we introduce an advertising pixel, ad personalization, or targeted advertising, we will identify the provider and purpose and provide any consent, opt-out, or Global Privacy Control response required by applicable law.

Marketing communications

We may offer an optional newsletter, promotional email, or SMS marketing program. If you choose to subscribe, we may collect your email address or telephone number, subscription source, consent record, communication preferences, and engagement information to send and administer the communications you requested.

We will identify the sender and purpose at sign-up, obtain and record consent where required, and provide a working unsubscribe or withdrawal method. You may unsubscribe from email through the link in a message and from SMS using the instructions provided with the program. We may still send non-promotional messages needed for an order, support request, safety notice, recall, or another service you request.

Cross-border processing

We operate for Canadian and U.S. customers and may use service providers in Canada, the United States, and other countries. As a result, personal information may be processed or stored outside your province, territory, state, or country and may be accessible to courts, law-enforcement, and regulators under local law.

We remain responsible for personal information under our control and use contractual, organizational, and technical measures appropriate to the information and service. Contact us for more information about relevant cross-border service providers.

Retention

We keep personal information only as long as reasonably necessary for the purpose for which it was collected, to meet legal and accounting requirements, and to resolve disputes. Shopify is the primary system holding direct-store order and customer records. Our retention schedule is:

A legal hold, active dispute, fraud investigation, product recall, or different statutory requirement may extend a period. Backups may remain until securely overwritten through a provider's normal cycle. We review Shopify settings and installed apps against this schedule and review retained information at least once each year.

Security and privacy breaches

We use administrative, technical, and physical safeguards appropriate to the nature and sensitivity of the information, such as access controls, provider review, secure transmission, authentication, updates, backups, and staff procedures. No system or transmission can be guaranteed completely secure.

If a privacy or security breach occurs, we will investigate, contain, document, and provide notices or reports required by applicable law. Under Canadian federal privacy law, this may include reporting a breach that poses a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notifying affected people, and keeping required breach records.

If you believe information connected with us has been compromised, submit a request through our Support page and select Privacy request.

Canadian privacy rights

Subject to applicable law, people in Canada may request access to personal information we hold about them, ask how it has been used or disclosed, request correction, and withdraw consent to optional processing. Additional rights may apply under provincial law, including portability or de-indexing rights in Quebec in eligible circumstances.

To make a request, use our Support page and select Privacy request. We will log the request, verify identity in a proportionate way, search the relevant Shopify, support, fulfilment and business records, and respond within 30 days unless applicable law permits an extension. We may refuse or limit a request where law permits or requires and will explain a refusal unless prohibited. There is no fee for a routine request, although a reasonable fee may apply where legally permitted and disclosed in advance.

When deletion is requested, we will delete or anonymize eligible information and ask relevant service providers to do the same. We may retain information that is still required for an order, tax record, fraud prevention, product safety, legal claim, or other lawful exception. We will tell the requester when an exception prevents complete deletion.

Residents may raise an unresolved concern with the Office of the Privacy Commissioner of Canada or, where applicable, the privacy regulator in Alberta, British Columbia, or Quebec. Our public-facing accountable role is the Privacy Contact; requests submitted through the Support page are assigned internally to the person designated to oversee privacy compliance. The designated person's name or title is available on request. If you purchase through Amazon or another approved marketplace, that marketplace's privacy policy governs the information it independently collects for the transaction; we may still receive limited order or support information where permitted.

U.S. state privacy rights

If a comprehensive privacy law in your state applies to us and to your information, you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccurate personal information;
• delete personal information, subject to exceptions;
• obtain a portable copy of certain information;
• opt out of sale, targeted advertising, or certain profiling;
• limit certain uses of sensitive personal information; and
• appeal a denied request, where that right applies.

We will not discriminate against you for exercising an applicable privacy right. To submit a request or appeal, use our Support page, select Privacy request, and state your jurisdiction and request. We may take reasonable steps to verify identity and authority. An authorized agent may submit a request where permitted, subject to verification.

These rights do not apply in every state or to every business. We may retain or decline to disclose information where an exemption applies, including to complete transactions, prevent fraud, comply with law, protect security, or establish legal claims.

California disclosures

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the CCPA), applies to Arts & Crafts, California residents have the rights to know, access, correct, and delete covered personal information; opt out of its sale or sharing; limit certain uses of sensitive personal information; and receive equal service and pricing when exercising those rights, subject to legal exceptions.

The categories described in Information we collect also describe the categories we expect to collect in the preceding 12 months. The sections on sources, purposes, and recipients explain our expected practices. We do not intend to use or disclose sensitive personal information to infer characteristics about a person.

We do not currently meet or assume that we meet the CCPA's business thresholds. We will reassess the applicable thresholds and the preceding 12 months of practices before launch and at least annually. No advertising sale or sharing is planned.

Children's privacy

The website and direct store are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information online from a child under 13 without legally required parental consent. In Canada, we will also consider whether a young person can provide meaningful consent, taking account of age and maturity.

If you believe a child has provided personal information improperly, contact us so we can investigate and take appropriate action. We do not knowingly sell or share the personal information of people under 16 for cross-context behavioural advertising.

Changes to this policy

We may update this policy when our services, providers, Shopify settings, practices, or legal obligations change. We will post the revised policy and update the last-updated date. Before activating a materially different marketing, analytics, advertising, account, or data-sharing practice, we will provide additional notice, obtain consent, or offer an opt-out where required by law.

Contact, requests and complaints

Use our Support page and select Privacy request to ask a privacy question, withdraw consent, exercise a right, appeal a decision, or make a complaint. No account is required. Please describe your request and your province, territory, or state. Do not send passwords, complete payment-card information, or government identification unless we request a secure verification method.

Privacy ContactArts & Crafts - operated by Anavrin Digital Services Inc.Support page — select “Privacy request”

We will acknowledge the request, verify identity only as reasonably necessary, and normally respond to a Canadian access request within 30 days. If a concern remains unresolved, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial regulator. California residents may also contact the California Privacy Protection Agency.