Privacy Policy

1. Who is responsible

Drip & Bake is operated by Drip & Bake Inc., a corporation formed in Ontario, Canada ("Drip & Bake", "we", "us"). Drip & Bake Inc. is the organization responsible for the personal information described in this policy. Privacy questions, access requests and complaints may be directed to support@dripandbake.com.

2. Our different privacy roles

Drip & Bake can handle information in different roles.

For merchant-account, billing, platform-security, support, product-analytics and direct Drip & Bake communications, Drip & Bake determines why and how information is used.

For many storefront activities, the merchant determines the customer relationship and uses Drip & Bake as the software platform through which customer information is collected and processed. Merchants remain responsible for their own customer-facing privacy obligations and lawful use of customer data.

3. Information we may collect

Depending on how the Service is used, information may include:

• merchant and staff names, email addresses, account credentials, roles and workspace membership;
• business names, locations, contact information, branding and operational settings;
• storefront customer names, email addresses, telephone numbers and account information;
• order, product, pickup, fulfillment, loyalty and subscription information;
• communication preferences and consent/unsubscribe records;
• support requests and communications with Drip & Bake;
• subscription, billing and transaction metadata, while payment-card details may be handled directly by connected payment processors;
• device, browser, approximate location, page-view and technical information used for security, reliability and analytics;
• if staff use the Drip & Bake Service app for iOS and allow notifications, the device's Apple push notification token, together with the staff account and shop it is signed in to, used only to deliver order and operational alerts;
• audit, authentication and operational logs necessary to operate and protect the Service.

4. Why we use information

We may use information to create and secure accounts; provision workspaces; provide storefronts and ordering; route and fulfill orders; provide loyalty and subscription features; send requested transactional communications; administer merchant subscriptions; provide support; detect fraud and abuse; troubleshoot and improve the Service; maintain audit and security records; comply with law; and communicate with merchants about Drip & Bake products where legally permitted.

We may use aggregated or de-identified statistics, such as the number of merchants using Drip & Bake, to understand and describe the growth and performance of the platform. We do not sell personal information.

5. Merchant communications to customers

Merchants may use Drip & Bake tools to send customer communications. Merchants are responsible for establishing the lawful basis and obtaining any consent required for their campaigns. Drip & Bake may provide technical tools for consent records, preferences and unsubscribe requests. Transactional messages related to an order or account may be treated differently from promotional marketing under applicable law.

6. How information may be disclosed

Information may be disclosed to service providers that help us operate Drip & Bake, such as cloud hosting, databases, payment infrastructure, communications delivery, analytics, security and customer-support providers; to a merchant and its authorized workspace users where necessary to operate that merchant's business; where required by law or valid legal process; to protect the security, rights and safety of Drip & Bake, merchants, customers or others; or in connection with a legitimate corporate transaction subject to appropriate protections.

We require service providers to handle information for legitimate service purposes and expect appropriate privacy and security safeguards.

7. Payment information

Merchant subscriptions and merchant customer payments may involve third-party payment processors. Those processors may collect payment credentials directly and process them under their own privacy policies and agreements. Drip & Bake should avoid storing full payment-card credentials where the connected processor can handle them directly.

8. International processing

Drip & Bake is based in Ontario, Canada but is intended to be available internationally and may use service providers in other countries. Information may therefore be processed or stored outside the user's province or country and may be subject to lawful access by authorities in those jurisdictions. Appropriate contractual and technical safeguards should be maintained where required.

9. Retention

We retain personal information only as long as reasonably necessary for the purposes described, including security, legal, accounting and fraud-prevention needs. Following merchant cancellation, Drip & Bake intends to provide a 5-day retention/grace period and then a deletion window of up to 30 days for eligible workspace data. Some records may be retained longer where law, security, backups, dispute resolution or accounting obligations require it. Merchant workspaces that are not being used may also be deleted after notice to their owner, as described in the Merchant Terms; records the law requires us to keep, such as tax records, are retained for their retention period.

10. Security

We use administrative, technical and organizational safeguards appropriate to the nature of the information, including account access controls, role-based permissions, tenant isolation, secure hosting and other platform-security measures. No online service can guarantee absolute security. Users should protect credentials and promptly report suspected unauthorized access.

11. Access, correction and deletion

Subject to applicable law, individuals may request access to personal information held about them, request correction of inaccurate information, withdraw consent where consent is the applicable basis, or request deletion where legally available. Storefront customers may sometimes need to direct requests to the merchant that controls their customer relationship. Drip & Bake will assist merchants where appropriate to respond to valid requests involving platform data.

Requests may be sent to support@dripandbake.com. Identity verification may be required before fulfilling a request.

12. Analytics

Drip & Bake measures visits to its own website with analytics it built and operates itself. No third-party analytics service receives visitor data, no cookie is set for this purpose and nothing is stored in a visitor's browser. For each visit we record the page viewed, from a fixed list of our own public pages; the hostname of the website that referred the visitor; any campaign tags on the link they followed; the country and region inferred from their connection; and the general type of device, browser and operating system. We do not record full web addresses, IP addresses or browser identification strings.

To count visitors without identifying them, the visitor's IP address and browser type are combined with a random value that is replaced every day and then deleted. The resulting code cannot be traced back to a person and does not link one day's visit to another's. The IP address itself is not stored.

When a merchant account is created, we record how that account found us: the campaign or referring website, and the first page visited that day. This is kept with the account and separately from the visit records, which do not identify who signed up.

Visits to merchant storefronts are counted in the same way, on behalf of each merchant. For a storefront visit we record the page viewed, from a fixed list of storefront pages (for example the menu or the checkout, never the web address); the hostname of the website that referred the visitor; any campaign tags on the link they followed; whether the storefront was opened from an app saved to the home screen; and the general type of device, browser and operating system. We do not record a storefront visitor's country or region, their IP address or their identity, and a visit is not linked to a customer account.

When a storefront visitor places an order, the visit is marked as having led to an order. The order's identifier is kept separately from the visit, for about a day, only so that the same order is not counted twice. Each merchant can see the totals for its own storefront and for no other merchant's. Drip & Bake can see each storefront's totals in order to operate and improve the platform. Individual storefront visit records are deleted after 400 days; daily totals are kept.

Separately, we record which parts of the product signed-in merchants and staff open and use, by workspace and account, so that we can improve it. This records the feature used and when, not the content of what was done.

13. Children's privacy

Merchant and staff accounts are intended for adults and authorized business users. Drip & Bake is not designed as a service directed to children. Merchants using storefronts remain responsible for complying with laws applicable to their own customer audience and products.

14. Changes

We may update this Privacy Policy as the Service, providers or legal requirements change. Material changes will be communicated through reasonable means where required.

15. Contact and privacy accountability

Drip & Bake Inc. has designated a Privacy Officer, who is accountable for our compliance with this Privacy Policy and applicable privacy law. Privacy inquiries, requests to access or correct personal information, and complaints can be sent to the Privacy Officer at support@dripandbake.com, with “Privacy” in the subject line, or by mail to: Privacy Officer, Drip & Bake Inc., 300 Sheppard Ave W, Unit 101-17, Toronto, Ontario M2N 1N5, Canada.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.