Privacy Policy

1. The short version

• We collect what we need to run the marketplace and fulfil your order — nothing more.
• We don’t sell personal information to anyone.
• Payments go through Stripe; we never see your full card number.
• Stores see what they need to ship to you (name, shipping address, order contents). They don’t see your payment method.
• You can ask for a copy of your data, or its deletion, at any time — contact us.

2. What we collect, and why

From all visitors (no account needed). Standard request logs to operate the site and detect abuse: IP address, browser user-agent, the page you requested, and a timestamp. Stored for up to 30 days, then aggregated or deleted.

When you place an order. Email, billing name, shipping address (if the Store ships physical goods), and a Stripe customer/session reference. We keep order records as long as needed for tax, accounting, and customer-service purposes (typically 7 years to comply with Canadian tax law).

When you apply to sell. Your name, email, store name, the wing you picked, your written pitch, and any optional link you provided. We keep applications for review and for the operating life of your Store; rejected applications are deleted after 12 months.

Cookies and storage. Offplanet Shop currently uses:

• Local storage in your browser to remember your cart (cleared by you, or when you wipe the site’s data). Not sent to our server unless you check out.
• Stripe’s cookies, set on its own checkout page (we don’t set them).

No third-party analytics, ad networks, or tracking pixels.

3. Who we share data with

• The Store you bought from, with the information they need to fulfil your order: name, email, shipping address (if applicable), and the items you bought. They are responsible for their own use of that information; their privacy notice applies to anything they do beyond fulfilling your order.
• Stripe Inc. / Stripe Payments Canada processes payments. Stripe’s privacy policy is at stripe.com/privacy.
• Hosting and infrastructure providers who operate the servers and content delivery network we run the site on. They process data on our instructions only.
• Law enforcement or courts if we receive a lawful order. We push back on overbroad requests where we can.

We do not sell personal information. We do not share it with advertisers.

4. Email and communications

We send transactional email only — order confirmations, shipping notifications, account or security notices, and replies to messages you send us. There is no marketing list to subscribe to or unsubscribe from. Sellers receive additional operational email about their Store; that is also transactional under Canadian anti-spam law (CASL).

5. Where data lives

Application data is stored on servers operated for Offplanet, currently located in Asia-Pacific. Stripe processes payment data in its own infrastructure. By using the site, you understand that your information may be transferred to and processed in countries other than the one you live in, including countries whose data-protection laws may differ from yours. We use contractual and technical safeguards to protect your data wherever it’s processed.

6. How we protect data

Transport is encrypted with TLS. Access to production data is limited to people who need it to operate the marketplace, using individual credentials and two-factor authentication where supported. We do not store payment card numbers ourselves; Stripe does, under PCI-DSS compliance.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant privacy authorities as required by law (in Canada, the Personal Information Protection and Electronic Documents Act — PIPEDA — and any applicable provincial laws).

7. Your rights

You can ask us to:

• Tell you what personal information we hold about you.
• Correct information that is wrong.
• Delete information we no longer need to keep (note that we may need to retain order records to comply with tax law).
• Export your data in a portable format.

Email privacy@offplanet.ca or use the contact page. We reply within 30 days. If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada or, if you live elsewhere, your local data-protection authority.

8. Children

Offplanet Shop is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please tell us and we’ll delete it.

9. Changes to this Policy

We may update this Policy. Material changes will be announced on this page and the “Last updated” date above will be bumped. We don’t make material changes retroactive to data we already collected — old data is handled under the Policy that applied when it was collected.

10. Contact

The address for privacy questions and rights requests is privacy@offplanet.ca. For everything else, see Contact.