Privacy policy

Catch153 operates this store and is responsible for the personal information described here. You can reach us about anything on this page at orders@catch153.ca.

Only what an order actually requires:

• Your account — name, email address and phone number.
• Delivery addresses — recipient name and phone, street and unit, city, province, postal code, and any delivery instruction or landmark you add. You can save more than one.
• Orders — the items and quantities you bought, what they cost, the delivery area, and the status history of the order.
• Email preferences — whether you have opted in to marketing email, when that choice was made or changed, and whether you have opted out of order notifications.

We do not collect payment card details, and we could not store them if we wanted to — see Payments below.

• To take payment for an order and deliver it to the right address.
• To email you about an order — confirmation, dispatch, a delivery problem.
• To show you your order history and let you reorder.
• To work out whether we deliver to your postal code.
• To keep the accounting and tax records Canadian law requires us to keep.
• To send you marketing email, but only if you have expressly opted in.

We do not sell your personal information, and we do not share it for anyone else's advertising.

Sign-in is handled by Amazon Cognito. Your password is set and checked there, never by this store — we do not receive it and cannot read it.

If you sign in with Google, Google tells us your name, email address and profile picture, and nothing else. We never see your Google password, and we have no access to your Gmail, Drive, contacts or any other Google service. You can disconnect Catch153 at any time from your Google account permissions page.

If you already had an account with the same email address, signing in with Google joins you to that existing account rather than creating a second one, so your order history follows you.

Card payments are processed by Stripe. Your card number is sent from your browser directly to Stripe and never passes through or rests on our servers. We receive only the result of the payment and the last few digits of the card, which is what appears on your order.

Stripe handles that information under its own privacy policy.

When you type into the address field, what you type is sent to Google Places to fetch suggestions, so you can pick your address instead of typing it in full. The request goes through our server rather than from your browser, and it carries no name, email or account identifier — only the partial address text.

Order email — confirmations and delivery updates are part of the service, and we send them because you placed an order.

Marketing email — sent only if you have expressly opted in. The box is never pre-ticked, we record when consent was given or withdrawn, and every marketing message carries an unsubscribe link. That link works without signing in, at your email preferences. This is how Canada's anti-spam legislation (CASL) expects it to work, and how we do it.

Service providers who make the store work, and no one else:

• Amazon Web Services — hosting, the database, and sign-in through Amazon Cognito.
• Stripe — payment processing.
• Amazon SES — sending the email described above.
• Google — sign-in, if you choose it, and address suggestions.

Beyond these, we disclose personal information only where the law requires it.

Our servers, database and user accounts are hosted in Amazon's Canadian region (ca-central-1), so day-to-day your information stays in Canada. Stripe and Google are global services and may process information outside Canada under their own policies.

Orders, and the copy of the delivery address taken when the order was placed, are kept for as long as tax and accounting rules require. That snapshot is why deleting an old address does not rewrite an old invoice: saved addresses are archived rather than erased, so past orders still show where they actually went.

Account details are kept while your account is open. Ask us to close it and we will remove what we are not obliged to retain.

Under Canada's PIPEDA you may ask us to show you the personal information we hold about you, correct anything wrong, delete what we are not required to keep, or withdraw a consent you previously gave.

Most of it you can do yourself: your name, phone number and addresses are editable in your account, and email choices on your email preferences page. For anything else, email orders@catch153.ca and we will respond within 30 days.

We use browser storage to keep you signed in and to complete the sign-in handshake securely. There are no advertising cookies and no third-party tracking pixels on this site. Your basket is saved to your account on our server, not to a cookie, which is why it survives moving to another device.

This store is meant for adults placing grocery orders. We do not knowingly collect personal information from children.

If we change how we handle personal information we will update this page and move the date at the top. Material changes will also be emailed to customers with an active account.

Questions, corrections, or a complaint about privacy: orders@catch153.ca. If you are not satisfied with our answer you can raise it with the Office of the Privacy Commissioner of Canada.