Legal
Privacy Policy
Effective Date: May 31, 2026 • Last updated: May 31, 2026
1. Who We Are
This Privacy Policy applies to the website alcarte.ca, operated by À La Carte by Josée (“we,” “us,” or “our”), a small handmade craft business based in Ontario, Canada.
If you have questions about this policy, please contact us at contact@alcarte.ca.
2. What Personal Information We Collect
We collect only what you provide directly to us:
Contact Form
Name, email address, and your message.
Custom Order Form
Name, email address, phone number (if provided), and details about your requested order. The exact fields may vary depending on how the form is configured.
Checkout / Order Placement
Name, email address, phone number, shipping address (if ordering for delivery), and optional order notes. Card payment details are entered directly into Stripe’s secure form — we never receive, store, or have access to your card number, CVV, or expiry date.
Automatically collected data: Our hosting provider (Cloudflare) automatically collects standard server log information such as your IP address, browser type, pages visited, and the date and time of requests. This is handled by Cloudflare’s infrastructure and is governed by Cloudflare’s Privacy Policy. We do not run any first-party analytics or tracking scripts.
3. Why We Collect Your Information
We collect personal information for the following purposes:
- ✓ To respond to your inquiries and messages.
- ✓ To process and fulfill your orders.
- ✓ To send you order confirmation and status updates.
- ✓ To coordinate custom orders, quotes, and pickup arrangements.
- ✓ To protect our website from spam and abuse (via Cloudflare Turnstile).
We do not use your information for advertising profiling, automated decision-making, or any purpose beyond what is listed above.
4. How We Use Your Information
Your information is used only to fulfill the purpose for which it was provided. We communicate with you by email to confirm orders, follow up on custom requests, or respond to your messages. We do not send unsolicited marketing emails.
We do not sell, rent, or trade your personal information to any third party.
5. When We May Share Your Information
We share your information only in the following limited circumstances:
Stripe (Payment Processing)
When you pay by card, your payment details are submitted directly to Stripe. Stripe is a PCI-DSS-compliant payment processor. We share your name, email, and order total with Stripe to create a payment record. Stripe’s use of your data is governed by the Stripe Privacy Policy.
Cloudflare (Hosting & Bot Protection)
Our website is hosted on Cloudflare Pages and uses Cloudflare Turnstile for spam prevention. Cloudflare processes network traffic and may process your IP address and browser fingerprint. See the Cloudflare Privacy Policy.
Email Service
We use an email service to receive and send order confirmations and inquiry responses. Your name and email address may pass through this service in the course of sending email. [Email provider name and link to their privacy policy, if known.]
Legal Requirements
We may disclose your information if required by law, regulation, court order, or to protect the rights, property, or safety of our business or others.
6. How Long We Keep Your Information
We retain customer order information for as long as reasonably necessary to fulfill orders, handle questions or disputes, and meet applicable record-keeping obligations. Contact form submissions are kept for the period needed to resolve your inquiry.
You may request deletion of your information at any time by contacting us (see Section 8). We will honor deletion requests unless we are required to retain information by law.
7. How We Protect Your Information
We take reasonable steps to protect your personal information, including:
- ✓ All data transmission between your browser and our servers uses HTTPS encryption.
- ✓ Payment card details are handled entirely by Stripe and never transmitted to or stored on our servers.
- ✓ Our website and API run on Cloudflare's infrastructure, which includes DDoS protection, Web Application Firewall (WAF), and bot mitigation.
- ✓ Forms include bot and spam protection via Cloudflare Turnstile.
No method of electronic transmission or storage is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security of your information.
Note: We do not claim compliance with HIPAA, GDPR, CCPA, SOC 2, or any other specific regulatory framework unless formally certified or legally required.
8. Your Rights & Choices
You may contact us at any time to:
- › Request a copy of the personal information we hold about you.
- › Request correction of inaccurate or incomplete information.
- › Request deletion of your personal information.
- › Ask questions about how your information is used.
We will respond to your request within a reasonable time. We may need to verify your identity before fulfilling certain requests.
9. Children’s Privacy
Our website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of the website after changes are posted constitutes your acceptance of the updated policy.
11. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:
See also: Terms of Service