Short version
We collect what we need to make and deliver your order, nothing more. We don't sell or rent your information, we don't run ad trackers, and card numbers never touch our servers.
Who we are
GAWD! YUMM ("GAWD! YUMM") makes and sells protein foods from Kingston, ON. Our privacy officer is the owner — reach them at orders@gawdyumm.ca about anything on this page.
What we collect and why
Account & orders: name, email, phone, delivery address, what you ordered, and notes you add (like allergies or a gate code) — to make, deliver and support your order and keep required tax records.
Subscriptions: your schedule and a payment token from our processor (not your card number) — to charge renewals you've agreed to.
Custom orders: what you tell us on the form — to reply and quote.
Flavor Drop votes: a random ID in a cookie so each person votes fairly.
Marketing email: only if you tick the box. We record when and where you agreed.
Payments
Cards are entered directly into our payment processor's secure form (Helcim or Square, both PCI-DSS compliant). They send us a confirmation and a token for renewals. We never see or store full card numbers.
Cookies
We only use cookies the site needs to work: your login session, your bag, and the voting ID. No advertising or cross-site tracking cookies. If we ever add analytics, it will be privacy-friendly and off until you allow it.
Where your information is stored
Our website and database are hosted by Hostinger in the United States (Hostinger data centre). Payment data is held by our processor (Helcim is Canadian; Square Canada processes through its own systems). Information stored outside Canada may be subject to the laws of that country. We choose providers that contractually protect it.
Who we share it with
Only the service providers needed to run the shop — web hosting, payment processing and email delivery — and only what they need. We'll also disclose information if the law requires it. We never sell it.
How long we keep it
Order and payment records: 6 years, because the Canada Revenue Agency requires it. Closed custom-order requests: 2 years. Security logs: 48 hours. If you delete your account, we remove your personal details and keep only the anonymous sale records.
Your rights
You can see, download, correct or delete your information at any time from your account page, or by emailing orders@gawdyumm.ca. You can withdraw marketing consent with one click (every marketing email has an unsubscribe link). We answer requests within 30 days. If you're not satisfied, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), or the Commission d'accès à l'information if you live in Quebec.
Security
Encrypted connections (HTTPS) everywhere, hashed passwords, two-step login for staff, limited staff access, and regular backups. If a breach ever creates a real risk of significant harm to you, we'll tell you and the Privacy Commissioner as the law requires.
Kids
Our shop is meant for adults. We don't knowingly collect information from children under 13.
Changes
If we change this policy in a meaningful way we'll update the date above and, for big changes, email account holders.