Privacy Policy

Aerial Design Co. (Ottawa, Ontario, Canada) is responsible for the personal information described here. The owner of the business is accountable for our privacy practices and answers privacy questions directly at support@aerialdesign.org.

• When you check out: your name, email, shipping address (including apartment/unit and province or state), what you're buying, and the shipping option you choose. We also record when you agreed to our Terms and which version.
• Before you pay: when you continue from our checkout page to payment, we save your email, name and the contents of your bag, so that if you don't finish we can send you one reminder.
• Payment: handled entirely by Stripe. We never see or store your full card number; we receive a payment confirmation and the details you entered on Stripe's page.
• Gift cards: if you buy one for someone else, their name and email and your optional message, used only to deliver the card. We store a scrambled (hashed) form of each gift card code, not the code itself, along with its balance and where it was spent.
• Discount codes: if an offer is limited to one use per person, a scrambled (hashed) form of your email so we can tell whether it's been used.
• Newsletter: your email address, only if you subscribe.
• Reviews: the name and review you post, which are shown publicly.
• Order tracking: the order number and email you enter, used only to look up your order.
• Abuse protection: your IP address, held for a few minutes to limit how often forms like checkout and reviews can be submitted, then discarded.

To process, ship and support your orders; to email you about them; to send the newsletter if you signed up; to send one reminder about an unfinished checkout; to show reviews; and to keep the site secure.

We don't use your information for advertising, we don't build profiles, and we don't sell or rent it to anyone.

We rely on your consent, given when you order or subscribe, and you can withdraw it at any time (it may mean we can't complete an order you haven't paid for yet). If you're in the EU or UK, our legal bases are: performing our contract with you (orders), your consent (the newsletter), and our legitimate interest in recovering a checkout you started and in keeping the site secure.

We share information only with the services that run the store, and only what each one needs:

• Stripe — payment processing.
• Google Firebase — our database of orders and products, and admin sign-in.
• Cloudflare — hosts the website, protects it from abuse, and counts visits (Cloudflare Web Analytics).
• Resend — delivers our emails.
• Printify and its print providers — receive your name, shipping address and email for orders that include prints, to produce and deliver them.
• Shipping carriers — receive your name and address to deliver your order.

We'd also disclose information if the law required it. Cloudinary hosts our product photos but receives no customer information.

Some of these services store or process data outside Canada, mainly in the United States, where it may be accessible to authorities under local law. Each has its own safeguards for international transfers (such as the EU Standard Contractual Clauses), and we choose services with strong security practices.

• Order records: six years, which Canadian tax law requires us to keep business records for.
• Unfinished-checkout records: deleted automatically after 90 days, or sooner on request.
• Newsletter: until you unsubscribe.
• Reviews: until you ask us to remove yours.

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct anything that's wrong;
• delete it, except what we're legally required to keep (like order records for tax);
• stop using it for anything based on consent, like the newsletter.

Email support@aerialdesign.org and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, in the EU or UK, to your local data protection authority.

We don't use tracking, analytics or advertising cookies. Your bag, saved items and recently viewed products are stored in your own browser (local storage), not on our servers — clearing your browser data clears them.

Your browser also remembers, for up to 30 days, how you first found us (for example a link from our TikTok or Instagram, or a Google search) and the page you landed on. It's only sent to us if you place an order, and is saved with that order so we know which of our posts are worth making. It isn't shared with those sites.

To see how many people visit and which pages they read, we use Cloudflare Web Analytics. It sets no cookies, doesn't fingerprint your device, and doesn't follow you to other sites; we only ever see totals, never individual visitors.

Stripe (on the payment page) and Firebase (for admin sign-in) may set cookies they need to work. They aren't used to track you across other sites.

The site is served only over encrypted connections, card payments never touch our servers, and access to order data is restricted to the store's administrator. No system is perfectly secure; if a breach ever put your information at real risk, we'd tell you and report it as the law requires.

The store isn't aimed at children, and we don't knowingly collect information from anyone under 13.

If this policy changes, we'll update the date at the top. Significant changes will be highlighted on this page.