Privacy policy

We collect information in three ways: you give it to us, the site records it as you use it, or a partner passes it back to us about your order.

Identity and contact

Your name, email address, phone number and delivery address, given when you order, request swatches, apply to the trade programme or write to us.

Order history

What you bought, when, at what price, how it was delivered and any returns, claims or warranty work on it.

Payment

Card and pay-over-time payments are made on our payment processor’s page, so we never see or store your full card number. When Stripe processes a payment for an order, the application receives and stores the verified payment event, including payment identifiers and the customer and order metadata contained in that event.

Site use

The information you submit in forms and searches, and the cart, saved items and draft details described below. The page URL determines the language. Server request and error logs support site operation; this application does not install an optional analytics cookie.

Delivery and building details

Measurements and access notes — door width, stairs and elevator — given so we can check that a piece will fit and the carrier can deliver it.

Financing

If you choose to pay over time at checkout, the instalment provider you pick collects your application directly, under its own privacy policy. We receive the outcome of the payment, not your application.

Quote emails

When we email you a quote, a small image in the email tells us whether it was opened, and the quote page records when it is viewed, so we can follow up. No cookie is set for this.

Order and marketing email activity

For order updates, cart reminders, review requests, back-in-stock alerts and the newsletter welcome, a small image tells us whether the email was opened, and a link you click comes back through our own site first, so we know it was followed — clicks are much more reliable than opens; security scanners in some mail systems can also click links. Clicking sets a cookie (loftyn_act) that links a visit back to that email for up to 30 days — unless your browser sends Global Privacy Control, in which case the cookie is never set. We keep this for 12 months, and we never track it at all for an address we know is in Québec.

We do not collect information from children, and we do not buy information about you from data brokers.

Every use falls under one of these purposes, and we do not use information for a new purpose without telling you first:

• To take, confirm, build, deliver and support your order, including returns and warranty claims.
• To answer your questions and keep a record of what we told you.
• To send order emails, which you cannot opt out of while an order is open, and marketing emails, which you can stop at any time with the link in each one.
• To keep the site working, secure and fast, and to understand which pages help shoppers decide.
• To meet legal obligations: tax records, consumer protection, product safety and responding to lawful requests.

We do not sell your information, we do not rent our mailing list, and we do not make decisions about you by automated means alone.

Your information is seen by the Loftyn staff who need it to do their job, and by the service providers below, each under a contract that limits what they can do with it:

• Carriers, who receive your name, address, phone number and access notes for a delivery.
• Suppliers, who receive the order number, the piece and, when they ship it to you directly, your delivery details.
• Our payment processor and email provider, as needed to process payments and send emails.
• Our hosting providers, whose servers may be outside Canada, meaning your information can be subject to the laws of those countries while it is there.
• Auditors, lawyers and public authorities when the law requires it.

If you create an account, we keep your email address, the name and phone number you give us, the pieces you save, and when you last signed in. You sign in with a one-time link or code we email you; we never ask for a password. A cookie keeps you signed in for up to 30 days on that device. You can delete your account at any time from Account → Details; your orders, quotes and invoices stay with us because tax law requires it.

The application uses the cookies below for requested shopping functions, customer sign-in and staff authentication. English or French is selected through the page URL, not a language cookie. This application does not install an analytics cookie or present an analytics consent choice.

Cart, saved-item and quote-draft cookies are signed, not encrypted. Their contents can be read from browser cookie storage. HttpOnly prevents page JavaScript from reading them.

We keep information for as long as the purpose it was collected for requires, and then delete or anonymise it. The main periods are:

Under PIPEDA and Québec’s Law 25, you can ask us at any time to:

• See the personal information we hold about you and how it has been used, in a portable format if you want it.
• Correct anything that is inaccurate or incomplete.
• Withdraw consent to marketing or any other optional use.
• Delete your information, except what we must keep by law, such as invoices, which we then keep only for that purpose.
• Know which service providers outside Canada have held your information.

We answer within 30 days, at no charge, and we may ask you to confirm your identity before we release anything. If we refuse a request, we tell you why and how to challenge it.

Our privacy officer is reachable at hello@loftyn.ca with “Privacy” in the subject line.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Québec, to the Commission d’accès à l’information.