Privacy Policy

1. The law we follow

We are based in Alberta, so we handle personal information under Alberta's Personal Information Protection Act (PIPA). Where we do business across provincial or national borders, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies as well. Our email practices follow Canada's anti-spam legislation (CASL).

2. Who to contact about your privacy

The owner of Pretty Baked is the person accountable for personal information here. Any privacy question, request or complaint comes to us at:

3. What we collect

• Contact details — your name, email address and phone number.
• Order details — what you ordered, flavours, sizes, message on the cake, pickup or delivery date, delivery address where that applies, and any notes you give us.
• What you tell us about allergies and dietary needs, so we can bake safely for you. We treat this as sensitive and only use it for your order.
• Photos and design notes you upload with a custom order or enquiry.
• Account information, if you create an account — your email and a password we never see in readable form.
• Payment information — the amount, the method, and whether it is paid. Card payments go through Stripe; your full card number goes to Stripe, never to us, and we never store it.
• Messages between us — enquiries, emails and notes about your order.
• Reviews you choose to leave, including the name you put on them.
• Basic technical information your browser sends when you visit, such as device and browser type, and error reports when something on the site breaks.
• The approximate town a visit came from, so we know which areas our customers are in. We work this out from your connection when you arrive and keep only the town — we do not store your internet (IP) address.
• Whether an order email we sent you was opened. We use this to tell whether a confirmation actually reached you.

We do not run advertising trackers, we do not build profiles about you, and we never sell your personal information to anyone.

4. Why we have it

• To take, bake, confirm and hand over your order.
• To talk to you about your order and answer your questions.
• To take payment, issue invoices and receipts, and handle refunds.
• To bake safely around allergies you tell us about.
• To keep the business records the Canada Revenue Agency requires us to keep.
• To keep the website working and to fix problems with it.
• To send you promotional email or show a review publicly — but only where you have agreed to it.

We only use your information for these purposes. If we ever want to use it for something new, we will ask you first.

5. Your consent

Placing an order, sending an enquiry or creating an account is you agreeing to us using your information for the purposes above. You can withdraw that consent at any time by contacting us — though if you withdraw it for an order in progress, we may not be able to finish that order.

Marketing email is separate and always opt-in. Every promotional email has an unsubscribe link, and unsubscribing does not affect the emails we send about an order you have placed.

6. Who else sees it

We use a small number of service providers to run the bakery. They only get what they need to do their job, and they are not allowed to use it for anything else:

• Our website and database hosting provider, which stores the orders, enquiries, photos and account records behind this site.
• Stripe, which processes card payments and holds the card details we never see.
• The email service that delivers your confirmations, invoices and receipts.
• A location service (ipwho.is), which is sent the internet address of visitors to this site so we can tell roughly what town they are in. It gets nothing else — no name, no order, no account.

Some of these providers store or process information on servers outside Canada, including in the United States. While it is there, it is subject to the laws of that country, and courts or authorities there may be able to require access to it. We tell you this because Alberta's PIPA requires it.

Beyond that, we only disclose personal information where the law requires it, or where it is needed to establish or defend a legal claim.

7. Cookies and what your browser stores

• If you log in, we store a session in your browser so you stay logged in. Without it, accounts do not work.
• Your shopping cart is kept in your own browser's storage until you check out or clear it. It stays on your device.
• Order emails contain a small invisible image that tells us the email was opened. If you block images in your email program, we learn nothing.
• We count visits to our pages anonymously — a random number stored in your browser, never your name or account — so we can see which pages people enjoy. Owner and staff visits are not counted.
• To work out the rough area a visit came from, your internet (IP) address is checked against a location service (ipwho.is) the moment you arrive. We keep only the town it names — never the address itself — and it is never tied to your name or your orders.
• We do not use advertising or cross-site tracking cookies.

8. How long we keep it

• Order, invoice and payment records: at least six years after the tax year they fall in, because the Canada Revenue Agency requires it.
• Enquiries and quotes that never became orders: up to two years, in case you come back to us.
• Account details: until you ask us to close the account.
• Photos you upload: for as long as the related order or enquiry is kept, unless you ask us to delete them sooner.

When we no longer need something, we delete it or strip your name from it.

9. How we protect it

Access to customer records is limited to the owner and anyone we have specifically given an admin account, each with their own login. Information travels to and from this site encrypted, and our hosting and payment providers maintain their own security controls.

No system is perfect. If a breach ever creates a real risk of significant harm to you, we will notify Alberta's Information and Privacy Commissioner and let you know, as PIPA requires.

10. Your rights

• Ask for a copy of the personal information we hold about you, and what we have used it for.
• Ask us to correct anything that is wrong.
• Withdraw your consent, subject to legal and contractual limits.
• Ask us to delete information we no longer need to keep.
• Complain to us, and to the regulator, if you are not happy with how we handled it.

Write to us using the details in section 2. We may need to confirm who you are before we release anything. We will respond within 45 days, as PIPA requires, and a copy of your own information is normally free.

11. Children

This site is meant for adults. We do not knowingly collect personal information from children. If a child has given us information, contact us and we will delete it.

12. If you are not satisfied

Please come to us first — most things are fixed with a message. If you are still not satisfied, you can complain to:

• the Office of the Information and Privacy Commissioner of Alberta, at oipc.ab.ca; or
• the Office of the Privacy Commissioner of Canada, at priv.gc.ca.

13. Changes to this policy

We will update this page when our practices change, and the date at the top will tell you when that last happened. Our terms of sale and use cover ordering, deposits and cancellations.