Privacy Policy

Lêlê's Sweets, Toronto, Ontario, Canada. For anything about your personal information, write to lelesweets.ca@gmail.com. That address reaches the person accountable for it.

When you place an order or ask for a quote:

• Your name, email address and phone number.
• Your delivery address, if you choose delivery.
• What you ordered — box, flavours, presentation, and the date you need it.
• The gift message or card text you write, and the recipient's name if you give one.
• Any allergies or dietary notes you tell us. This is health information and we treat it with more care than the rest: it is used only to make your order safely, and it is never shared beyond that.
• Whether the order has been paid, and by which method.

We never see or store your card number, security code or bank details. Card payments happen on Stripe's own systems and we only receive a yes-or-no result.

• To make your order and deliver it to the right address on the right day.
• To contact you if something about your order needs sorting out.
• To take payment and issue a receipt.
• To keep the sales records the Canada Revenue Agency requires us to keep.

We do not send marketing emails and we do not add you to any mailing list. The only emails you get from us are about an order or a quote you asked for.

We use a handful of services to run the shop. Each one receives only what it needs, and none of them may use it for anything else:

• Stripe — processes card payments. Receives your name and email.
• Supabase — stores the order database.
• Resend — sends order confirmation emails. Receives your email address and order details.
• Google Maps — works out the delivery distance and fee. Receives the delivery address you type, and nothing that identifies you.
• Netlify — hosts the website.
• Google Analytics — anonymous visit statistics. See below.

We do not sell, rent or trade your personal information. We would disclose it only if a Canadian law or court order required us to.

Our database and several of the services above run on servers in the United States. Your information is therefore stored outside Canada and, while it is there, it can be accessed by US authorities under US law — including through orders you would not be told about.

We are telling you this because Canadian privacy law requires it, and because you should be able to decide with the facts in front of you. If you would rather not have your details stored this way, order by WhatsApp instead and we will take it from there.

We use Google Analytics to see how many people visit and which pages they read. It tells us things like "forty people looked at the menu this week" — we cannot tell who you are from it, we do not use it for advertising, and we never combine it with your order.

If you would rather not be counted, you can install Google's opt-out add-on or block cookies for this site. Neither will stop you from ordering.

The site also keeps your basket in your own browser's storage so it survives a refresh. That never leaves your device and we cannot read it.

Order records are kept for six years, because Canadian tax law requires sales records to be kept that long.

Quote requests that never become an order are deleted after twelve months. Gift messages and allergy notes are removed once the order is complete and the record is no longer needed for tax purposes.

Under Canadian privacy law you can, at any time:

• Ask what personal information we hold about you, and get a copy of it.
• Ask us to correct anything that is wrong.
• Ask us to delete it, unless we are legally required to keep it (see above).
• Withdraw your consent, though we may then be unable to complete an order.

Email lelesweets.ca@gmail.com and we will answer within 30 days, free of charge.

If you are not satisfied with how we handled it, you can complain to the Office of the Privacy Commissioner of Canada.

The site runs entirely over HTTPS. The order database cannot be read from a browser at all — every request for customer data goes through a server that checks a password first, and the admin panel is rate-limited against guessing. Card details never touch our systems.

No system is perfect. If a breach ever affected your information in a way that posed a real risk of harm, we would tell you and report it, as the law requires.

The shop is meant for adults. We don't knowingly collect information from anyone under 16. If you believe a child has given us their details, email us and we will delete them.

If we change how we handle your information we will update this page and change the date at the top. Material changes will be flagged at checkout.

See also our Terms of Sale.