What personal information TiffinGrab collects, why, who sees it, how long we keep it, and how to exercise your rights under PIPEDA.
Updated October 7, 2026 · TiffinGrab, Ontario, Canada
You pay by Interac e-Transfer. We may keep the amount, the transfer reference, and a screenshot you upload so staff can confirm the payment. We do not store your banking login or full account number on our servers.
Card payments through Stripe are coming later. When they are available, card data will be processed by Stripe. We will not store full card numbers or CVV on our servers.
We may collect IP address, browser, device, pages viewed, and timing via cookies and server logs.
We use personal data to:
Marketing: Promotional messages only if you opt in. Unsubscribe anytime (link or reply instructions). We do not send unsolicited marketing without consent.
We share data only as needed:
Processors and partners are bound to confidentiality and purpose limitation.
We use reasonable technical and organizational measures, including TLS in transit and access controls on a need-to-know basis. When card payments through Stripe are added, card data will be handled by Stripe. No online system is perfectly secure; we will notify you of breaches as required by law.
We keep data while your account is active and up to three years after your last transaction where needed for accounting, tax, and disputes. Communications tied to complaints may be kept up to five years. After that, data is deleted or anonymized where permitted.
You may request access, correction, deletion (subject to legal holds), and withdrawal of consent for non-essential uses. You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Email info@tiffingrab.ca with subject “Privacy Request”. We aim to respond within 30 days.
We use essential cookies for site operation, and may use analytics cookies in line with our configuration. You can control cookies in your browser; disabling some may affect functionality.
Our services are not directed to children under 18. If you believe a minor submitted personal data, contact us and we will delete it promptly where appropriate.
