Privacy policy.

Our privacy officer is accountable for how we handle your information. Contact [Privacy officer's name] at [privacy@boatbetter.co], or write to us at [Street address], [City, Province Postal code], Canada.

• Account details: your name, email, phone number, saved addresses and password. Passwords are stored as a one-way hash, so we can’t read them.
• Order details: what you bought, your shipping and billing addresses, email, phone number and order history.
• Payment details: handled by Stripe, which holds your card details. We receive a record of the payment and whether it went through.
• Your boat: type, length, outboard horsepower, battery voltage and any name you give it. This is stored in a cookie on your device, not on our servers.
• Searches and assistant questions: what you type, so we can find products and answer you. We don’t keep a history of your assistant conversations on our servers.
• Technical details: your IP address and browser information, used to keep the store secure and to stop abuse such as automated requests. Server logs that include IP addresses are kept for up to 30 days.
• Messages you send us: emails and anything you include in them.
• Marketing preference: whether you’ve agreed to marketing emails. If you have, we also record the date and the wording you saw.

• To process and deliver your orders, and to handle returns and refunds.
• To run your account.
• To show which products suit the boat you’ve added and to answer your questions.
• To prevent fraud and keep the store secure.
• To meet legal duties, such as keeping sales and tax records.
• To send marketing emails, only if you’ve said yes.

We don’t sell your personal information, and we don’t use advertising or analytics trackers.

By using the store and placing orders, you agree to us using your information for the purposes above. Marketing emails need your separate, express consent: the box at sign-up and checkout is never ticked for you. You can withdraw consent at any time, though we may still need some information to complete an order you’ve placed or to keep records the law requires.

We share personal information only with the service providers below, and only what each needs to do its job for us:

We may also disclose information when the law requires it, for example in response to a valid court order.

Our database and files are stored in Montréal, Canada. Some providers above process information in the United States, where it may be accessible to courts and authorities under US law. These providers are bound by contract to protect it and to use it only to provide their service to us. Under its commercial terms, Anthropic does not use the questions sent through our store to train its models.

• Order and payment records: as long as tax law requires, generally six years.
• Your account: until you ask us to close it.
• Server logs: up to 30 days.
• Marketing consent records: for as long as we email you, and for three years after you unsubscribe, as proof of consent.

We only use cookies the store needs to work. There are no advertising or analytics cookies.

• _medusa_cart_id Remembers your cart.
• _medusa_jwt Keeps you signed in.
• _medusa_pending_customer Holds your sign-up details for up to a day while you verify your email.
• _medusa_cache_id Lets the store cache pages for speed. It doesn't identify you.
• _boat_profile Remembers the boat you added, on this device only.

If we add analytics or advertising tools later, we’ll ask for your consent first and update this policy.

You can ask us to:

• show you the personal information we hold about you;
• correct anything that’s wrong;
• delete your information, except what we must keep by law;
• stop sending you marketing emails (every marketing email also has an unsubscribe link);
• give you your information in a common electronic format, where the law provides for it.

Email [privacy@boatbetter.co]. We’ll reply within 30 days. If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Québec, the Commission d’accès à l’information.

Connections to the store are encrypted, the database is encrypted and private to our hosting network, and access is limited to people who need it. If a breach creates a real risk of significant harm to you, we’ll tell you and the regulators as the law requires.

The store isn’t meant for children under 14, and we don’t knowingly collect their information.

When we change this policy, we’ll update the date at the top. If a change affects how we use information you’ve already given us, we’ll tell you first.