Privacy policy
We collect only what we need to make and deliver your cards, and we protect it. This policy follows the Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec’s Act respecting the protection of personal information in the private sector (Law 25).
Last updated: September 2026
Draft pending legal review. This page may change before the store opens.
Who is responsible
Canadian Metal Cards, based in Calgary, Alberta, is responsible for the personal information it holds. Our person in charge of the protection of personal information can be reached at hello@canadianmetalcards.com, with “Privacy” in the subject line.
What we collect
Account details: your name, email address, a protected (hashed) password, your language and your preferences. Your quick-start profile, designs and the logos you upload. Order details: contact email and phone, shipping and billing addresses and what you ordered. The messages you send us.
Payments are handled by Stripe: we receive the payment status and limited details such as the card brand, never your full card number. We also keep technical logs needed for security, and page-speed measurements that do not identify you.
Why we use it
To make, ship and support your orders; to run your account; to answer your messages; to meet our legal and tax obligations; to protect the store against fraud and abuse; and, only if you agree, to send you marketing emails.
Your consent
We ask for your express consent before sending marketing emails; the box is never ticked for you. You can withdraw it at any time with the unsubscribe link in every email or from your account page. Information needed to fulfil your order is used for that purpose.
Service providers
We share information only with providers that help us run the store, under contract and for our purposes only: Stripe (payments), Canada Post (delivery), Amazon Web Services in its Canadian region (hosting and storage) and our email delivery provider. Our pages load typefaces from Google Fonts, which receives your IP address when the fonts load.
Where your information is kept
Our store and its data are hosted in Canada. Some providers, such as Stripe and Google, may process information in the United States or elsewhere, where it is subject to local laws. Before information leaves Québec we assess whether it will be adequately protected, as Law 25 requires.
How long we keep it
Account information is kept while your account is open. Designs and logos are kept until you delete them or your account. Orders and receipts are kept for as long as Canadian tax law requires. When you delete your account, we anonymise your personal information and keep only the order records the law requires.
Your rights
You can ask to access or correct your information, withdraw your consent, or have your information deleted. You can download a copy of your data and delete your account from your account page. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d’accès à l’information.
Cookies and browser storage
We do not use advertising or cross-site tracking cookies. Your browser stores a session token so you stay signed in and your cart is kept. We measure page speed without identifying you.
Security
Information travels encrypted, passwords are stored hashed, and only staff who need it can access your information, with two-step verification. If a confidentiality incident presents a risk of serious injury, we notify the people concerned and the authorities as the law requires.
Children
Our store is not intended for children under 14, and we do not knowingly collect their information.
Changes to this policy
We will post any change on this page with its date, and email account holders about significant changes.