Your privacy, respected.

We collect only what we need to run the shop and fulfill your orders:

• Account details — your name, email address, and a password you create (passwords are handled by Google Firebase Authentication; we never see or store your plaintext password).
• Order & shipping details — items ordered, shipping address, phone number (if provided), order history, and order status.
• Payment information — processed directly by Stripe. We do not collect or store your full card number, CVC, or expiry; we receive only a payment confirmation and limited details (e.g., the last few digits and card brand) needed to manage the order.
• Communications — messages you send us (e.g., via the contact form, email, or the “Ask Lola” chat) and newsletter sign-ups.
• Information collected automatically — device and usage data such as IP address, browser type, pages viewed, and referring links, gathered through analytics and security tools (see “Cookies & similar technologies”).

We use personal information to:

• process, fulfill, and deliver your orders, and send order confirmations and shipping updates;
• create and manage your account and let you view your order history;
• respond to your questions and provide customer support;
• send the newsletter and offers you have asked to receive (you can opt out at any time);
• protect the site against fraud and abuse (via reCAPTCHA Enterprise and Firebase App Check);
• understand and improve how the site is used; and
• meet legal, tax, and accounting obligations.

We use cookies and similar browser storage to make the site work and to understand usage:

• Essential — keep you signed in, remember your cart, and secure requests. The site cannot function without these.
• Analytics — Firebase Analytics (Google Analytics 4) helps us see which products and pages are popular so we can improve the store.
• Security — Google reCAPTCHA Enterprise and Firebase App Check verify that requests come from a real browser, not bots. Their use is subject to Google's Privacy Policy and Terms.

You can block or delete cookies in your browser settings, but parts of the site (such as cart and checkout) may not work properly without the essential ones.

We do not sell your personal information. We share it only with service providers who help us operate the store, and only as needed to provide their service:

• Stripe — payment processing.
• Google / Firebase — hosting, authentication, database, analytics, and security (reCAPTCHA / App Check).
• SMTP2GO — sending transactional emails such as order confirmations.
• Shipping carriers — to deliver your order.

We may also disclose information when required by law, to enforce our Terms, to protect our rights or the safety of others, or in connection with a business transfer (such as a merger or acquisition). Some of these providers operate outside Canada (see “Where your information is processed”).

Our infrastructure runs on Google Cloud / Firebase and our other providers may process data in the United States and other countries. Where information is transferred outside Canada, it may be subject to the laws of those jurisdictions, including lawful access by their authorities. We use reputable providers that maintain appropriate safeguards.

We keep personal information only as long as needed for the purposes above — for example, order and transaction records are retained as long as required for accounting and tax law, and account information is kept while your account is active. You can ask us to delete your account; we may retain limited records where the law requires.

We use industry-standard safeguards: encryption in transit (HTTPS), access controls, a strict Content Security Policy, bot protection, and reputable processors. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify you and the appropriate authorities if a breach poses a real risk of significant harm, as required by law.

Subject to applicable law, you can:

• access the personal information we hold about you and ask for a copy;
• correct information that is inaccurate or incomplete;
• ask us to delete your account and associated information;
• withdraw consent or opt out of marketing emails (use the unsubscribe link or contact us); and
• ask how your information is handled.

To exercise any of these, email us at privacy@masayagourmet.com or use our Contact page. We may need to verify your identity first. If you are in Canada and have an unresolved concern, you may contact the Office of the Privacy Commissioner of Canada. Residents of Quebec, the EU/UK, and certain U.S. states may have additional rights under their local laws, which we honour where they apply.

The store is intended for adults. We do not knowingly collect personal information from children under the age of majority in their province or state. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, take reasonable steps to let you know. Your continued use of the site after an update means you accept the revised policy.

Questions about this policy or your personal information? Email privacy@masayagourmet.com or reach us through our Contact page. Masaya Gourmet, Toronto, Ontario, Canada.