Your information, handled plainly.

What we collect, and why

To take an order we need the basics: your name, email, delivery or pickup details, and what you bought. To take a payment we hand card entry to Square — the full card number never touches our systems. If you subscribe, Square keeps your card on file so we can charge each renewal; you can remove it any time. That is the whole of it — we do not sell your information, and we do not collect it to build a profile of you.

The services that help us run the store

A small farm store leans on a few trusted providers. Each one receives only what it needs to do its job, and nothing more:

• Square

  Payments & card-on-file for subscriptions

  Card details (tokenized — we never see or store the full number), amount, and the email/name on the order.

• Flagship

  Shipping labels & delivery

  The delivery name, address, and phone number needed to get a box to your door.

• Klaviyo

  Order emails & (opt-in) updates

  Email, name, and order events. Marketing emails are sent only with your CASL consent; order confirmations are transactional.

• Anthropic

  The “Ask the farm” assistant

  The text of your question and the earlier turns of the same conversation. We do not send your account or order identity with it.

• OpenAI

  Search and safety checks behind the assistant

  The text of your question, turned into a numerical search vector to find the right passage in our own farm knowledge base, and screened for abuse before the assistant answers. No account or order identity travels with it.

• Cloudflare Turnstile

  Bot check on the assistant

  A short, usually invisible check that the question comes from a real visitor, not an automated script. It runs only when you open the assistant and sees none of what you type. Cloudflare publishes a Turnstile Privacy Addendum describing exactly what it processes.

Where these providers offer Canadian or regional data handling, we use it. We keep this list current as the store changes.

Analytics & cookies

Analytics are off by default. When you first visit, nothing that tracks you loads — no analytics cookie is set and no data is sent — until you choose “Accept” on the cookie banner. Choose “Decline” and nothing loads at all. You can clear your choice from your browser to be asked again. The only cookies set before you decide are the ones strictly needed to keep your cart and session working.

The assistant also runs a Cloudflare Turnstile bot check when you open it — a security step, not analytics, which is why it is not behind the cookie choice.

Your rights

We handle personal information in line with Canada’s PIPEDA, and we send marketing email only with your consent under CASL — order confirmations and account notices are transactional and always sent. You can ask us to show you what we hold, correct it, or delete it, and you can unsubscribe from marketing at any time from any email or by contacting us. We will help with any of these directly.