Privacy Policy

What you give us

• When you place an order: your name, email, phone number, and, for delivery orders, your delivery address and postal code. We use the postal code to work out your delivery zone and fee.
• When you pay by card: your payment is processed by Stripe, our payment provider. Card numbers go directly to Stripe; we never see or store your full card details. We keep a payment reference so we can match your payment to your order and process refunds.
• When you pay by Interac e-transfer: we see the transfer details your bank shares so we can match it to your order.
• When you join a list: your email address, whether that is the harvest newsletter, a crop waitlist, or the note asking us to tell you when ordering reopens. We keep a record of when and how you signed up.
• When you leave a review: your name, your rating and comment, and the email and order number we use to confirm you really bought the item.
• When you write to us: whatever you choose to include in your message.
• When you use our site helper: the messages you type, processed by our AI service provider to answer you, to route your question to a real person when needed, and to improve the helper.

What our site collects automatically

Like most websites, our systems automatically receive some technical information when you visit: your IP address, browser and device type, the pages you view, and the date and time, kept in standard server logs for security and troubleshooting. We use a small number of cookies that are needed for the site to work, such as keeping items in your basket. We keep basic, privacy-respecting site statistics in aggregate, like visits and orders, so we can plan what to plant. When you use card checkout, Stripe may collect device information to help prevent fraud. A small number of embedded services on our pages, such as the map on our Find Us page and, when connected, our Instagram gallery, may receive your IP address when those elements load, and, if you use the locate me button, your approximate location is sent to OpenStreetMap to find your postal area. We do not use advertising trackers and we do not sell or rent your information to anyone.

• Basic activity on our own site: which pages are viewed, which crops are looked at, and whether an order is completed. We count this ourselves, with no third party analytics service and no advertising cookies, and we do not use it to identify you.

Who receives your information

Only the services we need to run the store: Stripe for card payments and fraud prevention; Emergent, the platform that hosts our website, stores our orders, sends our emails and runs our site helper's AI service; and, if you use the locate me button, OpenStreetMap, which receives your approximate location to find your postal area. Each receives only what it needs to do its job. Some of these providers process information outside Canada, including in the United States and India, where it may be subject to the laws of those places. We remain responsible for your personal information when it is handled by our service providers.

How we protect it

Your information travels encrypted (the whole site runs on HTTPS) and is stored encrypted by our hosting platform. That platform, Emergent, holds an independent SOC 2 attestation and is certified to ISO/IEC 27001:2022 for information security management, and our data is backed up on a schedule with tested restores. On our side: we collect only what we need, our farm systems are protected by two factor authentication, customer photos are stripped of hidden location data before they are ever shown, and your card number never touches our systems at all, because it goes directly to Stripe. No method of storage is perfect, but we treat your information the way we treat your food: carefully, and only for its purpose.

How long we keep it

Transaction and accounting records are generally kept for at least six years from the end of the tax year they relate to, or longer where the law requires. Other personal information is kept only as long as reasonably needed for the purpose it was collected for, and is then deleted or anonymized. List emails are kept until you unsubscribe or ask to be removed.

Your choices and rights

Every marketing email we send includes an unsubscribe link. Unsubscribe requests take effect promptly, and in any event within the time the law requires. You can also write to us at any time to ask what personal information we hold about you, how it is used and who it has been shared with, to correct it, or to request deletion where applicable, subject to legal and legitimate retention requirements such as tax records. We respond to access requests within 30 days as required by Canadian privacy law. Our site is not directed at children.

Who is responsible

Our Privacy Officer is responsible for how we handle personal information and for answering privacy questions and complaints:

Changes

If this policy changes, we will update this page and the effective date above. We handle personal information in line with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act.