Privacy Policy
Last updated: August 22, 2026
Astropaint (“we”, “us”, “our”) operates this website and online shop. This policy explains what personal information we collect, why we collect it, how we use it, and what choices you have.
We are based in Ontario, Canada, and we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). If you are located in Quebec, the European Economic Area, or the United Kingdom, you may have additional rights, described below.
Contact: hello@astropaint.ca
What information we collect
When you place an order
To fulfil an order we collect your name, billing address, shipping address, email address, phone number (when provided), the items you purchased, and your order history. This information is necessary to process the sale, ship your items, handle returns, and meet our tax and record-keeping obligations.
We do not see or store your full payment card details. Card payments are processed by Stripe, and your card information goes directly to Stripe rather than to us. We receive only a confirmation of payment, the last four digits of the card, the card brand, and the billing postal code. Stripe’s privacy policy is available at https://stripe.com/privacy.
When you create an account
If you register for an account, we store the information in your user profile: your username, email address, password (stored in encrypted form — we cannot read it), and any name or address details you save. You can view and edit this information at any time from your account page. Usernames cannot be changed.
When you leave a comment
When visitors leave comments on the site, we collect the data shown in the comment form, plus the visitor’s IP address and browser user agent string, which help with spam detection.
An anonymized string created from your email address (a “hash”) may be provided to the Gravatar service to check whether you use it. Gravatar’s privacy policy is available at https://automattic.com/privacy/. After your comment is approved, your profile picture is visible to the public alongside your comment.
When you contact us
If you email us or use a contact form, we keep your message and contact details so we can respond and follow up.
When you sign up for our mailing list
If you subscribe to our newsletter, we collect your email address and, optionally, your name. We only send marketing email to people who have asked for it, and every message includes an unsubscribe link. Unsubscribing takes effect immediately and does not affect emails about orders you have placed.
Automatically, as you browse
Our web server and analytics tools record standard technical information: IP address, browser type, device type, operating system, referring page, pages viewed, and time of visit. We use this to keep the site secure and to understand which pages people find useful.
Media and uploaded images
If you upload images to the website, avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images published on the site.
Cookies
Cookies are small files stored in your browser. We use them for the following purposes:
Shop and cart. WooCommerce sets cookies that remember the contents of your cart, keep your session active while you browse, and carry your details through checkout. The site will not function as a shop without these.
Comments. If you leave a comment, you may opt in to saving your name, email address, and website in cookies, so you do not have to re-enter them next time. These last one year.
Login. Visiting the login page sets a temporary cookie to check whether your browser accepts cookies; it contains no personal data and is discarded when you close your browser. When you log in, additional cookies save your login information and screen display choices. Login cookies last two days and screen option cookies last one year. If you select “Remember Me”, your login persists for two weeks. Logging out removes the login cookies.
Editing posts. If you edit or publish an article, a further cookie is saved that contains no personal data and simply records the post ID of the article you edited. It expires after one day.
You can block or delete cookies through your browser settings, though doing so may prevent the cart and checkout from working.
Embedded content from other websites
Articles and pages on this site may include embedded content such as videos, images, or social media posts. Embedded content from other websites behaves exactly as though you had visited that other website directly.
Those websites may collect data about you, set their own cookies, embed additional third-party tracking, and monitor your interaction with the embedded content — including tracking that interaction if you have an account and are logged in to that website.
Who we share your information with
We do not sell your personal information, and we do not share it for anyone else’s marketing purposes. We share it only with the service providers we need to run the shop:
- Stripe — payment processing and fraud prevention.
- Shipping carriers — your name, address, and phone number, so your order can be delivered. For international shipments, customs authorities may also receive a description and value of the contents, as required by law.
- Our web host and email provider — Hostinger and Namecheap, which stores the site’s data on our behalf.
- Automated spam detection — visitor comments may be checked through an automated spam filtering service.
- Mailchimp — subscriber names and email addresses.
We may also disclose information where we are legally required to, or where it is necessary to protect our rights, safety, or property.
If you request a password reset, your IP address will be included in the reset email.
Where your information is stored
Some of the service providers listed above store or process data on servers outside Canada, including in the United States. When personal information is held in another country, it may be accessible to the courts and law enforcement of that country under its laws. We select providers that offer comparable protection, but we cannot exempt them from the legal requirements of the jurisdictions they operate in.
How long we keep your information
Orders and transaction records: retained for at least six years from the end of the tax year they relate to, as required by Canada Revenue Agency record-keeping rules.
Account information: retained for as long as your account is open. You can ask us to close and delete it at any time, subject to the order-record requirement above.
Comments: comments and their metadata are retained indefinitely, so that follow-up comments can be recognized and approved automatically instead of being held in a moderation queue.
Newsletter subscriptions: retained until you unsubscribe.
Contact form and email correspondence: retained for two years, then deleted.
Server and analytics logs: retained for 30 days, then deleted or anonymized.
Your rights
You can ask us to:
- Access the personal information we hold about you, and receive an exported copy of it.
- Correct anything that is inaccurate or incomplete.
- Delete your personal information. This does not extend to records we are required to keep for legal, tax, accounting, or security reasons.
- Withdraw consent to marketing email, at any time.
If you have an account or have left comments, you can request an export of your personal data, including anything you have provided to us, and you can request erasure of the data we hold.
To make a request, email us at [YOUR EMAIL]. We will respond within 30 days. We may need to verify your identity before acting on a request.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.
Quebec residents have additional rights under Quebec’s privacy legislation, including the right to data portability and the right to be informed when a decision about you is made solely by automated processing.
EEA and UK residents have rights under the GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority.
Children
This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.
Security
We use HTTPS encryption across the site, store passwords in hashed form, keep our software updated, and limit administrative access to those who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable steps to protect your information. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Privacy Commissioner as required by law.
Changes to this policy
We may update this policy from time to time. The revision date at the top will change, and material changes will be announced on the site. Continuing to use the site after an update means you accept the revised policy.
Questions
Email hello@astropaint.ca