Privacy policy

Catch153 operates this store and is responsible for the personal information described here. You can reach us about anything on this page at orders@catch153.ca.

Only what an order actually requires:

• Your account — name, email address and phone number.
• Delivery addresses — recipient name and phone, street and unit, city, province, postal code, and any delivery instruction or landmark you add. You can save more than one.
• Orders — the items and quantities you bought, what they cost, the delivery area, and the status history of the order.
• Email preferences — whether you have opted in to marketing email, when that choice was made or changed, and whether you have opted out of order notifications.

We do not collect payment card details, and we could not store them if we wanted to — see Payments below.

• To take payment for an order and deliver it to the right address.
• To email you about an order — confirmation, dispatch, a delivery problem.
• To show you your order history and let you reorder.
• To work out whether we deliver to your postal code.
• To keep the accounting and tax records Canadian law requires us to keep.
• To send you marketing email, but only if you have expressly opted in.

We do not sell your personal information. If you allow advertising cookies, we share details of your visit and your purchases with Meta so we can measure and improve our own ads on Facebook and Instagram — see Cookies and browser storage for exactly what, and how to stop it.

Sign-in is handled by Amazon Cognito. Your password is set and checked there, never by this store — we do not receive it and cannot read it.

If you sign in with Google, Google tells us your name, email address and profile picture, and nothing else. We never see your Google password, and we have no access to your Gmail, Drive, contacts or any other Google service. You can disconnect Catch153 at any time from your Google account permissions page.

If you already had an account with the same email address, signing in with Google joins you to that existing account rather than creating a second one, so your order history follows you.

Card payments are processed by Stripe. Your card number is sent from your browser directly to Stripe and never passes through or rests on our servers. We receive only the result of the payment and the last few digits of the card, which is what appears on your order.

Stripe handles that information under its own privacy policy.

When you type into the address field, what you type is sent to Google Places to fetch suggestions, so you can pick your address instead of typing it in full. The request goes through our server rather than from your browser, and it carries no name, email or account identifier — only the partial address text.

Order email — confirmations and delivery updates are part of the service, and we send them because you placed an order.

Marketing email — sent only if you have expressly opted in. The box is never pre-ticked, we record when consent was given or withdrawn, and every marketing message carries an unsubscribe link. That link works without signing in, at your email preferences. This is how Canada's anti-spam legislation (CASL) expects it to work, and how we do it.

Service providers who make the store work, and no one else:

• Amazon Web Services — hosting, the database, and sign-in through Amazon Cognito.
• Stripe — payment processing.
• Amazon SES — sending the email described above.
• Google — sign-in, if you choose it, address suggestions, and Google Analytics (see Cookies below).
• Meta (Facebook and Instagram) — measuring our ads, only if you allow advertising cookies (see Cookies below).

Beyond these, we disclose personal information only where the law requires it.

Our servers, database and user accounts are hosted in Amazon's Canadian region (ca-central-1), so day-to-day your information stays in Canada. Stripe, Google and Meta are global services and may process information outside Canada, including in the United States, under their own policies.

Orders, and the copy of the delivery address taken when the order was placed, are kept for as long as tax and accounting rules require. That snapshot is why deleting an old address does not rewrite an old invoice: saved addresses are archived rather than erased, so past orders still show where they actually went.

Account details are kept while your account is open. Ask us to close it and we will remove what we are not obliged to retain.

Under Canada's PIPEDA you may ask us to show you the personal information we hold about you, correct anything wrong, delete what we are not required to keep, or withdraw a consent you previously gave.

Most of it you can do yourself: your name, phone number and addresses are editable in your account, and email choices on your email preferences page. For anything else, email orders@catch153.ca and we will respond within 30 days.

We use browser storage to keep you signed in and to complete the sign-in handshake securely. Your basket is saved to your account on our server, not to a cookie, which is why it survives moving to another device.

We use Google Analytics to understand how the shop is used — which pages are visited, what is searched for, and how many visits end in an order — so we can make it better. We ask first: until you choose “Accept” on the cookie notice, Google Analytics sets no cookies and receives only anonymous, cookieless signals. If you accept, it sets its own cookies (named _ga). You can change your mind at any time with “Cookie settings” at the bottom of every page; declining removes them.

What Google Analytics receives is about the visit, not about you: the pages (without any codes or order numbers in their addresses), the products viewed and added, and an order's number and total. We never send your name, email, phone number or address. Google signals and ad personalisation are switched off: Google Analytics is not used for advertising.

We use the Meta Pixel to measure our ads on Facebook and Instagram — which ads lead to orders — and to show them to people likely to be interested. It is separate from Google Analytics and off unless you choose “Accept all”: “Analytics only” and “Decline” leave it off, and until you accept, Meta's code is not loaded at all. If you accept, it sets Meta's cookies (_fbp, and _fbc when you arrived from one of our ads).

From your browser, Meta then receives the shop pages you visit, the products you view, what you search for, what you add to your basket, when you start checkout, and each order's number, items and total, along with the technical details any website request carries (your IP address and browser). Meta never sees your account, sign-in, payment or wallet pages, addresses with codes or order numbers in them, or searches that look like an email address or phone number, and we never send your name or address from your browser.

When an order you placed with advertising cookies accepted is paid, our server also tells Meta about that purchase directly, so it is counted even if your browser blocks the pixel: the order's number, items and total, your browser's details, your IP address, and Meta's _fbp and_fbc cookie values when available. We do not send your name, email address, phone number or delivery address through this server connection. Meta uses the information it receives to measure and deliver our ads and, under its own terms, may use it to improve its advertising systems. Our server keeps the browser details for this only until they are sent, and the record of the send for 30 days.

You can withdraw at any time with “Cookie settings” at the bottom of every page: choosing “Analytics only” or “Decline” stops Meta's code, removes its cookies, and — if you are signed in — cancels anything about your orders not yet sent. What has already been sent is held by Meta; you can see and clear it in your Facebook or Instagram settings under “Your activity off Meta technologies”.

This store is meant for adults placing grocery orders. We do not knowingly collect personal information from children.

If we change how we handle personal information we will update this page and move the date at the top. Material changes will also be emailed to customers with an active account.

Questions, corrections, or a complaint about privacy: orders@catch153.ca. If you are not satisfied with our answer you can raise it with the Office of the Privacy Commissioner of Canada.