Privacy policy
What personal information TiffinGrab collects, why, who sees it, how long we keep it, and how to exercise your rights under PIPEDA.
Updated October 7, 2026 · TiffinGrab, Ontario, Canada
On this page
1.Information we collect
1.1 You provide
- Identity: name, phone, email;
- Delivery: address, unit, access notes;
- Orders: plan, preferences, order history, optional dietary notes; and
- Messages: email, WhatsApp, contact form.
1.2 Payments
You pay by Interac e-Transfer. We may keep the amount, the transfer reference, and a screenshot you upload so staff can confirm the payment. We do not store your banking login or full account number on our servers.
Card payments through Stripe are coming later. When they are available, card data will be processed by Stripe. We will not store full card numbers or CVV on our servers.
1.3 Technical data
We may collect IP address, browser, device, pages viewed, and timing via cookies and server logs.
2.How we use information
We use personal data to:
- Process, fulfil, and deliver orders;
- Manage subscriptions and accounts;
- Send operational updates (delivery, schedule changes);
- Respond to support requests;
- Meet legal obligations in Ontario and Canada;
- Detect fraud, chargebacks, and abuse; and
- Improve our service using aggregated or anonymized analytics.
Marketing: Promotional messages only if you opt in. Unsubscribe anytime (link or reply instructions). We do not send unsolicited marketing without consent.
3.We do not sell your data
4.Limited sharing
We share data only as needed:
- Delivery: name, address, instructions to complete delivery;
- Payments: Interac e-Transfer details stay with us so staff can confirm payment;
- Legal: when required by law or valid legal process; and
- Business transfers: a successor must honour similar protections.
Processors and partners are bound to confidentiality and purpose limitation.
5.Security
We use reasonable technical and organizational measures, including TLS in transit and access controls on a need-to-know basis. When card payments through Stripe are added, card data will be handled by Stripe. No online system is perfectly secure; we will notify you of breaches as required by law.
6.Retention
We keep data while your account is active and up to three years after your last transaction where needed for accounting, tax, and disputes. Communications tied to complaints may be kept up to five years. After that, data is deleted or anonymized where permitted.
7.Your rights (PIPEDA)
You may request access, correction, deletion (subject to legal holds), and withdrawal of consent for non-essential uses. You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Email info@tiffingrab.ca with subject “Privacy Request”. We aim to respond within 30 days.
8.Cookies & tracking
We use essential cookies for site operation, and may use analytics cookies in line with our configuration. You can control cookies in your browser; disabling some may affect functionality.
9.Children’s privacy
Our services are not directed to children under 18. If you believe a minor submitted personal data, contact us and we will delete it promptly where appropriate.