PRIVACY POLICY

WHAT WE COLLECT

We collect only the information necessary to operate the platform and process transactions. This includes:

• Account information: name, colony or business name, email address, and password (hashed — never stored in plain text).
• Contact information: mailing address, province or state, postal or ZIP code, and phone number where provided.
• Transaction data: purchase history, order details, and payment confirmation records (payment card details are held by Stripe — not by us).
• Listing data: product listings, prices, and inventory information submitted by sellers.
• Usage data: pages visited, features used, browser type, and general device information for platform performance and security purposes.
• Communications:messages sent through the platform's messaging system and support correspondence.

WHAT WE DO NOT COLLECT

• Credit card numbers, bank account numbers, or full payment card details — these are collected and processed solely by Stripe.
• Government-issued identification numbers (SIN, SNN, or equivalent) unless explicitly required by law and with your specific consent.
• Biometric data of any kind.
• Information about minor children — the platform is intended for use by adults and registered business entities only.

HOW WE USE YOUR DATA

• To operate, maintain, and improve the platform and its features.
• To process transactions and send related confirmations, receipts, and notifications.
• To communicate with you about your account, listings, orders, and platform updates.
• To detect, prevent, and respond to fraud, security incidents, and violations of these Terms.
• To comply with applicable laws, respond to lawful requests from government authorities, and enforce our legal rights.

DATA SHARING

We share data only with the third-party service providers necessary to operate the platform, and only to the extent needed to deliver our services. Each provider is bound by contractual confidentiality and data-protection obligations and may use the data only as instructed by us. These providers fall into the following categories:

• Cloud hosting and infrastructure— running and serving the platform.
• Database and storage— securely storing platform and account data.
• Payment processing— processing transactions and meeting financial-compliance requirements. Full payment card details are handled by our payment processor, not by us.
• Communications delivery— sending transactional email and SMS, such as verification codes, confirmations, and account notices.
• Security and monitoring— detecting, preventing, and responding to errors, fraud, and security incidents.
• AI-assisted features— where AI features are offered, queries may be processed by a third-party AI provider; please avoid entering personal data into AI-assisted fields.

We may also disclose personal information to government authorities, law enforcement, or regulators where required by law or valid legal process, or where we reasonably believe disclosure is necessary to protect the safety of any person.

DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law:

• Active account data: retained for the duration of the account relationship plus 2 years after account closure.
• Transaction records: retained for 7 years from the date of transaction, as required for tax and accounting compliance under Canadian law.
• Support and communications records: retained for 3 years after the close of the relevant inquiry or dispute.
• Platform usage logs: retained for up to 12 months for security, debugging, and performance analysis, then permanently deleted or anonymized.

YOUR RIGHTS (PIPEDA — Canada)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request that inaccurate or incomplete personal information be corrected.
• Withdrawal of consent: withdraw consent to the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions and reasonable notice.
• Complaint: file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe your privacy rights have been violated.
• Deletion: request deletion of your personal information, subject to our legal obligations to retain certain records.

YOUR RIGHTS (US)

US-based users should be aware of the following:

• This platform is operated from Canada and is governed by Canadian privacy law. US state privacy laws (including the California Consumer Privacy Act / CCPA) may not directly apply to our operations; however, we commit to honoring reasonable access and deletion requests from all users regardless of jurisdiction.
• US residents may submit privacy requests to privacy@thehutter.com and we will respond within 45 days.

COOKIES

• We use essential cookies only — those strictly necessary to operate the platform, maintain your session, and provide core functionality such as authentication and cart persistence.
• We do not use advertising cookies, cross-site tracking cookies, or third-party behavioral analytics cookies.
• You may disable cookies in your browser settings, but doing so may prevent certain platform features from functioning correctly. No consent banner is required as we use only strictly necessary cookies.

CROSS-BORDER DATA

The Hutter Platform serves users in Canada and the United States. By using the platform, you acknowledge that your personal information may be transferred to, stored in, and processed in Canada or the United States (or both) where our service providers maintain facilities. These jurisdictions may have different privacy laws than your home jurisdiction. Where data is transferred to the United States, it may be accessible to US government authorities under applicable US law. We take reasonable steps to ensure that service providers in any jurisdiction protect your information consistently with this Privacy Policy.

CONTACT