Privacy

When you place an order:

• your name;
• your email address, and your phone number if you give one;
• your shipping address, if the order is being shipped;
• what you ordered, what you paid, and any note you added.

That is it. We do not collect payment card details — there is no card processor on this site — and we do not ask for anything about your health.

To take the order, match your payment, send it to you, answer you if you get in touch, and keep the business records we are required to keep. We do not use it for anything else.

A few services are involved in running the shop. Each one only sees what it needs to do its job:

• Vercel — hosts the website and serves these pages.
• Supabase — the database your order is stored in.
• Resend — sends your order confirmation and receipt.
• Proton Mail — our email, where your message lands if you write to us.
• The carrier — gets your name and address on the label so the parcel can be delivered.
• Google Analytics — sees which pages are viewed and where visits come from. It is not given your name, address, email or anything from an order.

Some of these store data outside Canada, which means it can be subject to the laws of that country. We do not sell, rent or trade your information to anyone, and we do not share it for advertising.

We measure how the site is used, so we can tell which pages are worth writing and which are not. Two tools do that:

• Vercel Analytics and Speed Insights — page views and loading performance. Cookieless, and it does not identify you.
• Google Analytics (GA4) — page views, which site you arrived from, and roughly where in the world you are. It sets its own cookies to recognise a returning browser, and we ask Google to shorten your IP address before it is stored.

Neither is an advertising tracker. There is no Meta pixel, no ad network, and no remarketing on this site — we do not run ads, and nothing here is used to build an advertising profile of you or shared with an ad platform. Google Analytics is not loaded at all on the cart, or on our password-protected pages.

If you would rather not be counted, browser settings that block cookies or analytics will stop it, and Google publishes an opt-out add-on for its own analytics. The only cookie we set ourselves is one that keeps you signed in to a password-protected page, if you have been given access to one.

Order records are kept for as long as we need them for accounting and tax purposes — generally seven years, which is the Canadian requirement. Emails are kept until they are no longer useful.

Under Canadian privacy law (PIPEDA) you can ask what we hold about you, ask us to correct it, and ask us to delete it. Email hello@aurumbio.co and we will respond within 30 days.

We can delete most things on request. We cannot delete records we are legally required to keep, such as the accounting record of a completed sale — we will tell you if that applies.

The site runs over HTTPS, order data is held in an access-controlled database, and the pages that show customer information are behind a password. No system is perfect, and we will not pretend otherwise — if something happens that affects your information, we will tell you.