Privacy policy
Privacy Policy
Last updated: August 10, 2026
Fluff Mallows ("we", "us", "our") respects your privacy. This policy explains what personal information we collect when you visit our website or place an order, why we collect it, who we share it with, and the choices you have.
We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for our marketing emails, Canada's Anti-Spam Legislation (CASL).
By using our website or placing an order, you agree to the practices described here.
Information we collect
Information you give us
- Your name, email address, telephone number, shipping address and billing address
- Order details, including the products you buy and any gift message or delivery instructions
- Information you provide in a Return & Refund Form, including photographs of products and packaging
- Messages you send us by email or through a contact form
- Your email address if you sign up for our newsletter
We do not collect or store your full credit card number. Payment card details are collected and processed directly by our payment provider.
Information collected automatically
When you visit our website, we and our service providers automatically collect:
- Your IP address and approximate location
- Device type, browser type and operating system
- Pages you viewed, the time and date of your visit, and the site you arrived from
- Products you viewed or added to your cart
This is collected through cookies and similar technologies, described below.
Information from other sources
We may receive limited information from advertising and analytics providers, such as whether you arrived at our site from an advertisement.
Why we collect it
We use your personal information to:
- Process, fulfil and ship your order
- Take payment and detect fraudulent transactions
- Send order confirmations, shipping updates and delivery notifications
- Respond to your questions and review refund requests
- Investigate product quality or food safety concerns, including identifying the production lot involved
- Send marketing emails, if you have signed up
- Understand how our website is used so we can improve it
- Show and measure advertisements
- Meet our legal, tax and food safety record-keeping obligations
We will not use your information for a new purpose without telling you and, where required, obtaining your consent.
Consent and how to withdraw it
We collect, use and disclose your personal information with your consent, unless the law permits or requires otherwise.
By placing an order, you consent to us using your information to fulfil that order. Consent for marketing emails is always express and separate, and you may withdraw it at any time.
You can withdraw your consent by contacting us at the address below or by clicking the unsubscribe button located in the footer of every Fluff Mallows email. Please note that if you withdraw consent for information we need to complete an order, we may not be able to fulfil it. We may also need to retain certain information to meet legal obligations even after you withdraw consent.
Marketing emails
We only send marketing emails to people who have asked to receive them.
Every marketing email includes an unsubscribe link. You can also reply to any email or contact us directly to be removed. We will action unsubscribe requests within ten business days, as required by CASL.
Unsubscribing from marketing does not stop transactional messages about an order you have placed, such as a shipping confirmation.
Cookies and tracking technologies
Our website uses cookies and similar technologies, some of which are set by third parties.
Essential cookies keep your shopping cart working, remember your session and support checkout security. The site will not function properly without these.
Analytics cookies help us understand how visitors use the site. We use Google Analytics for this purpose.
Advertising cookies and pixels allow us to show ads and measure whether they work. We use the Meta Pixel and the TikTok Pixel. These tools may share limited information with Meta and TikTok, including a hashed version of your email address if you have provided one, so that our advertising can be matched to accounts on their platforms.
You can control cookies in several ways:
- Adjust your browser settings to block or delete cookies
- Opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on
- Adjust your ad preferences in your Facebook, Instagram or TikTok account settings
- Use the opt-out tools at the Digital Advertising Alliance of Canada
Blocking essential cookies may prevent you from placing an order.
Who we share your information with
We do not sell your personal information.
We share it only with service providers who help us run our business, and only to the extent they need it:
| Service provider | What they do | What they receive |
|---|---|---|
| Shopify | Runs our online store and hosts our website | Order and account details, browsing activity |
| Shopify Payments and related payment processors | Process payments and screen for fraud | Payment and billing details |
| Shipping carriers | Deliver your order | Name, address, telephone number, email |
| Email marketing provider | Sends newsletters and order emails | Name, email address |
| Website analytics | Device and browsing information | |
| Meta and TikTok | Advertising and measurement | Device and browsing information, hashed email where available |
We may also disclose personal information where required by law, in response to a valid legal request, to investigate a food safety incident with a public health authority, or to protect our legal rights.
If our business is sold or reorganised, customer information may transfer to the new owner as part of that transaction.
Where your information is stored
Our website and store are hosted by Shopify. Some of our service providers store or process personal information outside Canada, including in the United States.
When personal information is held in another country, it is subject to the laws of that country and may be accessible to courts, law enforcement and national security authorities there. We use service providers that are contractually required to protect your information to a comparable standard.
How long we keep it
We keep personal information only as long as we need it:
- Order and transaction records: at least seven years, to meet Canada Revenue Agency requirements
- Product quality and food safety records: [X] years, so we can trace a production lot if an issue arises
- Marketing email subscriptions: until you unsubscribe, plus a short period to record that you opted out
- Website analytics: as set by the retention settings of the providers named above
When information is no longer needed, we delete it or render it anonymous.
How we protect it
We use reasonable safeguards appropriate to the sensitivity of the information, including encrypted connections on our website, access controls, and payment processing handled entirely by our payment provider so that we never hold your card number.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take our responsibility seriously and will notify you and the Privacy Commissioner if a breach creates a real risk of significant harm to you, as PIPEDA requires.
Your rights
You have the right to:
- Ask what personal information we hold about you and how it has been used and disclosed
- Ask us to correct information that is inaccurate or incomplete
- Withdraw your consent, subject to legal and contractual limits
- Unsubscribe from marketing at any time
- Ask us questions about this policy or how we handle your information
To make a request, contact us using the details below. We will respond within thirty days. There is no charge for a routine request. We may need to verify your identity before releasing information.
Children
Our website is not directed to children and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.
Links to other websites
Our website may link to other sites, including our social media pages. We are not responsible for the privacy practices of those sites. Please read their policies before providing them with personal information.
Changes to this policy
We may update this policy from time to time. The current version will always be posted on this page with the date it was last updated. Material changes will be brought to your attention.
Contact us
If you have a question, a request, or a complaint about how we handle personal information, please contact our Privacy Officer:
Fluff Mallows
Attention: Privacy Officer
Email: hello@fluffmallows.ca
Address: 43 Reid Crt, Puslinch, Ontario, N0B 2J0
We take privacy complaints seriously and will investigate and respond to every one.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 priv.gc.ca