Privacy Policy
Last updated: [DATE]
Template - needs Paul's review. This text is a starting draft, not legal advice. Fill in every [PLACEHOLDER] and have it checked before the site goes live.
This policy explains how [BUSINESS LEGAL NAME], operating as Kairos at kairoscoffee.ca ("we"), handles personal information. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for email, Canada's Anti-Spam Legislation (CASL). Our service helps Canadian businesses source products from manufacturers in China.
1. What we collect
- Account details: email, password (stored only as a salted hash), and whether you verified your email or phone.
- Company profile and requests: business and legal name, contact name, role, phone, delivery cities and addresses, GST/HST number if given, products, quantities, what you pay now, current suppliers, timelines and shipping details.
- Files you upload: supplier invoices (PDF, JPG, PNG, HEIC) and design or logo files.
- Chat messages you send to our sourcing helper.
- Technical data: IP address and country (for security and rate limits), and the cookies listed below.
- Consent records: your age confirmation and, if you choose, your marketing email consent with date and time.
2. Why we use it
- To create your account, answer your requests and prepare sourcing quotes.
- To compare your current costs with possible suppliers.
- To keep the site secure and stop abuse.
- To send marketing emails, only if you said yes.
- To meet legal, tax and accounting duties.
We do not sell your personal information.
3. AI processing of invoices and chat
Uploaded invoices are read automatically by an AI model (Meta Llama 3.1 / 3.2, run on Cloudflare Workers AI) to pull out line items, sizes, pack counts, quantities and prices. Chat messages are answered by a Llama model on the same service. The AI results are checked by our staff and are shown only to our admin team, not to other clients. Cloudflare processes this data for us as a service provider. Built with Llama.
4. Consent
By creating an account, sending a request, uploading files or chatting, you consent to the uses in section 2 and 3. Marketing email is separate: it needs a box you tick yourself, and it is never ticked for you. You may withdraw consent at any time (see section 8); this may limit what we can do for you.
5. Age
This service is for businesses and adults. You must be 18 or older. We do not knowingly collect information from anyone under 18; if we learn we did, we delete it.
6. Where your data is stored (outside Canada)
Our website and data run on Cloudflare (Cloudflare, Inc., USA), including its key-value storage and Workers AI. Your information may be stored or processed in the United States or other countries where Cloudflare operates, and may be accessed by courts, law enforcement and national security authorities of those countries. Email is sent through [EMAIL PROVIDER: Resend or Brevo]. When we share details with manufacturers in China to get quotes, we share only what is needed (usually product specs and quantities, not your personal contact details unless you agree). The owner is located in [Washington State, USA / British Columbia - confirm]; if Washington law (such as the My Health My Data Act) applies, note we do not collect health data.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account is open, then up to [24] months |
| Requests, quotes, invoices you upload and AI results | [7] years for tax/accounting, or less if not needed |
| Chat messages | Not stored after the reply, except in rate-limit counters |
| Login sessions | 30 days |
| Marketing opt-out records | Kept so we never email you again by mistake |
8. Your rights: access, correction, withdrawal
You can ask to see the personal information we hold about you, correct it, or withdraw consent. You can edit most details in My account. For anything else email our Privacy Officer. We reply within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
9. Safeguards
Passwords are hashed, connections use HTTPS, invoices are only visible to you and our admin, and admin access needs a separate password.
10. Cookies
| Cookie / storage | Type | Purpose |
|---|---|---|
| ksess | Essential | Keeps you logged in (30 days) |
| kadmin | Essential | Admin login only |
| kconsent | Essential | Remembers your cookie choice (1 year) |
| kage18 (local storage) | Essential | Remembers that you confirmed you are 18+ |
| Analytics | Optional | None in use today. If added, they load only after you press "Accept all". |
Change your choice any time with "Cookie settings" at the bottom of the home page.
11. Privacy Officer
Privacy Officer: Hyung Sun Chun
Email: privacy@kairoscoffee.ca [confirm this inbox exists]
Mail: [MAILING ADDRESS]
12. Changes
We will post changes here and update the date at the top.