Privacy Policy

1. Who We Are

Sassy's Bakery ("Sassy's," "we," "our," or "us") is a family-owned bakery, deli, and pizzeria located at 225 King St, Thorndale, Ontario N0M 2P0. We operate this website at mysassys.com to allow customers to browse our menu, place pickup orders, and — for wholesale accounts — manage standing orders.

For privacy inquiries, contact us at inquiry@mysassys.com or call (519) 461-1234.

2. What Personal Information We Collect

When you use our website or place an order, we may collect:

• Contact information: name, email address, phone number.
• Order information: items ordered, pickup/delivery date and time, order notes, order total.
• Payment information: We do not store any payment card details. Online payments are processed directly by Clover (a third-party payment processor). We receive only a transaction confirmation reference.
• Wholesale account information: business name, delivery address, order history.
• Push notification tokens:If you opt in to browser push notifications, we store your browser's push subscription endpoint to send you order-ready alerts. You can withdraw consent at any time.
• Technical information: standard server logs (IP address, browser type, pages visited). We use Cloudflare Web Analytics, which is cookie-free and does not track individuals across sites.

3. Why We Collect It (Purposes)

• To fulfill your order and communicate its status (order confirmation, ready-for-pickup notification).
• To manage wholesale accounts and invoicing (net-30 billing).
• To respond to inquiries and catering requests.
• To improve our website and understand how it is used (aggregate analytics only).
• To meet our legal and regulatory obligations.

We collect only the minimum information necessary for these purposes. We do not sell, rent, or trade your personal information to any third party for their marketing purposes.

4. Legal Basis (PIPEDA)

We collect and use your personal information with your consent (express or implied) or as otherwise permitted under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). When you place an order, you consent to the collection and use of your information for the purposes described above.

5. Electronic Communications (CASL)

Emails we send you regarding your orders (confirmation, ready-for-pickup, catering inquiry responses) are transactional messagesand do not require separate consent under Canada's Anti-Spam Legislation (CASL). We do not send promotional or marketing emails without your explicit opt-in consent. If we ever introduce a newsletter or promotional emails, we will collect your consent separately.

6. Third-Party Services

We use the following third-party services that may process your information:

• Clover(payment processing) — your card details are entered directly on Clover's secure hosted checkout page and never touch our servers.
• Resend — transactional email delivery (order confirmations). Resend processes your email address to deliver messages on our behalf.
• Cloudflare — our website infrastructure, including cookie-free analytics and DDoS protection. Cloudflare processes network traffic including IP addresses.
• Neon — database hosting. Your order and account data is stored in a Neon Postgres database hosted in Canada or the United States.

7. Data Retention

• Order records: retained for 7 years for accounting and tax purposes, then deleted.
• Push notification subscriptions: deleted immediately when you unsubscribe, or within 30 days of an expired subscription.
• Wholesale account data: retained while the account is active and for 7 years after closure.
• Server logs: automatically purged by Cloudflare within 30 days.

8. Your Rights

Under PIPEDA, you have the right to:

• Know what personal information we hold about you.
• Request corrections to inaccurate information.
• Withdraw consent (where consent is the legal basis), subject to legal or contractual restrictions.
• Request deletion of your information, subject to legal retention obligations.

To exercise any of these rights, email inquiry@mysassys.com with your name and the nature of your request. We will respond within 30 days.

9. Cookies

Our website uses only essential cookies required for authentication (login sessions). We do not use advertising or third-party tracking cookies. Our analytics provider (Cloudflare Web Analytics) is cookie-free. You can disable cookies in your browser settings, but doing so will prevent you from logging into the wholesale portal or admin panel.

10. Security

We use industry-standard safeguards including TLS encryption in transit, hashed password storage (salted PBKDF2), rate-limited login endpoints, and audit logging for administrative actions. No system is perfectly secure; we will notify affected individuals in the event of a privacy breach as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when it was last revised. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact

Questions or complaints about our privacy practices? Contact us at:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.