Your information, with a purpose.

Who is responsible

Sear & Shred is a food business in Toronto, Ontario, Canada. Christopher Cifuentes, the owner, is our privacy contact and is accountable for how we handle personal information. Email searandshred@gmail.com.

What we collect, and why

• When you order: your name, email address and phone number; the dishes, options and quantities; the date and time; your order notes and any instruction for a dish; and, for delivery, the delivery address. Pickup needs no address. We use these to take, cook and hand over or deliver your order, to send its confirmation and receipt and to reach you about it.
• When you book a Pizza Party: your name, email address and phone number; the date, the start time and the number of guests; the pizzas you choose; the address of the party, which sets the drive time in its price; your confirmation that the place has running fresh water, electricity, plates and utensils and an outdoor space for the oven, and anything you tell us about that space; and any allergy you note for our kitchen, with who has it. The price worked out for you, the deposit and the remainder are kept with the booking.
• When you pay: every order and every Pizza Party is paid by Interac e-Transfer, to our business account, outside this website. We receive what your bank sends with each transfer (your name as your bank has it, the amount, your message and the transfer's reference) and keep it with your order. We never ask for your bank login or a security answer. A card payment made before October 24, 2026 was taken by Stripe on its own page: we received a payment reference, the amount and whether it succeeded, never your card number.
• When you write to us: your message and your email address.
• When you tell us something went wrong with an order: the private link to the documents of your order also opens Help with your order. What you send there is kept with that order: what it is about (a problem with the order, a request to cancel or a food-safety concern), what happened in your own words, the date and the dishes concerned if you give them, how you would like us to reach you and, for a food-safety concern, whether anyone was unwell, if you tell us. We use it to put the problem right and to keep our food safe. Only the people who run the kitchen can read it.
• When you make a privacy request: your email address, what you asked for and anything you add, so we can answer it.
• What the website needs to work: a session cookie that ties your order to your browser; your cart, kept in your own browser; and your network address, which our host uses to deliver each page and which we use, as a one-way fingerprint only, to stop one sender flooding a form.
• When a page fails: if one of our scripts fails in your browser, the page tells us the error message, which script and which page. It does not send what you typed or your cookies, and we do not keep your network address with it.

We keep a one-way fingerprint of your email address with a promo code you use, so a one-time code cannot be used twice, and to tell a first order from a repeat one. It cannot be turned back into your address. Some promo codes can be used once by each customer. When you review an order total with one of them, we also keep, with the record of that code, a one-way fingerprint of your phone number and one of your name. Both are made with a secret key that only our server holds, and neither can be turned back into what you typed. A paid use of the code stops a later one when the email address or the phone number is the same. The name is our record of who used the code and never stops anyone by itself, because two people can share a name. Your delivery address is not used for this. We also keep daily totals on our own server, such as how many orders were paid. They use no cookie and identify no one.

We ask only for what the order needs. There are no customer accounts and no passwords. We rely on your consent, given when you send a form that states its purpose, and we use your information for that purpose and the ones the law requires, such as keeping accounting records.

Dietary and allergy details

What you tell us about a diet or an allergy can be sensitive. Tell us only what we need to cook safely for you. We use it for that order, we restrict it to the people cooking and serving it, and we keep it out of our calendar and out of analytics. For a group, please do not send another person's health details unless they have agreed; a guest can always contact us directly.

Who handles your information for us

• Stripe Checkout (card payments made before October 24, 2026, their refunds and records): Since October 24, 2026 we take no card payment: every new order is paid by Interac e-Transfer. Stripe keeps the records of the card payments made before then, sends their refunds back to the card and handles any dispute about them.
• Website hosting, the site's server functions and its database (Netlify Database): Delivers the pages, runs the code that prices and records an order, and stores the order records.
• Gmail (our business mailbox): Sends the emails about your order from our business address, and holds the messages you send us.
• Google Calendar (our booking calendar): Keeps our working calendar, so two bookings are never promised the same time.
• Google Maps Platform (route distance): Measures the driving distance to a delivery address, which sets the delivery fee, and to a Pizza Party address, which sets the drive time in the price of the party. Only when we use it for a delivery or a party. When we do not, the distance is estimated on our own server from the postal code and nothing is sent to Google.

The service providers page lists each one with exactly what it receives and on what terms. We remain accountable for information we give a provider. We do not sell, rent or trade personal information, and we do not share it for anyone else's advertising. We disclose it to an authority only when the law requires us to.

Where it is processed

These providers may process and store information outside Canada, including in the United States. While it is there it is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to obtain it.

How long we keep it

• Paid orders: 6 years after the end of the tax year of the order, the period the Canada Revenue Agency requires for business records. A paid order is an accounting record: it is not changed, and a deletion request cannot remove it inside that period. After it we delete or anonymize the record at our next review of our records, or sooner if you ask.
• A total you reviewed, or a payment page you opened, without paying: your name, contact details, address and notes are removed from that record automatically 30 days after it expires.
• Pizza Party requests, and Chef's Table requests made before them: a request that was never paid loses your details 30 days after it ends. A paid booking is kept with its order; the allergy detail and the notes you gave, your note about the outdoor space included, are removed 12 months after the event.
• Privacy requests: 24 months after we close them.
• What you send through Help with your order: a report stays for as long as we are handling it. What you wrote is removed 90 days after we close it. A report about food safety is kept longer: what you wrote is removed 12 months (365 days) after we close it. A record that a report was made stays with the order.
• The fingerprints kept with a promo code: we set no end date. They stay with our record of that code so that it cannot be used again, they are not removed automatically, and a deletion request does not remove them.
• The counters that stop a form being flooded: 24 hours.
• Our unsubscribe list: for as long as we send email, as a one-way fingerprint and never as an address, so that an address that unsubscribed is not written to again.
• Emails and calendar entries: messages in our business mailbox and entries in our business calendar are not deleted automatically. We delete them when you ask, unless they are part of a paid order's records.

To ask what we hold from a report you sent, or with a promo code you used, use the Your data page or write to searandshred@gmail.com.

Stripe keeps its own records of the card payments made before October 24, 2026 for as long as its own obligations require. Copies in our providers' backups expire on the providers' schedules; if a backup is ever restored, we apply every recorded deletion again.

How we protect it

Pages and forms are served over an encrypted connection. We take no card details: you pay by Interac e-Transfer from your own bank. Only the people who run the kitchen can open order records, through a separate sign-in. The key that lets the website send email from our Google account is stored encrypted. We hold no security certification and do not claim one, and no system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner of Canada, as the law requires.

Your choices and your rights

• See what we hold about you, and how we have used it.
• Get a copy of it in a file you can keep.
• Have it corrected where it is wrong or incomplete.
• Have it deleted where the law does not require us to keep it. A paid order stays for the period above. A report you sent through Help with your order that we are still handling stays until we have closed it, and the fingerprints kept with a promo code stay. Everything else that names you goes.
• Withdraw consent: for optional cookies, use Privacy choices at the foot of any page; for promotional email, use the unsubscribe link in the message or ask us. We need your details to serve an order, so withdrawing them for an order we still owe you means cancelling it.

Use the form on the Your data page, or write to searandshred@gmail.com. We first confirm the request is yours, through the email address it names. There is no charge, and we answer within 30 days. If we cannot do all of what you ask, we tell you why.

Cookies and analytics

Essential storage keeps your cart and checkout working. Optional analytics is not switched on. If we switch it on it will be Google Analytics, it will load only after you accept optional cookies, and this policy and the cookie policy will name it. The cookie policy lists every cookie and storage key by name.

Promotional email

Placing an order or accepting the order terms does not sign you up for marketing. A receipt may carry one short offer, and if you tick the box on the Pizza Party form we may send you an occasional note from the kitchen. Every message that carries an offer says who sent it and has an unsubscribe link that works without signing in. Unsubscribing takes effect at once. Messages about an order you place, such as its receipt, still arrive.

Artificial intelligence and automated decisions

We do not use your personal information to train, fine-tune or evaluate artificial intelligence models, and we do not give it to anyone for that purpose. If that ever changed we would ask you first, separately, and you could say no without losing anything. The website applies fixed rules automatically, the same for everyone, such as the notice an order needs or how far we deliver. We do not profile you, and no decision is made about you by a system that treats one person differently from another.

We do not publish a customer's name, logo, photograph or review without the written permission of the person or business concerned.

Children

This website is for adults who can place and pay for an order. We do not knowingly collect personal information from children. If you believe a child has given us information, tell us and we will delete it.

Questions and complaints

Write to searandshred@gmail.com and we will look into it. Never email a password or a card number. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Changes to this policy

We date each revision. If we want to use your information for a new optional purpose, we ask first. A change to this policy does not change what you agreed to for an order you have already placed.

Cookie policy · Service providers · Your data · Business customers