Mearal ("we", "us") operates the website www.mearal.com and sells pre-fabricated greenhouse kits across Canada and the United States. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and the choices you have. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and where applicable, US state privacy laws including the California Consumer Privacy Act (CCPA).
What we collect
When you visit www.mearal.com or place an order, we may collect:
- Contact details — your name, email address, shipping address, and phone number, provided when you place an order or contact us.
- Payment information — handled entirely by Stripe, our payment processor. We never see or store your card number, CVC, or expiry. Stripe is PCI-DSS Level 1 certified.
- Order history — products you've purchased, amounts paid, shipping addresses, and order status.
- Anonymous analytics — page views, the path you followed through the site, your country, browser family, and the site that referred you. We use a randomly-generated visitor ID stored in your browser's localStorage. We do not use Google Analytics or third-party tracking pixels.
- Communications — emails you send us via our contact form or order confirmations.
How we use it
- To process and fulfill your order (charge payment, ship product, send confirmations).
- To respond to your questions and provide customer support.
- To send order status updates (shipping confirmations, tracking numbers).
- To improve the website based on aggregate, anonymized analytics.
- To send occasional newsletters — only if you explicitly subscribe (you can unsubscribe at any time).
Who we share it with
We share only what's strictly necessary, and only with these processors:
- Stripe (payment processing) — receives your name, email, billing address, and payment details to complete the transaction. Stripe Privacy Policy.
- Resend (transactional email delivery) — receives your email address and order details to deliver your confirmation and shipping notifications. Resend Privacy Policy.
- Shipping carriers (Canada Post, UPS, FedEx, regional freight carriers) — receive your name, address, phone, and order weight/dimensions to deliver your shipment.
- Supabase (database hosting) — your order data is stored on Supabase's infrastructure in North America.
- Vercel (website hosting) — handles HTTPS and delivers our website. Logs connection metadata (IP, user agent) for security and performance.
We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising targeting or to train AI models.
Security
We use HTTPS encryption for all traffic to and from our website. Card data is handled exclusively by Stripe and never touches our servers. Customer records in our database are protected by row-level security and accessed only via authenticated admin sessions over encrypted connections.
Data retention
Order records are retained for 7 years for tax and warranty purposes. Analytics data is retained for 24 months. You can request deletion of your personal information at any time (see "Your rights" below) — we'll fulfill your request except where we're legally required to retain records (e.g., tax filings).
Cookies and local storage
We use a small number of cookies and browser storage entries:
- Analytics visitor ID — a random UUID stored in your browser's localStorage so we can count unique visitors without identifying you personally.
- Admin session cookie — only set if you log into the admin panel. Not used for customers.
- Stripe Checkout cookies — set by Stripe during checkout for fraud prevention. Governed by Stripe's policy.
Your rights
Under PIPEDA, CCPA, and similar laws, you have the right to:
- Know what personal information we have about you.
- Request a copy of your data.
- Correct inaccurate information.
- Request deletion of your information (subject to legal retention requirements).
- Opt out of marketing emails (every newsletter has an unsubscribe link).
- Lodge a complaint with the Office of the Privacy Commissioner of Canada or your state attorney general.
To exercise any of these rights, email info@mearal.com.
Children
Our site and products are not directed to children under 16. We do not knowingly collect information from anyone under 16. If you believe we have collected information from a child, please contact us and we'll delete it.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. If changes are material, we'll notify customers by email.
Contact
Privacy questions? Email info@mearal.com or reach us via the contact page.