Privacy Policy

Nilo Cards, Montréal, Québec, is responsible for your personal information. The person in charge of the protection of personal information is the owner of Nilo Cards. Reach them by email info@nilocards.com, Instagram @nilo_cards, or the contact form at https://nilocards.com/contact.

• Account: your email address and password (the password is stored only in hashed form by our authentication provider), and the date and version of the terms you accepted — to sign you in and prove consent.
• Profile and orders: your first and last name, shipping address, optional phone number, and what you bought and paid — to fulfil and ship orders, send receipts and shipping emails, and keep the records the law requires (including tax records).
• Payment: card payments are handled entirely by Stripe. We never see or store your full card number; we receive a payment reference and the amount paid. If you pay by Interac e-Transfer, we receive what your bank sends with the transfer (your name, email address or phone number, the amount and your message), which we keep with the order's records.
• Messages: what you send through the contact or quote form — to answer you.
• Break alerts and newsletter: your email address, only if you asked for it — by clicking "Notify me" on a break, or checking the optional box at sign-up or on your account page. You can withdraw that consent at any time.

We don't use advertising or analytics trackers, we don't build profiles of you, and we don't sell your personal information.

Our site and services are for adults (18+). We don't knowingly collect personal information from minors; if you believe a minor has given us information, contact us and we'll delete it.

We share personal information only with the service providers that run the site for us, and only what they need:

• Amazon Web Services (hosting, database, sign-in and email delivery);
• Stripe (payment processing);
• Google (Google Analytics site statistics, only if you accept analytics cookies);
• Canada Post or other carriers (your name and address, to deliver your order).

Some of these providers store information outside Québec, including in the United States (our hosting and database are in AWS's US East region). We've assessed these transfers and rely on contracts that require the providers to protect your information; it may still be subject to the laws of the country where it's stored.

We may also disclose information when required by law, or to prevent fraud.

We don't use advertising cookies. Besides the optional analytics cookies described below, which are off unless you accept them, the site only stores what it needs to work:

• Sign-in cookies and browser storage (names starting with "CognitoIdentityServiceProvider" or "com.amplify", from Amazon Cognito): keep you signed in and let the site load images securely. Sign-in is removed when you sign out, and expires on its own after at most 30 days.
• Language cookie ("NEXT_LOCALE"): remembers the language you switched to. Deleted when you close your browser.
• Your break cart, kept in your browser's session storage (not a cookie): remembers the spots you picked while you sign in or check out. Deleted when you close the tab.
• Your sign-up details ("nilo-pending-signup", in your browser's session storage, not a cookie): keeps the name, address and choices you entered at sign-up until you've confirmed your email, so they're saved to your account even if you leave before entering the code. Deleted once saved, or when you close the tab.
• Display theme ("nilo-theme", in your browser's local storage, not a cookie): set only if you switch to light or dark mode, to remember that choice. Stays until you clear your browser data.
• Your analytics choice ("nilo-analytics-consent", in your browser's local storage, not a cookie): remembers whether you accepted or declined analytics, so we don't ask on every page. Stays until you clear your browser data.

Analytics (optional, off unless you accept): if you click "Accept" on our cookie notice, we use Google Analytics to count visits and see which pages are used, so we can improve the site. Google sets cookies ("_ga" and "_ga_…", kept up to 2 years) and receives your browser and device details, the pages you view, and your IP address, which Google Analytics uses only to estimate an approximate location and doesn't store. Data is processed in the United States under Google's privacy policy. We turned off Google Signals and ad personalization, and we don't send Google your name, email or order details. You can change your choice anytime with "Cookie preferences" at the bottom of every page; declining deletes the Google Analytics cookies.

Break streams are hosted on YouTube. The player, and YouTube's live chat beside it during a break, aren't loaded on our pages until you click "Load the stream", so nothing is sent to Google before that. Once you load them, YouTube (Google) may set cookies and collect information about your device and viewing, under Google's privacy policy. You can also watch with the "Open on YouTube" link, or not at all.

Payment happens on Stripe's own checkout page (checkout.stripe.com), which uses its own cookies for security and fraud prevention under Stripe's privacy policy.

You can delete or block cookies in your browser settings; if you block the sign-in cookies, you won't be able to sign in.

We keep account information while your account is open. Order and payment records are kept for 6 years after the order, as required for tax purposes. Contact-form messages are kept for up to 2 years. When information is no longer needed, we delete or anonymize it.

You can ask to access the personal information we hold about you, have it corrected, withdraw consent (for example, to break alerts or the newsletter), or have it deleted when we no longer need to keep it — and, under Law 25, to receive it in a structured, commonly used format, and to have us stop sharing or de-index information about you (for example, your name in a stream replay).

Some of these you can do yourself on your account page: update your name and address, and turn marketing emails on or off. Every alert email also has a one-click unsubscribe link.

To make a request, contact us by email info@nilocards.com, Instagram @nilo_cards, or the contact form at https://nilocards.com/contact. We'll answer within 30 days. If you're not satisfied, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Information is encrypted in transit and access is limited to the people who need it to run Nilo Cards. We keep a register of confidentiality incidents, and if one creates a risk of serious injury, we'll notify you and the Commission d'accès à l'information as the law requires.

If we change this policy materially, we'll post the new version here with a new date and let you know by email.