Privacy policy

Last updated: July 23, 2026

Exos Door operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Exos Door is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

  • Contact details including your name, address, billing address, shipping address, phone number, and email address.
  • Financial information including payment card information, transaction details, form of payment, payment confirmation and other payment details. Payments are processed by Shopify's payment services; we do not see or store your full card number.
  • Transaction information including the items you view, put in your cart, or purchase, return, exchange or cancel and your past transactions.
  • Booking information when you book a pickup or delivery time, including your order number, email address, the name on your order, and your chosen time slot (see "Pickup and Delivery Booking" below).
  • Content you submit including product reviews (the name you provide, your email address, your rating, your review text, and any photos you choose to upload) and the messages you send to our AI chat assistant (see the dedicated sections below).
  • Communications with us including the information you include in communications with us, for example, when sending a customer support inquiry through our Contact page.
  • Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers. In our own booking, chat, and review systems we store your IP address only in a shortened, hashed form used for security and spam prevention.
  • Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.

We do not offer customer accounts on our store, so we do not collect usernames, passwords, or security questions. If you choose to use Shopify features such as Shop Pay, Shopify handles that information under its own privacy policy (see "Relationship with Shopify" below).

Personal Information Sources

We may collect personal information from the following sources:

  • Directly from you including when you visit or use the Services, place an order, book a pickup or delivery, submit a review, use the chat assistant, communicate with us, or otherwise provide us with your personal information;
  • Automatically through the Services including from your device when you use our products or services or visit our websites, and through the use of cookies and similar technologies;
  • From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf;
  • From our partners or other third parties.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

  • Provide, Tailor, and Improve the Services. We use your personal information to provide you with the Services, including to perform our contract with you, to process your payments, to fulfill your orders, to send notifications to you related to your orders, to process purchases, returns, exchanges or other transactions, to arrange shipping, pickup and delivery, to facilitate any returns and exchanges, to enable you to post reviews, and to create a customized shopping experience for you. This may include using your personal information to better tailor and improve the Services.
  • Marketing and Advertising. We may use your personal information to send promotional communications by email (for example, an invitation to review a product you purchased) and to measure and improve our online advertising, as described in "Analytics and Advertising" below. We do not send marketing text messages or postal mail.
  • Security and Fraud Prevention. We use your personal information to provide a secure payment and shopping experience, detect, investigate or take action regarding possible fraudulent, illegal, unsafe, or malicious activity, protect public safety, and to secure our services, including rate limiting and spam prevention on our chat, booking, and review forms.
  • Communicating with You. We use your personal information to provide you with customer support, to be responsive to you, to provide effective services to you and to maintain our business relationship with you.
  • Legal Reasons. We use your personal information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, potential or actual litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

  • With Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping). The main service providers we use are listed in "Service Providers We Use" below.
  • With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalized advertising with third-party services based on your online activity with different merchants and websites, and we use Google advertising and analytics services as described in "Analytics and Advertising" below. Our business and marketing partners will use your information in accordance with their own privacy notices. You can opt out of personalized advertising as described in "Analytics and Advertising" below and through the Shopify Privacy Portal linked in "Relationship with Shopify".
  • When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as when we arrange to ship products to you.
  • In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

Service Providers We Use

Beyond Shopify, we use a small number of service providers to run specific features of the Services:

  • Shopify Inc. hosts our store and processes orders, payments, and customer records (see "Relationship with Shopify" below).
  • Cloudflare, Inc. (United States) provides the cloud infrastructure that runs our chat assistant, pickup and delivery booking, and customer review features, including the databases and file storage where that information is kept, and the Turnstile anti-spam check on our review form.
  • Anthropic, PBC (United States) is the AI provider that processes chat messages to generate the assistant's replies.
  • Google LLC (United States) provides the analytics and advertising services described in "Analytics and Advertising" below.
  • Telegram (a messaging service with servers outside Canada) is used to send our own staff real-time notifications about pickup and delivery bookings, as described in "Pickup and Delivery Booking" below.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, we use certain Shopify enhanced features that draw on data about how shoppers interact with our store, with other Shopify stores, and with Shopify itself. Where Shopify provides these features, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain rights with respect to your personal information here: Shopify Privacy Portal.

AI Chat Assistant

Our website offers an AI chat assistant to answer questions about our products, sizing, and policies. When you use it, we collect the messages you send and the assistant's replies, along with the date and time, the page of our site you were on when you sent the message, and a hashed (encoded) version of your IP address used for rate limiting and abuse prevention. If you answer the "Was this helpful?" prompt, we also record your rating together with the related question and answer. To generate replies, your messages are processed by our AI provider, Anthropic, and chat records are stored on our behalf by Cloudflare. We review chat logs, including with automated AI tools, to improve our assistant, our products, and our help content. Chat logs are kept until we delete them, and you can ask us to delete your chat records at any time using the contact details below. Because chats are not linked to your name or email address, please tell us roughly when you chatted and what about, so we can find the right records. Please don't enter sensitive personal information (such as full payment card numbers, passwords, or government ID numbers) into the chat. To place an order use secure checkout, and for order-specific matters use our Contact page.

Pickup and Delivery Booking

When you book, change, or cancel a pickup or delivery time on our booking page, we collect your order number, your email address, the name on your order, and your chosen time slot, together with the date and time of the booking and a hashed (encoded) version of your IP address used for spam prevention. If you use the "I'm here" button when you arrive for a pickup, we also record your arrival time. We use this information to verify the booking against your order and to schedule and manage your pickup or delivery. Booking records are stored on our behalf by Cloudflare, and we delete past and cancelled booking records from time to time.

So that our staff can prepare your order, booking notifications (your name, order number, and booked time slot) are sent to our staff through Telegram, a messaging service whose servers are located outside Canada. No payment information or street address is sent this way.

Customer Reviews

If you submit a product review, we collect the name you provide, your email address, your rating, your review text, and any photos you choose to upload. Your name, rating, review text, and photos are displayed publicly on our website; please only include information and images you are comfortable sharing publicly. Your email address is never displayed. We use it to check whether the review matches a past order (which is how a review earns its "Verified" badge) and, if needed, to contact you about your review. We may decline to publish, edit for clarity, or remove reviews that contain inappropriate content, links, or personal information. Review submissions are protected from spam by Cloudflare Turnstile, which checks signals from your browser to tell people apart from bots. Reviews and photos are stored on our behalf by Cloudflare and remain published until you ask us to remove them or we take them down. Some reviews shown on our site were originally posted by customers on marketplaces where we previously sold and have been republished here; contact us if you would like such a review corrected or removed. After a purchase, we may email you an invitation to leave a review; you can ask us at any time to stop sending you review invitations (see "Your Rights and Choices" below).

Analytics and Advertising

We use Google services to understand how visitors use our site and to measure our advertising:

  • Google Analytics 4 collects information about how you use our site, such as pages viewed, approximate location, and device information, using cookies and similar technologies.
  • Google Ads and Google Tag Manager help us measure whether our ads led to a visit or purchase, and may be used to show you relevant ads.
  • Google Merchant Center lets our products appear in Google search and shopping results.

Google processes this information under its own privacy policy. You can opt out of personalized advertising at Google Ads Settings, install the Google Analytics opt-out browser add-on, or block cookies in your browser settings. Shopify also uses cookies to run the store (for example, to keep items in your cart); you can learn more in the Shopify Cookie Policy.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Anything you post publicly, whether on our site or on social media, can be seen and used by others. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on why we hold it. In general: order and transaction records are kept as long as required for accounting, tax, and legal purposes; pickup and delivery booking records are deleted from time to time once the booking is in the past; published reviews remain until removed; and chat logs are kept until we delete them or you ask us to. You can request deletion of your information at any time (see "Your Rights and Choices" below).

Your Rights and Choices

Under Canadian privacy law you have rights in relation to your personal information. These rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

  • Right to Access / Know. You may request access to the personal information we hold about you.
  • Right to Delete. You may request that we delete personal information we maintain about you, including your chat history, reviews and photos, and booking records.
  • Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
  • Right of Portability. You may request a copy of the personal information we hold about you and ask that we transfer it to a third party, in certain circumstances and with certain exceptions.
  • Managing Communication Preferences. We may send you promotional emails, such as an invitation to review a product you purchased. You may opt out at any time by contacting us, and we will stop within 10 business days. If you opt out, we may still send you non-promotional emails, such as those about orders you have made.

Requests cover information held in Shopify as well as in our own systems (chat logs, reviews, and booking records). You may exercise any of these rights where indicated on the Services or by contacting us using the contact details provided below. To learn more about how Shopify uses your personal information and any rights you may have regarding data processed by Shopify, you can visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada or, depending on where you live, your provincial privacy regulator.

International Transfers

We are based in Ontario, Canada. Some of our service providers, including Shopify, Cloudflare, Anthropic, Google, and Telegram, process and store information on servers that may be located outside Canada, primarily in the United States. While your personal information is outside Canada, it is subject to the laws of the country it is in and may be accessible to the courts, law enforcement, and national security authorities of that country.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at sales@exosdoor.ca, call us at 519-574-3803, or write to us at the address below. The owner of Exos Door is the person responsible for the protection of personal information at Exos Door.

520 Conestogo Rd W, Waterloo, ON, N2L 4E2, CA