privacy policy.

Who we are

My Jungle Roots is a tropical houseplant shop based at 209 10th St, Hanover, Ontario, Canada. This policy explains how we handle the personal information you share with us when you visit our website, place an order, sign up for our newsletter, or chat with our Ask Jungle assistant. We are the controller of this information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

We collect only what we need to fulfil your order and run our shop:

• Order information. Your name, shipping address, email, phone (optional), and the items you bought.
• Account information. If you create an account, your email and a hashed password (or a Google sign-in identifier).
• Cart information. The items in your cart, kept locally in your browser and optionally synced to your account if you're signed in.
• Newsletter sign-up. Just your email address.
• Ask Jungle chat transcripts. The questions you ask our AI assistant and the responses it gives, used only to improve the assistant.
• Browser and device telemetry. IP address, browser type, pages visited, and similar information collected automatically by analytics tools (see §How we share it).
• Payment details. We never see or store your card number. Payment information is collected directly by Square through their secure payment form.

How we collect it

We collect information directly from you when you fill in a form (checkout, newsletter, account sign-up), when you talk to our Ask Jungle chat widget, and when payment information is collected by Square's secure payment form on our checkout page. We collect browser and device telemetry automatically when you visit our site, through the third-party services listed below.

How we share it

We work with the following service providers. Each one receives only the information they need to do their job:

Square (Block, Inc.)

Processes your payment and stores our product catalog and inventory. Receives your name, billing/shipping address, email, order details, and payment information.

Supabase

Hosts our database and handles account authentication. Receives your account email, hashed password, order records, and saved cart contents. Servers are located in Canada and the United States.

PostHog

Product analytics. Receives anonymous usage events such as which pages you view and how far you progress through checkout. Used to improve the shopping experience.

Google Tag Manager

A separate container that loads its own configured tags on our site. PostHog loads directly through our app's own analytics code, not through GTM.

Microsoft Clarity

Session replay and heatmaps. Records anonymized interactions on our site (clicks, scrolls, page navigations) so we can fix usability problems. Form input fields and payment data are masked.

Resend

Sends our transactional emails — order confirmations, newsletter welcomes, shipping notifications. Receives your email address and the message contents.

Anthropic

Provides the language model that powers our Ask Jungle chat assistant. Receives the messages you type into the chat. Anthropic does not train its models on data sent through their API.

Google Maps

Embeds the map of our shop on the About page. When you view the embed, your IP address is shared with Google.

N8N

Self-hosted automation tool we run internally to coordinate order workflows (shipping notifications, abandoned cart reminders). Holds the same order and email data as Resend and Supabase.

Sentry

Error monitoring. When something breaks on our site, Sentry receives an error report containing your IP address, the page URL, and your browser type so we can fix the problem. No card data is ever included.

Shippo

Shipping labels and carrier rates. Receives your name and shipping address so we can buy a Canada Post or courier label for your order.

Vercel

Hosts our website. Receives standard request logs (IP address, page requested, browser type) as part of serving the site.

Cloudflare

DNS and image delivery network. Receives standard request logs (IP address, image requested, browser type) when product images are loaded.

We do not sell your personal information to anyone, ever.

Cookies and tracking

Cookies are small files stored in your browser. We use two kinds:

• Functional cookies. Required for the site to work — for example, keeping you signed in, remembering your cart, processing payment.
• Analytics cookies. Used by PostHog and Microsoft Clarity to understand how visitors use the site. Your choice in our cookie banner (accept or decline) is the main way to control these. If your browser sends a Do Not Track signal, we also turn off PostHog analytics for you, even if you already accepted. Do Not Track does not affect Google Tag Manager or Microsoft Clarity.

How long we keep your data

We keep order and account data for as long as your account is active, plus the period required by Canadian tax law (currently six years). Saved carts expire after 30 days. Abandoned cart sessions expire after 7 days. Newsletter subscriptions are kept until you unsubscribe.

Analytics data is retained according to each provider's default policy (typically 12–13 months for PostHog and Microsoft Clarity).

Your rights under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access the personal information we hold about you;
• Request that we correct any information that's wrong or out of date;
• Request that we delete your information (we'll do so unless we're required by law to keep it);
• Withdraw your consent for any optional processing (such as marketing emails) at any time;
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe we've mishandled your information.

To exercise any of these rights, email us at hello@myjungleroots.ca. We'll respond within 30 days.

Children's privacy

Our shop is intended for adults. We don't knowingly collect personal information from anyone under the age of 13. If you believe we've received information from a child under 13, please email us and we'll delete it right away.

International data transfers

Some of the service providers listed in §How we share it are based in the United States or operate servers outside Canada. When your information is processed in another country, it's subject to the laws of that country, which may differ from Canadian privacy law. We pick providers that publish industry-standard privacy commitments and security practices.

How we protect your data

Our site is served over HTTPS. Account passwords are stored as one-way hashes — never in plain text. Database access is restricted by row-level security policies, so you can only see and modify your own records. Payment information is collected by Square through their PCI-compliant payment form and never touches our servers. We use environment-based credentials and rotate them when team members change.

Changes to this policy

If we make a material change to how we handle your information, we'll update the “Last updated” date at the top of this page and, if the change is significant, we'll let our newsletter subscribers know directly. The current version of this policy always lives at myjungleroots.ca/privacy.