Privacy Policy — Polestar Bakery Bulk Supply Ltd — Polestar Bakery Bulk Supply Ltd

Table of contents

1. Who we are
2. What we collect
3. Why we collect it
4. Legal basis
5. Who we share it with
6. How long we keep it
7. How we protect it
8. Cookies & local storage
9. Your rights
10. Children
11. Data breaches
12. Changes to this policy
13. Contact us

1. Who we are

This online ordering portal is operated by Polestar Bakery Bulk Supply Ltd — Polestar Bakery Bulk Supply Ltd (the "Bakery", "we", "us") on the Coral Soft Bake multi-tenant platform. The Bakery is the data controller for the personal information collected through this portal. Coral Soft Bake acts as the data processor, providing the technical infrastructure required to operate the service.

This policy applies to all visitors and registered clients of the portal, including public clients (individuals ordering for personal use) and business clients (companies ordering wholesale).

2. What we collect

We collect only the information necessary to process your orders.

2.1 Information you provide directly

Category	Examples	Required?
Identity & contact	Name, company name, email, phone, billing address, delivery address	Yes (to create an account and process orders)
Account credentials	Username, password (stored only as a bcrypt hash — never in plain text)	Yes
Order information	Products ordered, quantities, prices, delivery dates, PO numbers	Yes
Payment reference	Interac e-Transfer reference number (optional, for reconciliation)	No
Free-text notes	Comments on your order or account	No

2.2 Information collected automatically

Category	Purpose
IP address	Security, rate limiting, fraud prevention, audit logs
User agent (browser + OS)	Security, troubleshooting, audit logs
Login timestamps	Session security and audit trail
Session cookies	Keep you logged in during your visit

2.3 Information we do NOT collect

❌ Payment card numbers, CVV, or banking credentials — we never receive them.
❌ Government identifiers (SIN, passport, driver's licence).
❌ Health, biometric, or genetic data.
❌ Location tracking (GPS).
❌ Third-party advertising identifiers.
❌ Data from social media logins (we do not offer them).

3. Why we collect it

Fulfill your order — prepare, pack, and deliver the products you ordered.
Identify you — confirm you are the account holder when you log in or reset your password.
Communicate — send order confirmations, delivery notifications, and (only if you are a business client) invoice reminders.
Process payment — reconcile your Interac e-Transfer to the correct order.
Comply with the law — retain sales records as required by the Canada Revenue Agency (CRA).
Protect the service — detect and block fraudulent registrations, brute-force login attempts, and abuse.
Improve the service — aggregated, anonymized statistics only (no individual profiling, no third-party analytics).

4. Legal basis for processing

Under PIPEDA and Quebec Law 25, we rely on the following legal bases:

Purpose	Legal basis
Creating your account and processing orders	Performance of a contract — we cannot fulfill your order without this information.
Security logs (IP, user agent, login attempts)	Legitimate interest — protecting the service and its users from fraud and abuse.
Retaining sales records	Legal obligation — Canadian tax law requires 7-year retention.
Sending you a password reset email	Contract + explicit request — you asked for it.
Sending a welcome email at registration	Contract — part of account creation.

We do not send marketing emails. If we ever introduce marketing, you will be asked for explicit, separate, opt-in consent (CASL-compliant), and you will be able to withdraw it at any time.

We do not sell, rent, or trade your personal information. We share it only with the following trusted service providers, and only to the extent required to operate the portal:

Recipient	Purpose	Location
Mailgun Technologies, Inc.	Delivers order confirmation and password reset emails	USA (EU-US Data Privacy Framework certified)
Hosting provider	Hosts the portal and the database (Canada or USA)	Data centre location listed on request
Coral Soft Bake	Provides the platform, acts as data processor, and handles technical support	Canada

We may also disclose information when required by law (court order, subpoena, CRA audit) or to protect the rights and safety of the Bakery, its staff, or other clients.

6. How long we keep it

Data	Retention	Why
Active client account	While active	Service delivery
Inactive client account	2 years after last order	Reactivation window
Orders & order details	7 years	Canadian tax law (CRA)
Login attempt logs	90 days	Security forensics
Password reset tokens	Deleted after use or expiry (1 hour)	Security
Email queue (if used)	Deleted immediately after successful delivery	No PII retained
Backups	30-day rolling window	Operational recovery

When retention periods expire, personal identifiers are either permanently deleted or anonymized so that the record can no longer be linked to an individual. Anonymized sales data may be kept indefinitely for accounting and statistical purposes.

7. How we protect your information

Encryption in transit: the entire portal runs over HTTPS (TLS 1.2+).
Password hashing: passwords are stored using bcrypt with automatic rehashing on login.
CSRF protection: every form submission is protected with a session-scoped token.
Rate limiting: login and password-reset endpoints are rate-limited per IP and per account.
Session security: session IDs are regenerated on login and after password changes; sessions expire after 30 minutes of inactivity.
Access control: only authorized staff of the Bakery can view your orders, and only for the location where you placed them.
Audit logs: every administrative action (approval, password reset, role change) is logged with actor, timestamp, and IP.
Two-factor authentication: mandatory for all platform administrators and executives.
Data isolation: each bakery's data is isolated at the database level; one bakery can never see another's orders or clients.
Backups: daily encrypted backups retained for 30 days.

8. Cookies & local storage

We use only the cookies and local storage necessary to operate the portal. We do not use advertising or analytics cookies.

Name	Type	Purpose	Lifetime
`PHPSESSID`	Session cookie	Keeps you logged in	Until you close the browser or 30 min inactivity
`coralsoft_cart_*`	sessionStorage	Holds your shopping cart items during your visit	Until the tab closes or the order is submitted
`coralsoft_csrf`	Session cookie	Protects forms against cross-site request forgery	Session duration
`coralsoft_trusted_device`	Persistent cookie	Remembers your 2FA verification (executives only)	30 days
`coralsoft_pwa_dismissed`	localStorage	Remembers that you dismissed the "install app" banner	30 days

You can delete or block cookies at any time from your browser settings. Blocking session cookies will prevent you from logging in and placing orders.

9. Your rights

Under PIPEDA and Quebec Law 25, you have the following rights:

Right of access — request a copy of the personal information we hold about you.
Right to correction — ask us to correct inaccurate or incomplete information.
Right to deletion — ask us to delete your account and personal information (subject to legal retention obligations).
Right to withdraw consent — withdraw consent for any processing that relies on consent, at any time.
Right to data portability — request your data in a structured, machine-readable format (JSON or CSV).
Right to lodge a complaint — with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Quebec Access to Information Commission (cai.gouv.qc.ca).

To exercise any of these rights, contact us at the address in section 13. We respond within 30 days, as required by PIPEDA.

Account deletion: when you ask us to delete your account, we remove your name, email, phone, and address from our active systems within 30 days. Order records are retained for the legally required 7 years but are anonymized (replaced with [deleted]) so they can no longer be linked to you.

10. Children

This portal is intended for adults (18 years or older) placing orders on behalf of themselves or a business. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

11. Data breaches

If we become aware of a data breach that creates a real risk of significant harm to you, we will:

Notify you without unreasonable delay.
Report the breach to the Office of the Privacy Commissioner of Canada.
Provide you with details about what happened, what information was involved, and what steps we are taking.
Recommend actions you can take to protect yourself (e.g., password change).

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. When we make material changes, we will:

Update the effective date at the top of this page.
Display a notice on the order form for 30 days.
Send an email to registered clients when the change significantly affects their rights.

Continuing to use the portal after the effective date means you accept the updated policy.

13. Contact us

For any privacy question, request, or complaint, contact:

Privacy Officer — Polestar Bakery Bulk Supply Ltd — Polestar Bakery Bulk Supply Ltd

📧 Email: privacy@coralsoftbake.com

📧 Platform support: support@coralsoftbake.com

When contacting us, please include your client ID (e.g., PUB50 or your business username) and the email address associated with your account, so we can verify your identity before responding.

Response time: we acknowledge all privacy requests within 5 business days and provide a complete response within 30 days, as required by PIPEDA.

Last updated: 2026-10-15 · Policy version 1.0

← Return to login

🔒 Privacy Policy