Privacy policy

Last updated: August 20, 2026

illuscyn is a small independent shop run by one person in Ontario, Canada. This policy explains what personal information the shop collects, why, who it is shared with, and what you can ask for. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What is collected

When you place an order, the following is collected so the order can be taken and shipped:

• Your name
• Your email address
• Your phone number
• Your shipping address, and billing address if it differs
• A list of the items you ordered, and the amount paid

Payment card details are never seen or stored by illuscyn. Card information is entered on a payment page hosted by Stripe and handled entirely by Stripe. The shop only receives confirmation that a payment succeeded.

When you browse, your own browser stores two things on your device:

• the contents of your shopping cart, so it survives a page refresh;
• whether you selected Canada or the United States for shipping.

Both stay on your device, are never transmitted to illuscyn, and you can clear them at any time through your browser settings. They are needed for the cart to work — they are not used to track you.

Counting visits

So that I know which things people actually like, this shop counts its own visits. It does that itself, and the counts are stored in this shop's own database — they are never sent to Google, Meta, or any other company.

What is recorded when you look at a page:

• which page it was, and how long it was open and on screen
• how far down the page you scrolled
• the website or app you followed a link from, if any
• whether you are on a phone, a tablet or a computer
• your country — never your city, and never your address
• if you searched, the words you typed
• if you added something to your basket or went to checkout

To tell one visit from two, your browser is given a random number kept in tab memory. It is not a cookie, it is not stored on your device, and it is erased the moment you close the tab. It cannot follow you to another website, and it cannot recognise you if you come back tomorrow.

Your IP address is never stored. It is used once, in passing, to look up the country, and then it is gone. Nothing above is ever linked to your name, your email, or your order. If you buy something, the order records which website sent you here — never which pages you looked at.

These counts are kept for about a year and then deleted. If your browser sends a Global Privacy Control signal, none of this is recorded at all.

What is not collected

There are no advertising pixels and no third-party trackers on this site. No Google Analytics, no Meta or Facebook pixel, no TikTok pixel, nothing similar. No profile of you is built, you are not followed across other websites, and nothing is sold or rented to anyone, ever.

There is currently no mailing list. You will not receive marketing email as a result of ordering — only messages about your actual order.

Why it is collected

• To process your payment and fulfil your order
• To send you an order confirmation, and a note when your parcel ships
• To contact you if there is a problem with your order
• To meet tax and business record-keeping obligations

Your information is not used for anything else without asking you first.

Who it is shared with

Stripe — payment processing. Stripe receives your name, email, phone, address and payment details in order to take the payment and guard against fraud. Stripe is based in the United States, so this information is stored and processed outside Canada and may be accessible to US authorities under US law. Stripe's own privacy policy is at stripe.com/privacy.

Shipping carriers — your name and address are given to the postal carrier so your parcel can be delivered.

Cloudflare — hosting. The shop runs on Cloudflare, and your order details (name, email, phone, shipping address and what you bought) are stored in a Cloudflare database so the order can be packed, tracked and looked up again. Only the shop owner can read it, behind a Google sign-in restricted to named accounts. Cloudflare is based in the United States and operates servers worldwide, so this information may be stored or processed outside Canada. Their privacy policy is at cloudflare.com/privacypolicy.

Resend — email. Your name and email address are passed to Resend so it can send you an order confirmation and a note when your parcel ships. Resend is based in the United States, so those details are processed outside Canada. It is used only for messages about your own order — there is no marketing list. Their privacy policy is at resend.com/legal/privacy-policy.

Nothing is shared with anyone else, except where the law requires it.

How long it is kept

Order records are kept for at least seven years, which is the period Canadian tax rules expect business records to be kept. That means your order details stay in the shop's records and in Stripe's, under Stripe's own schedule, for that period rather than being deleted when your parcel arrives.

If you would like your details removed sooner, email the address below. Anything not required by tax or consumer-protection law will be deleted, and you will be told what had to be kept and why.

Your rights

You can ask, at any time, to:

• see what personal information is held about you;
• have anything inaccurate corrected;
• have your information deleted, where no legal obligation requires keeping it;
• withdraw consent for any use that is not required to complete your order.

Email cynthiayuan1106@gmail.com and it will be answered within 30 days, as PIPEDA requires. If you are not satisfied with the response, you can complain to the Office of the Privacy Commissioner of Canada.

Security

The site is served entirely over HTTPS. Payment card data never touches this site — it goes directly to Stripe, which is PCI-DSS Level 1 certified. Order information is held in Stripe's dashboard behind an account protected by two-factor authentication.

Children

This shop is not directed at children under 13, and personal information is not knowingly collected from them. If you believe a child has provided information, email cynthiayuan1106@gmail.com and it will be deleted.

Changes to this policy

If this policy changes, the updated version will be posted here with a new date at the top. Material changes affecting how your information is used will be noted clearly.

Contact

Questions about privacy, or about this policy, go to cynthiayuan1106@gmail.com.

This policy describes how the shop actually operates today. It is not legal advice.