Legal

Privacy policy

What Plantovia collects, why it is needed, and what you can ask us to do with it.

Last updated: 18 September 2026 Version: 2026-09-18 Privacy contact: plantovia.shop@gmail.com

Who is responsible for your information

Plantovia is a registered Ontario business name operated as a sole proprietorship by Liudmyla Koblytska, Ontario business identification number 1001448827. That person is the one accountable for the personal information described on this page, and is the privacy contact named above.

Mailing address

1502-3170 Golden Orchard Dr, Mississauga, ON L4Y 3G8

plantovia.shop@gmail.com, answered within 24 hours

What we collect, and why

Plantovia collects only what an order needs. There is no advertising network on this site, no tracking pixel, and nothing is collected for a purpose you are not told about here.

Name

So the courier, or we at pickup, know who the order is for.

Email address

It identifies your account, and it is where your order confirmation, receipt and any message about your delivery are sent.

Phone number

For a delivery, the courier texts this number: Uber sends the tracking link, the delivery updates and, on some runs, a handoff code the driver asks you for. For a pickup, we text it ourselves, from the store number in your order email, to tell you the order is ready and to arrange the handover. Without a working number neither can be completed.

Street address, city and postal code

Delivery orders only: something is being delivered there. The postal code is also checked against our serviced cities before an order can be placed, so nobody pays for a delivery we cannot make. A pickup order has no address and none is collected.

Pickup day and time window

Pickup orders only: the day and the stretch of the day you chose, so the order is packed and ready when you arrive.

Delivery time window

The stretch of the day you chose, so the courier run is booked when someone can receive it.

Delivery or pickup notes

An optional free-text box. Whatever you type there is stored on the order and read by the person packing it, so please put only what the delivery needs — a buzzer code or a gate instruction — and nothing you would not want kept on file.

Order history

The items, quantities, prices and totals of each order, kept so you can look up what you bought and so we can answer a question about a past delivery.

Your agreement records

When you place an order we store the two statements you ticked at checkout, the wording as it read that day, the version of the policy, and the time you accepted. This exists so that a disagreement later can be settled by what you actually agreed to rather than by memory.

Restock requests

If you tap Request restock on a plant, we store which plant, your account email and the date, so we can tell you when it returns. See restock notifications below.

Plantovia does not collect or store payment card details. Payment is by Interac e-transfer, which happens entirely inside your own bank — we never see your banking credentials, and no card number is ever entered on this site.

Where it is stored

Orders, accounts and restock requests are held in a Supabase database. Site files and request logs are served by Vercel. Order emails are sent through EmailJS.

Your order record stays in Canada. The Supabase project holding your account, your orders and your delivery details runs in the Canada (Central) region. It is not stored outside the country.

Two services that do operate outside Canada. Vercel hosts the site and keeps standard server request logs. EmailJS sends your order confirmation and receipt — which means the contents of those emails, including your name, phone number and delivery address, pass through servers outside Canada and are subject to the laws of the country they sit in, including lawful access requests by its authorities. By placing an order you consent to that transfer.

Who can see it

You, and the two owners of Plantovia. Nobody else.

That limit is enforced by row level security in the database itself, not merely by what the website chooses to show you. Each account can read only its own orders, its own profile and its own restock requests, and the rule is applied by the database on every single request. A stranger who bypassed the website entirely and spoke to the database directly would still get nothing back, because the restriction is not in the page — it is in the data.

The two owner accounts can read every order, because somebody has to pack them and book the courier. Each owner signs in under their own account with their own password and their own two-factor authentication — they do not share a login — and every administrative action is recorded against the individual who performed it.

We do not sell, rent or trade your information, and we do not share it with anyone for marketing.

Third parties who handle your information

Supabase

Database, accounts and authentication. Holds your account email, profile, orders and delivery details.

EmailJS

Sends your order confirmation, receipt and delivery-confirmation emails, and delivers anything you send through the contact form. Receives the contents of those emails, which includes your name, email, phone, delivery address and the order itself.

Vercel

Hosts the site and keeps standard server request logs, which include IP addresses. Vercel also provides the visitor counts described below. Neither is used to build a profile of you.

Uber (courier)

When a delivery is booked, the recipient name, delivery address and phone number are given to the courier service so the driver can reach you. Nothing about a pickup order is shared with Uber.

Each of these processes information on Plantovia's behalf in order to run the shop. None of them is given your information for their own marketing.

What this site stores in your browser

Plantovia sets no advertising cookies and no analytics cookies. There is nothing here that follows you to another website, which is why you are not being asked to dismiss a consent banner.

The site does count visits, using Vercel Web Analytics. It records the page visited, the referring site, and coarse details such as country, browser and whether the device is a phone or a desktop. It sets no cookie, stores nothing on your device for this purpose, and assigns you no identifier that persists between visits or follows you to any other website. It exists to answer questions like "which plants do people look at" and "where do orders get abandoned", and it cannot be used to single you out.

What the site does use is your browser's own local storage, on your device, readable only by this site:

Your cart, so it survives a refresh or a closed tab.
Your delivery details, so you are not retyping your address on every order. It is offered back to you as an autofill you have to accept.
Sign-in session and inactivity timing, so you stay signed in while you shop and are signed out after a long idle period.
Which plants you have asked to be restocked, so the button reads correctly when you come back.
A cached copy of the catalogue and site settings, so pages open quickly.

Clearing your browser's site data for plantovia.ca removes all of it. Doing so empties your cart and signs you out; it does not touch orders already placed, which live in your account.

If advertising, or any analytics that identifies you individually or follows you between websites, is ever added to this site, this section will change and consent will be asked for properly.

Restock notifications

Tapping Request restock on an out-of-stock plant is you asking us to email you about that plant, and we treat it as exactly that — consent to one commercial message, recorded with the date you gave it.

That email will identify Plantovia and carry our mailing address, and every one contains a way to opt out. You can also withdraw the request at any time by tapping the button again on the plant page, or by emailing us. We act on a withdrawal immediately and in no case later than ten business days.

Asking for a restock does not sign you up for anything else. Plantovia does not run a newsletter, and your order confirmations are not marketing — they are the record of a purchase you made, and they do not stop.

How long it is kept

Orders and receipts

Seven years from the order date. Canadian tax rules require business records to be kept for six years from the end of the tax year they relate to, and an order is a business record.

Your account and profile

Until you ask us to delete it.

Saved delivery details

Held in your own browser until you clear it, and on the most recent order until that order is deleted.

Restock requests

Until the plant is restocked and you have been told, or until you withdraw the request.

Server logs

Kept by Vercel under its own retention schedule, typically a matter of weeks.

What deleting your account does. Your profile, your saved details and your restock requests are removed. Your past orders are not, because we are required to keep them for the period above — but they stop being linked to a live account and are retained only as the sales record they are. If you want to know exactly what is still held about you after a deletion, ask and we will tell you.

Your rights

Under Canada's Personal Information Protection and Electronic Documents Act you can:

See what we hold. Most of it is already visible in your account and order history. Ask and we will send you the rest.
Correct it if it is wrong.
Have it deleted, subject to the record-keeping period above.
Withdraw your consent to restock emails, at any time.
Complain, to us first — and if we do not resolve it, to the Office of the Privacy Commissioner of Canada, at priv.gc.ca.

Email plantovia.shop@gmail.com from the address on your account. That inbox is monitored, and every message gets an answer within 24 hours. We will respond to a formal access or deletion request within 30 days.

Keeping it safe

Every connection to this site is encrypted. Passwords are hashed by Supabase and are never visible to us. Access to your data is restricted at the database level as described above, and the owner account requires two-factor authentication.

No system is perfect. If a breach ever put your information at real risk of significant harm, we will tell you and report it as the law requires.

Children

Plantovia is not directed at children and does not knowingly collect information from anyone under the age of majority in Ontario. Orders should be placed by someone able to enter into a contract.

Changes to this policy

If this policy changes, the date and version at the top change with it. A change that materially affects how your information is handled will be brought to your attention rather than quietly published.

Something here not clear?

Ask. A privacy policy nobody understands protects nobody.

Contact Plantovia Read the terms of sale