Privacy policy
Privacy Policy
Last updated: October 5, 2026
Atelier Alba Inc. (“Atelier Alba”, “we”, “us”) operates the website at atelieralba.ca and the floral design and delivery services offered through it (the “Services”). We are based in Toronto, Ontario, Canada. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.
We are the organisation responsible for your personal information. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls on matters of personal information.
Information We Collect
Order and contact details — your name, email address, phone number, billing address, and the delivery address you give us.
Recipient details — where you are sending flowers to someone else, the recipient’s name, phone number, delivery address and any access instructions, plus the gift card message you ask us to write.
Payment information — your payment is processed by Stripe on Stripe’s own checkout page. We never receive or store your full card number, expiry date or security code. We receive only confirmation of payment, the last four digits, the card brand, and the billing details you entered.
Correspondence — what you write to us by email or through our contact, enquiry and waitlist forms.
Technical and usage information — your IP address, device and browser type, pages viewed, items viewed or added to cart, referring site, and approximate location derived from IP address.
Session recordings — if you accept analytics cookies, we record a playback of your visit. See Session recording below.
We do not ask for and do not want government identifiers, health information, or financial account numbers. Please do not send them to us.
How We Use It
To fulfil your order — to take payment, make your arrangement, deliver it, keep you informed, and handle any issue afterwards. This is necessary to perform our contract with you.
To communicate with you — order confirmations, delivery windows, proof-of-delivery photographs, and replies to your enquiries.
To improve the Services — to understand which pages and products people engage with, and where the site confuses or frustrates people.
Marketing and advertising — only with your consent, to send you our newsletter and to show you advertising on Google and Meta platforms. We send news only to people who ticked Send me seasonal news from the atelier or joined our list, and every email lets you unsubscribe. You can withdraw consent at any time.
Security, fraud prevention and legal compliance — to protect the Services and to meet our legal obligations, including tax and accounting records.
Cookies, Analytics and Your Consent
When you first visit, we show you a banner. Until you choose, no analytics or advertising technology loads at all. Only the storage strictly necessary to run the site — remembering your cart and your choice on the banner — is used.
If you accept, we enable the measurement and advertising tools listed below. If you decline, they are not loaded and we receive no analytics about your visit. You may change your mind at any time by clearing this site’s data in your browser, which makes the banner appear again.
Session Recording
If you accept analytics cookies, we use Microsoft Clarity to record a playback of your visit: pages viewed, mouse movement, scrolling, clicks and taps. We use this only to find and fix usability problems.
We instruct Clarity to mask the text you type into personal fields, including the name, email, phone and message fields on our contact and enquiry forms and the newsletter field. Your payment details are never recorded because payment happens on Stripe’s own website, not ours. We do not use these recordings to identify individuals or to make decisions about you.
Who We Share It With
We do not sell your personal information. We share it with the following service providers, each of which processes it on our behalf under their own privacy terms:
Cloudflare, Inc. — website hosting, content delivery, DNS and security. Processes your IP address and request data.
Stripe, Inc. — payment processing, and the receipt Stripe emails you.
Mailbeams and Amazon Web Services (Amazon SES) — sending our order confirmations and transactional email.
Google LLC — Google Analytics 4 and Google Tag Manager for measurement, Google Ads for advertising and conversion measurement, and Google Merchant Center for our product listings. Loaded only with your consent, and operated under Google Consent Mode.
Meta Platforms, Inc. — the Meta Pixel, for measuring and targeting advertising on Facebook and Instagram. Loaded only with your consent.
Microsoft Corporation — Microsoft Clarity, for heatmaps and session recordings as described above. Loaded only with your consent.
Birch Team, Inc. — a marketing data relay configured on our Meta advertising account, which forwards Meta Pixel events on our behalf. Loaded only with your consent.
Microsoft 365 — our business email, where your correspondence with us is held.
We may also disclose personal information where required by law or valid legal process, to enforce our Terms, to protect our rights or the safety of others, or in connection with a sale or reorganisation of our business.
International Transfers
We are in Canada, but several of the providers above are based in the United States or process data there and in other countries. Those countries may not offer the same legal protections as Canada, and personal information held there may be accessible to foreign courts, law enforcement and national security authorities. We share information with them only as needed to run our business, and under contractual terms requiring them to protect it.
How Long We Keep It
Order and transaction records — seven years, to meet Canadian tax and accounting obligations.
Correspondence, celebration enquiries and proposals — up to three years from our last exchange, in our private client register.
Newsletter subscription — until you unsubscribe.
Session recordings and analytics — according to the retention period of each provider, generally no more than 30 days for recordings and 14 months for analytics.
Security
The site is served entirely over HTTPS. Payment is handled by Stripe, a certified PCI Service Provider Level 1, so card data never reaches our systems. We limit access to order information to the people who need it to prepare and deliver your flowers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your Rights
Subject to applicable law, you may ask us to:
give you access to the personal information we hold about you;
correct information that is inaccurate or incomplete;
delete information we no longer need to keep;
stop sending you marketing, at any time, which you can also do using the unsubscribe link in any newsletter;
withdraw a consent you previously gave.
Write to [email protected] and we will respond within 30 days. We may need to verify your identity first. If you are a resident of Quebec, the European Economic Area or the United Kingdom, you may have additional rights, including data portability and the right to object to certain processing; tell us and we will honour them.
If you received flowers from us and want to know how we obtained your details, or want them deleted, write to us at the same address. Your details were given to us by the person who sent you the flowers, for the purpose of making that delivery.
Children
The Services are intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to us and we will delete it.
Complaints
If you are not satisfied with how we have handled your personal information, please contact us first so we can put it right. You also have the right to complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à l’information.
Third Party Links
Our site may link to websites we do not operate. We are not responsible for their privacy practices, and we encourage you to read their policies.
Changes to This Policy
We may update this Privacy Policy. We will change the date at the top whenever we do, and where the change is significant we will say so on the site.
Contact
Atelier Alba Inc., Toronto, Ontario, Canada. Privacy enquiries: [email protected].