Privacy Policy

Effective Date: July 28, 2026

Misfit Boutique ("we," "our," or "us") respects your privacy and is committed to handling your personal information responsibly. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

Misfit Boutique is an independent Canadian small business based in Ontario, Canada. You can reach us at samantha@misfitboutique.ca with any privacy question.

1. Information We Collect

We only collect information that is necessary to run our shop and serve you as a customer. This includes:

• Customer account information — if you create an account: your name, email address, hashed password, and order history. • Contact form submissions — your name, email address, the subject and message you send us, and (optionally) your order number. • Order information — items purchased, order totals, applied discount codes, order notes, and order status. • Shipping information — recipient name, shipping address, phone number (if provided), and shipping method. • Payment information — payment is processed by Stripe on their hosted checkout. We do not collect, process, or store your full payment card details. Stripe returns to us only what is needed to complete your order (for example, the last four digits of the card, a confirmation reference, and billing name). • Communications — records of the emails and messages you send us, and our replies. • Newsletter subscription — your email address and first name if you opt in. • Cookies & website analytics — basic technical information about your visit (see Section 5).

2. How We Use Your Information

We use your information to:

• Process, fulfill, and ship your orders • Send order confirmations, shipping notifications, and password-reset emails through Resend, our transactional email provider • Respond to contact form messages and customer support inquiries • Send occasional newsletters if you have opted in (you can unsubscribe at any time) • Improve the website and our product offerings • Prevent fraudulent orders and protect our website • Comply with applicable legal and tax obligations

We do not sell or rent your personal information to anyone.

3. Third-Party Service Providers

To run our shop, we share the minimum necessary information with trusted service providers:

• Stripe — payment processing. Full card details are entered on Stripe's secure hosted checkout and never touch our servers. See stripe.com/privacy. • Resend — transactional email delivery (order confirmations, password resets, contact form notifications). See resend.com/legal/privacy-policy. • Etsy — where applicable, product listings, inventory, and order information may be synchronized with our Etsy shop via the Etsy Open API. • Shipping carriers — for label creation and delivery. • Hosting and infrastructure providers — that operate the servers on which our website runs. • Analytics tools — for basic, aggregated visit statistics (see Section 5).

Each provider only receives the information needed to perform its service, and each is bound by its own privacy policies.

4. Customer Accounts

If you create an account with us, we store your name, email, hashed password, and order history to make future shopping and support easier. You can request account deletion at any time by emailing samantha@misfitboutique.ca. Some information may need to be retained after account deletion for legal, tax, or fraud-prevention purposes (for example, records of completed orders).

5. Cookies & Website Analytics

Our website uses a small number of cookies and similar technologies to:

• Keep you signed in during your visit • Remember the items in your cart and wishlist • Recognize your device across page loads • Measure basic, aggregated website traffic (page views, general geography, referral source, device type) so we can improve the shop

We do not use cookies to build personal advertising profiles or to sell your browsing behaviour to third parties. Most browsers let you refuse or delete cookies through their settings; disabling cookies may affect features such as your cart or account login.

6. Marketing Emails

If you opt in to our newsletter ("the Misfit List"), we will occasionally send you release announcements, curated finds, and discounts. Every marketing email contains a clear unsubscribe link, or you may email samantha@misfitboutique.ca to be removed at any time. Transactional emails (order confirmations, password resets, and shipping updates) are not marketing emails and will still be sent even if you unsubscribe from the newsletter.

7. Data Retention

We keep your information only as long as needed for the purposes described above, or as required by law. Order records, invoices, and correspondence may be retained for at least seven (7) years to comply with Canadian tax and accounting requirements. Accounts and newsletter subscriptions may be deleted upon request, subject to those retention requirements.

8. Data Security

We use industry-standard measures to protect your information, including HTTPS/TLS across the website, hashed passwords, restricted access to production systems, and trusted third-party providers for sensitive functions such as payments. No online service can be guaranteed to be 100% secure, but we take reasonable steps to protect the information you entrust to us.

9. Your Rights

Under Canadian privacy law (including PIPEDA) and applicable provincial legislation, you have the right to:

• Access the personal information we hold about you • Request correction of inaccurate information • Request deletion of your account and associated personal information (subject to legal retention requirements) • Withdraw consent to marketing communications at any time • File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have not been respected

To exercise any of these rights, email samantha@misfitboutique.ca. We will respond within a reasonable timeframe.

10. Children's Privacy

Misfit Boutique is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Cross-Border Data Transfers

Some of our service providers (including Stripe, Resend, and hosting infrastructure) may store or process data outside of Canada, including in the United States. By using our website, you consent to your information being transferred to and processed in these jurisdictions, subject to their applicable privacy laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top will indicate when the policy was last updated. Continued use of our website after any changes constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, requests, or concerns, please contact:

Misfit Boutique Ontario, Canada samantha@misfitboutique.ca