Privacy policy — Castle Hill Decants

Who we are

Castle Hill Decants (“we”, “us”) sells fragrance decants online to customers in Canada and the United States. This policy explains what personal information we collect, why, and the choices you have. Questions can be sent to contact@joshyreal.com.

What we collect

Orders. When you check out, our payment provider Stripe collects your name, email address, shipping address, the items you bought and payment details. We receive your order and contact details, but never your full card number.
Reserve membership. If you join Castle Hill Reserve or sign in to vote, we keep your email address, shipping details, membership status, your fragrance picks, the boxes we’ve sent you and your vote. Stripe keeps your payment details.
Partners. If you’re one of our partners, we keep your name, email, the email you want payouts sent to, and the orders and commission linked to your code. Customers who use a partner’s code aren’t identified to that partner.
Email list. If you join our drop list, we collect your email address and a record of your consent.
Messages. If you contact us, we collect your name, email address, any order number you include and your message.
Technical information. Our hosting provider may log basic technical information such as IP address and browser type to keep the site secure and running.
Your browser. Your bag and currency choice are saved in your own browser so they’re there when you come back, and a cookie keeps you signed in if you use a member account. They stay on your device. We don’t use advertising trackers.

How we use it

To process, ship and support your order, including sending order and shipping updates.
To run your Reserve membership, including sign-in links, reminders to choose your decant and billing notices.
To answer your questions.
To send news about drops and offers, only if you’ve agreed to receive them.
To prevent fraud and keep our site secure.
To keep business records required by law, such as tax and accounting records.

Who we share it with

We share personal information only with service providers who help us run the shop, and only as needed:

Stripe, to process payments.
Netlify, to host our website and receive form submissions.
Resend, to send membership and sign-in emails.
Shipping carriers, who receive your name and address to deliver your order.

We may also disclose information where required by law. We do not sell your personal information.

Some of these providers store information outside Canada, including in the United States, where it may be subject to the laws of that country.

How long we keep it

We keep order records for as long as required for tax and accounting purposes. We keep your email address on our list until you unsubscribe, and we keep messages for as long as needed to help you.

Your choices

Unsubscribe from marketing emails at any time using the link in any email, or by emailing us.
Ask to see, correct or delete the personal information we hold about you, subject to legal record-keeping requirements.
Withdraw your consent to how we use your information, subject to legal or contractual limits.

To make a request, email contact@joshyreal.com. If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

Security

Payments are handled entirely by Stripe’s secure checkout. We use reputable providers and limit access to personal information to what’s needed to run the shop. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

Changes

We may update this policy from time to time. The date at the top shows when it was last changed.