Privacy Policy

1. Who is responsible

Terra Bath & Body is the data controller for the personal information we collect through terrabath.com. Our studio is located in Ajax, Ontario, Canada (Greater Toronto Area). Our designated Privacy Officer can be reached at privacy@terrabath.com for any privacy question, request, or concern.

2. What we collect

• Account details: name, email address, phone number, password (stored as a salted hash — we never see the plain text).
• Order details: shipping and billing addresses, items purchased, prices, taxes, and fulfillment status.
• Payment metadata: Stripe customer and payment-method identifiers. Full credit-card numbers are entered directly into Stripe's secure form and are never stored on our servers.
• Course and usage data: pages viewed, course progress, lesson watch time, and basic analytics so you can resume a lesson where you left off and so we can improve the site.
• Communications: messages you send through the contact form, email, or customer-care channels.
• Soap calculator: if you email a recipe export, we store your email and recipe snapshot to deliver that message; optional newsletter opt-in is recorded separately. If you save recipes to My Recipes, we store your formula, notes, and optional photo.
• Technical data: IP address, browser type, device type, and approximate location, collected automatically through cookies and server logs.

You are not required to provide all of this information, but some of it is necessary to create an account, complete a purchase, or access a course.

3. Why we collect it (purposes and consent)

• To process orders, ship them with Stallion Express, and provide customer service.
• To grant access to training content you have purchased and to track your progress.
• To send transactional emails — order confirmations, tracking, password resets, course-unlock notifications.
• To send marketing emails about new products, restocks, and promotions only when you have opted in; an unsubscribe link is included in every marketing email, as required by CASL.
• To detect and prevent fraud, debug the site, and meet our legal obligations (for example, retaining tax records).

We rely on your consent to use your information for the purposes described above. Where the law allows, we may rely on implied consent for purposes that are obvious from the context — for example, using your shipping address to deliver an order you placed. You can withdraw consent for any non-essential purpose at any time by emailing the Privacy Officer or, for marketing email, by clicking "unsubscribe."

4. Who we share it with

We share personal information only with the service providers needed to operate the store, and only the information they need to do their job:

• Stripe — payment processing and subscription billing.
• Stallion Express — shipping rates, label generation, and tracking.
• Resend — transactional and (opted-in) marketing email delivery.
• Cloudflare — content delivery, DDoS protection, and bot mitigation.
• Hosting and database providers used to run our site and store account data securely.

Each provider is bound by contractual confidentiality and data-protection obligations. We do not sell or rent your personal information. We may also disclose information when required by law (for example, in response to a valid court order) or to protect our rights, our customers' safety, or the integrity of the site.

5. International transfers

Some of our service providers (including Stripe, Resend, and Cloudflare) process information on servers located in the United States or other countries outside Canada. While the information is in another country it may be subject to that country's laws, including lawful access by foreign authorities. We use providers with strong reputations and contractual safeguards to protect your information. If you have questions about cross-border transfers, contact our Privacy Officer.

6. Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary: authentication, the cart session, security, and load balancing. These cannot be turned off.
• Functional: remembering preferences such as language and locale.
• Analytics: understanding aggregate, non-identifying usage of the site.
• Marketing: set only after you opt in through the cookie-consent banner, where applicable.

You can control cookies through your browser settings; blocking strictly necessary cookies may break parts of the site (for example, the cart).

7. Security

We take reasonable physical, technical, and administrative steps to protect personal information from loss, theft, and unauthorised access, use, or disclosure — including encryption in transit (HTTPS), encrypted password storage, role-based access controls, and minimum-data principles. No system is perfectly secure; if you suspect your account has been compromised, contact us immediately.

8. Retention

• Account information is retained for as long as your account is active.
• Order, tax, and payment records are retained for at least seven years as required by Canadian tax law.
• Course access and progress remain associated with your account for as long as the account exists.
• Marketing-consent records are retained as long as the consent is in force, plus a reasonable period afterwards to demonstrate compliance with CASL.

When information is no longer required we delete it or anonymise it.

9. Your rights

You have the right, under PIPEDA, to:

• request access to the personal information we hold about you;
• request correction of information that is inaccurate or incomplete;
• withdraw your consent for non-essential uses (subject to legal and contractual requirements);
• request deletion of your account and associated data, subject to records we are required by law to retain.

Send requests to privacy@terrabath.com. We respond within 30 days, as required by PIPEDA, and may ask you to verify your identity before releasing or changing information.

10. Children's privacy

The site is intended for adults aged 18 and over (the age of majority in Ontario). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact our Privacy Officer and we will delete it.

11. Complaints

If you are not satisfied with how we have handled your personal information, please first contact our Privacy Officer at privacy@terrabath.com so we can try to resolve the matter. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date above tells you when. Material changes will be highlighted on the homepage for at least 14 days.

13. Contact

Privacy Officer, Terra Bath & Body — privacy@terrabath.com · Greater Toronto Area, Ajax, Ontario, Canada.