What we collect,and what we don't.

Novelo Coffee ("Novelo", "we", "our", "us") is a sole proprietorship registered in the Province of Ontario under the Business Names Act. Business identification number (BIN): 1001665746. Sole proprietor: Hanad Sahal Hassan. Registered business name: NOVELOCOFFEE.

You can reach our privacy office at novelocoffee@gmail.com. Postal correspondence: Novelo Coffee, Toronto, Ontario, Canada.

Because we sell to Canadian residents from Ontario, we comply with:

• PIPEDA — the Personal Information Protection and Electronic Documents Act.
• CASL — Canada's Anti-Spam Legislation, governing our commercial electronic messages.
• Consumer Packaging and Labelling Act — governing bilingual product labels.
• Applicable provincial consumer protection statutes in the province where you receive your order.

We only collect what we need to sell you coffee and support you.

• Order data: name, shipping address, email, and order contents. Payment card details are handled by Stripe and never touch our servers.
• Newsletter / waitlist: email address and the source of your signup (footer, home teaser, product page, etc.).
• Contact form: name, email, and the message you send us.
• Chatbot transcripts: the full conversation you have with our assistant is stored so we can improve the service and follow up if you asked us to.
• Technical data: standard access logs (IP, user agent, timestamps) kept for security and abuse prevention.

• To fulfill and ship your order.
• To answer your questions and provide customer support.
• To send you promotional email only if you explicitly opted in. Every email includes an unsubscribe link.
• To detect and prevent fraud, abuse and unauthorized access.
• To comply with legal, tax and accounting obligations.

We do not sell your personal information. We share it only with:

• Stripe, Inc. — payment processing. Governed by Stripe's Privacy Policy.
• MongoDB Atlas (Canadian region where available) — encrypted database storage for orders, waitlist and chat.
• Anthropic PBC — our chatbot is powered by Claude Sonnet. Conversations are processed by Anthropic to generate replies.
• Shipping carriers (Canada Post and equivalents) — for name, shipping address and tracking updates.
• Legal / regulatory bodies — if compelled by a valid Canadian legal process.

We use a minimum of cookies — session storage for your cart, and localStorage for the chat widget session identifier. We do not currently run third-party marketing pixels, Google Analytics, or cross-site trackers. If that changes we will update this page and notify newsletter subscribers.

• Order records: 7 years (Canada Revenue Agency requirement).
• Newsletter subscribers: until you unsubscribe (one click, every email).
• Waitlist entries: until you're notified + 90 days.
• Chatbot transcripts: 24 months, then permanently deleted.
• Access logs: 90 days for security investigation, then permanently deleted.

You have the right to:

• Know what personal information we hold about you.
• Ask us to correct anything that is inaccurate.
• Ask us to delete your data (subject to legal retention rules).
• Withdraw your consent for marketing emails at any time by clicking unsubscribe or emailing us.
• File a complaint with the Office of the Privacy Commissioner of Canada if you feel we've mishandled your data.

To exercise any of these rights, email novelocoffee@gmail.com with the subject line "Privacy Request". We'll respond within 30 days.

Data in transit is protected by TLS. Payment card data never touches our infrastructure — Stripe handles it end to end and is PCI-DSS Level 1 certified. Database access is restricted to the sole proprietor and any contracted personnel bound by a written confidentiality agreement.

Novelo Coffee is a food product intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has submitted information to us, please contact us and we will delete it promptly.

Some of our service providers (Stripe, Anthropic, MongoDB) operate servers outside Canada. Where cross-border transfer occurs, your data remains subject to comparable protections and to any subpoenas or lawful orders of the foreign jurisdiction.

We may update this policy from time to time. Material changes will be announced at the top of this page and notified to newsletter subscribers. The date at the top always reflects the last revision.