Privacy Policy

FIOFIO is a brand operated by CivicAI. Address: 3260 rue Andante, Trois-Rivières, Québec G8V 0J6, Canada The person with the highest authority within the company is responsible for the protection of personal information, unless this responsibility has been formally delegated. For any question, access request, correction request, or complaint regarding your personal information:

commandes@fiofio.ca

We only collect the information necessary for our activities. When placing an order, depending on what is needed to fulfill it, we may collect:

• first and last name
• shipping address
• email address
• phone number, when necessary or provided
• order details
• shipping and order tracking information

When creating an account, we may collect:

• email address
• authentication and account management information

Passwords are protected (encrypted) and are never stored in plain text. We do not request personal information that is not necessary for these purposes.

We use your personal information only for determined and legitimate purposes, notably to:

• process and confirm your orders
• prepare and ship your purchases
• communicate your order status to you
• provide customer service
• manage your account
• ensure the security and operation of the site
• comply with our legal and regulatory obligations

We do not use your personal information for purposes incompatible with those for which it was collected without meeting the applicable consent requirements.

Payments made on FIOFIO are processed by Stripe, our payment services provider. The information needed to process your payment (including your card details) is sent directly to Stripe — FIOFIO never receives it and does not store your complete card data.

Stripe is responsible for its own personal information protection practices; we invite you to review its privacy policy.

FIOFIO receives a payment confirmation from Stripe, the amount, and the last 4 digits of the card used, for billing and customer service purposes.

To deliver your order, we share the necessary information with the carrier chosen — Canada Post or UniUni, the two carriers used by FIOFIO —, notably:

• recipient name
• shipping address
• phone number, when necessary
• information necessary for shipment tracking

This information is shared only to the extent necessary to fulfill the delivery.

We use the following service providers to run FIOFIO:

• Supabase — database, authentication, and product image storage
• Render — application hosting
• Cloudflare — content delivery network and bot protection (Turnstile) on login forms
• Stripe — payment processing
• Resend — transactional emails (order confirmation, refund, newsletter)
• Canada Post and UniUni — order delivery

These providers only have access to the information necessary to perform their services, subject to applicable contractual and legal obligations.

FIOFIO uses Supabase (database, authentication, storage) and Render (application hosting) as technology infrastructure providers. As of the writing of this policy, both services host your information in the United States (Ohio region).

Your personal information may therefore be hosted or processed outside Québec and Canada. Cloudflare, whose global network serves the site, may also route your information through servers located outside Québec.

When required by law, FIOFIO carries out a privacy impact assessment before disclosing personal information outside Québec and takes appropriate measures to ensure adequate protection of the information concerned.

FIOFIO uses cookies necessary for the site's operation, notably to:

• maintain a session
• retain certain cart items
• ensure security
• remember certain preferences

Google Analytics

FIOFIO uses Google Analytics (GA4) to understand how visitors use the site and to improve its services. Google Analytics (GA4) does not retain your complete IP address. FIOFIO does not use cookies for advertising retargeting or advertising profiling.

Bot protection

The login and password reset forms use Cloudflare Turnstile, a bot-verification tool, to prevent fraudulent access attempts.

Smart search

When you use the site's search, the text of your query — or, if you use photo search, the image you upload — may be sent to OpenAI to interpret its meaning (e.g., recognizing a category, colour, or item in a photo) — never your order or account information. Photos sent for search are not retained by FIOFIO beyond processing the request.

We keep personal information only for the period necessary for the purposes for which it was collected and for the duration necessary to comply with our legal, tax, accounting, and administrative obligations. When information is no longer necessary, it is deleted or securely destroyed, subject to applicable legal obligations.

FIOFIO implements reasonable and appropriate measures to protect personal information against unauthorized access, loss, alteration, disclosure, or unauthorized destruction, notably:

• encryption of communications via HTTPS
• secure authentication
• database-level security rules (each person can only access what belongs to them)
• access to information limited on a need-to-know basis
• passwords never stored in plain text
• infrastructure monitoring

However, no method of electronic transmission or storage can guarantee absolute security.

In the event of an incident involving personal information, FIOFIO will assess the situation and take the necessary measures in accordance with applicable laws. When an incident presents a risk of serious harm, FIOFIO will take the required measures, including notifying the affected individuals and, when necessary, the Commission d'accès à l'information. FIOFIO also maintains a register of privacy incidents in accordance with applicable requirements.

Subject to the exceptions provided by law, you may notably request:

• access to the personal information we hold about you
• correction of inaccurate or incomplete information
• information regarding the use or disclosure of your information
• withdrawal of your consent when processing is based on your consent
• deletion of certain information when permitted by law

To exercise your rights, please contact us at the address indicated in Section 1, or via our Contact page.

We may request certain information to verify your identity before responding to a request.

FIOFIO does not sell your personal information to third parties.

If you subscribe to our newsletter, you may unsubscribe at any time using the mechanism provided in the email received or by contacting us.

The FIOFIO site may contain links to sites or services operated by third parties. FIOFIO is not responsible for the privacy practices of these external sites. We encourage you to review their own privacy policy.

FIOFIO may amend this policy to reflect changes in its practices, its services, or legal requirements. The most recent version will be published on this page with its update date.

When required by law, FIOFIO will notify affected individuals of changes made to the policy.

For any question regarding this policy or the protection of your personal information: FIOFIO — CivicAI 3260 rue Andante, Trois-Rivières, Québec G8V 0J6, Canada

commandes@fiofio.ca

Contact form