Last updated: October 21, 2026
This policy explains what personal information Zen Bliss Canada collects when you visit zenbliss.ca or buy from us, why we collect it, who we share it with and the choices you have. We follow Canada's private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada's anti-spam law (CASL) for email.
By using our site or placing an order, you agree to the collection and use of your information as described here.
Who we are
Zen Bliss Canada is a Toronto company that sells CBD and Delta-8 products online to adults in Canada. For any privacy question or request, email us at info@zenbliss.ca. That inbox reaches the person responsible for privacy at Zen Bliss.
What we collect
When you place an order
- Your name, email address, billing and shipping addresses, and phone number if you give one.
- What you bought, the price, taxes, shipping and any discount code.
- Payment details: for card payments we keep only the last digits of the card and the transaction ID. We never see or store your full card number (see "Card payments" below). For Interac e-Transfer, we see the details your bank sends with the transfer, such as your name.
When you create an account
Your name, email address, saved addresses and order history. Your password is stored in scrambled (hashed) form, so we can't read it.
When you join our email list
Your email address and how you signed up. If you use the email step in our Help me choose quiz, we also save your quiz answers about your goal, THC preference and preferred product form.
When you contact us
Your name, email address, phone number if you give one, and your message.
When you write a review
The name you give, your rating, your review and any photos you add.
Automatically, when you visit
- Your IP address, browser and device type, the pages you view, the site that sent you to us, and the date and time of your visit.
- Information stored in cookies (see "Cookies and similar tools" below).
Our Dose Finder works in your browser and does not send your answers to us. Help me choose answers (without your email) may be counted in Google Analytics so we can see which answers are common.
How we use your information
- To process, pack, ship and track your order, and to handle returns and refunds.
- To run your account and answer your messages.
- To send order, shipping and account emails.
- To send marketing emails, only if you subscribed (see "Emails" below).
- To ask for and show product reviews.
- To run our age check, prevent fraud and keep the site secure.
- To understand how the site is used and improve it.
- To keep business and tax records and meet our legal obligations.
We don't sell your personal information, and we don't give it to other companies for their own marketing.
Emails
Order and account emails
We send order confirmations, Interac e-Transfer instructions, shipping and tracking emails, refund notices and password resets to everyone who orders or has an account. These are part of the service, so unsubscribing from marketing doesn't stop them.
Review requests
After an order, we may email you to ask for a review of what you bought. If you'd rather not get these, email us and we'll stop them.
Marketing emails
We send news, guides, restock alerts and offers only to people who subscribed: through a sign-up form on our site, through the email step in Help me choose, or by choosing to get our emails when you create an account or check out (where we offer that option). Entering your email in Help me choose adds you to our email list.
Every marketing email names Zen Bliss and has an unsubscribe link. Unsubscribing usually takes effect right away, and always within 10 business days. You can also email us to unsubscribe.
If you're subscribed, we may use your order history to make our emails more relevant, for example a reminder when you may be due to reorder.
Cookies and similar tools
Cookies are small files a website saves in your browser. We don't show a cookie banner. Cookies are used as described below when you use the site, and you can block or delete them in your browser settings at any time.
- Needed to run the store: your cart, checkout, login, security and bot checks (WooCommerce, WordPress and Cloudflare), and our age check, which remembers your "Yes" for 30 days. If you block these, the cart and checkout may not work.
- Order source: our store software notes where an order came from (for example a search engine, another website or one of our emails), the type of device and the number of pages viewed, and saves this with the order.
- Analytics: Google Analytics cookies help us count visits and see which pages and products people use. To opt out of Google Analytics on every site, you can install Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.
- Email: Drip's script may set a cookie so that, if you're a subscriber, Drip can link your visits and cart activity to your subscriber profile.
We also run a simple page counter of our own. It records which pages are viewed, site searches and checkout steps, without cookies and without personal information, and it skips browsers that send a Global Privacy Control signal.
Who we share it with
We share personal information only with the service providers below, only what each one needs to do its job for us, and only for that job. Only people who need your information to run the store and fulfil your order can see it.
- Cloudways hosts our website and its database (accounts, orders and form messages) on DigitalOcean servers in a data centre in Toronto, Canada.
- Cloudflare sits in front of our website to protect it from attacks and deliver pages faster. It processes visitors' IP addresses and browser details. Its Turnstile check runs on our forms and at checkout to tell people from bots.
- NMI and Nuvei (card payments). NMI is our payment gateway and Nuvei our payment processor. You type your card details into their secure fields on our checkout page, and the details go straight to them. They may also receive your name, billing address and the order amount to approve the payment and help prevent fraud.
- Your bank (Interac e-Transfer). If you pay by e-Transfer, you send the payment from your own bank.
- Canada Post receives your name and shipping address to create the label and deliver your parcel. We may also share your phone number and email address with Canada Post for delivery and tracking notices.
- Amazon Web Services (AWS). Amazon SES sends our order, shipping and account emails from the AWS Canada (Central) region. AWS also stores our website backups, in the Canada (Central) region. Our own order-tracking and reporting tools also run on AWS in the Canada (Central) region and read order details, such as names, addresses and tracking numbers, so we can follow parcels and see how the store is doing.
- Microsoft 365 hosts our email inbox. Emails you send us, including messages from our contact form, are kept there.
- Google Analytics and Google Tag Manager measure how the site is used. Google processes this data under its own privacy policy (policies.google.com/privacy).
- Drip stores our email list and sends our marketing emails. Our store may also send your order and cart activity to Drip. People who haven't subscribed don't get marketing emails.
- Customer Reviews for WooCommerce is the plugin on our site that sends review requests after an order and shows reviews. It uses your name, email address and the products you bought. Reviews you post, with the name you give, are shown on our site.
We may also disclose personal information if the law requires it (for example a court order), to protect our rights or someone's safety, or to a buyer if our business is ever sold, in which case the buyer must protect it as this policy says.
Where your information is stored
Our website, its database and our order emails are hosted in Canada. Some of our service providers, such as Google, Cloudflare, Drip, Microsoft and our payment providers, may store or process information outside Canada, including in the United States. Information held outside Canada is subject to the laws of that country and may be accessible to its courts and authorities.
How long we keep it
- Orders: we keep order records for as long as Canadian tax law requires us to keep business records (generally six years), and longer if we need them for a dispute or claim.
- Accounts: until you ask us to close your account. Past orders stay in our records as above.
- Email list: until you unsubscribe. After that, we keep a record of your unsubscribe so we don't email you again.
- Messages: as long as we need them to answer you and keep a record of your orders.
- Google Analytics: event data is deleted after 14 months.
- Backups: kept for 30 days, then deleted.
How we protect it
We use reasonable safeguards for the kind of information we hold, such as encrypted connections (HTTPS), secure payment fields so card numbers never reach our servers, access limited to the people who need it, and security tools that log IP addresses and requests to block attacks. No website or email system is perfectly secure, so we can't guarantee absolute security.
If a breach of your personal information creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada, as the law requires.
Your choices and rights
- See your information: you can ask what personal information we hold about you and how we've used it.
- Correct it: you can update your details in your account, or ask us to correct them.
- Withdraw consent: you can unsubscribe from marketing emails at any time, and ask us to stop review requests. Some uses, such as shipping your order or keeping tax records, are needed to provide the service or required by law.
- Close your account: you can ask us to close your account and delete the information we don't need to keep by law.
Email your request to info@zenbliss.ca. We may ask you to confirm your identity first. We'll respond within 30 days, or tell you within that time if we need longer, as the law allows.
If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Age
Our site and products are for adults of legal age only. We don't knowingly collect personal information from anyone under 19. If we learn that we have, we'll delete it.
Our previous store platform
Until October 2026, our store ran on Shopify. When we moved to our own site, we copied customer accounts and order history so your account and past orders stay available. We did not add anyone to our email list in the move. Shopify may keep its own copy of past store data for a time under its own privacy policy.
Changes to this policy
We may update this policy. When we do, we'll post the new version here with a new "Last updated" date. For important changes, we may also tell you by email or with a notice on our site.
Contact
Questions or requests about your privacy: info@zenbliss.ca.