Privacy Policy

We collect the least we can, keep it only as long as we need it, and never sell it. This page says exactly what that means. Last revised January 2026.

What we collect

When you order: your name, delivery and billing address, email address, telephone number, what you bought and a payment token. We never see or store your full card number; our payment provider returns a token, and that token is what sits in our records.

When you browse: the pages you visited, the device and browser you used, and a session identifier. When you subscribe: your email address and the date you gave it to us.

Why we collect it

To take payment, pick, pack and deliver your order, handle returns and repairs, answer your questions, keep our accounts as tax law requires, and (only if you asked) send you email about new arrivals.

How long we keep it

Order records for seven years, because tax law requires it. Support conversations for two years. Marketing consent until you withdraw it. Analytics for fourteen months, in aggregate. Accounts are deleted on request, except the order records we are obliged to keep.

Who else sees it

Our payment provider, our carrier, our email provider and our hosting company, each only what they need to do their job, each under a written data-processing agreement. We do not sell data, we do not trade mailing lists, and we do not share anything with advertisers.

Cookies

Two are strictly necessary: the one that remembers your cart and the one that keeps you signed in. One is analytical and anonymised. There are no advertising cookies on this site, so there is nothing to opt out of beyond the analytics banner.

Your rights

You may ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, or object to us using it for marketing. Write to [email protected] and we will answer within 30 days. If you are unhappy with our answer you may complain to your data protection authority.

Security

The site runs over TLS 1.3. Passwords are hashed, never stored in the clear. Access to order data is limited to the people who pick, pack and support orders, and every access is logged. If a breach ever affects you we will tell you within 72 hours of discovering it.

Data controller: Canvas Clothing Store, 795 Folsom Ave, Suite 600, San Francisco, CA 94107.