Privacy policy

The data controller for this shop is Northstar Cart Inc., trading as Northstar Cart, of 4-400 Esna Park Drive, Markham, Ontario L3R 3K2, Canada. The person accountable for privacy questions is Customer service, reachable at privacy@northstarcart.com.

We handle personal data in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies to you, the EU and UK General Data Protection Regulation. This policy is written to be read; it is the same undertaking either way.

To fulfil an order. Your name, email address, delivery address, and a contact telephone number where the carrier requires one. Without these we cannot ship, and under the terms of sale we cannot enter into the contract at all.

To take payment. The card details you type at checkout go straight from your browser to our payment processor, a PCI-DSS compliant payment institution. They are not sent to us. What is returned to us, and what our database keeps, is the card brand, the last four digits, the amount, the currency and the processor's own payment and order identifiers — enough to reconcile an order, answer a query and issue a refund, and nothing more.

To screen for fraud. Every card payment is scored for fraud risk before it is authorised. Where that service is enabled, a device-fingerprint script supplied by Kount runs in the checkout page and reports technical characteristics of your browser and device — screen size, time zone, installed fonts, whether the browser looks automated — to Kount. It does not read your files, your other tabs, or anything you have typed. If the service is not enabled, the checkout generates a session identifier locally instead and no data leaves our server for this purpose.

To keep the shop working. Ordinary server logs record the IP address, the page requested and the time. We use them to keep the site up and to block abuse, and we keep them for 30 days.

What we never collect. We never ask for your full card number, its expiry date or its security code in any message, form or email outside the checkout — and anything that does is not from us. We never receive your bank login, and we do not run advertising or third-party analytics trackers on this site.

We use the smallest set that will work. There is no consent banner because none of them is used for advertising or tracking:

• cy_csrf — a security token that stops another site from submitting our forms on your behalf. Strictly necessary, contains no personal data, expires after 30 days.
• cy_admin — set only after a member of staff signs in to the back office. It is never set for a customer.

Your basket lives in your browser's localStorage under the key cy_cart_v1, so that it survives a reload. It holds product identifiers and quantities and nothing else. Clearing your browser data empties it permanently.

When a payment is submitted, the fraud-screening script described above runs in the checkout page. That is the only third-party code that executes during a visit, and it is loaded only on the checkout.

Order records, including the invoice and the card brand and last four digits, are kept for seven years after the end of the tax year in which you ordered. Tax law requires it and we cannot delete them early on request; everything else on the order we can.

Server logs are kept for 30 days. Newsletter subscriptions are kept until you unsubscribe, which is one click in every email. A refund does not delete the order it relates to.

Four parties, and no others:

• Our payment processor — a PCI-DSS compliant payment institution. Receives the card data you enter, your name, email address and billing address, plus the fraud-screening session identifier.
• Kount — fraud screening, where enabled. Receives device characteristics and the order amount, not your name or address.
• Our shipping carrier — receives your name, delivery address and a telephone number where one is required for delivery.
• Our hosting provider — stores the database and the logs on our behalf, under a data processing agreement.

We do not sell, rent or trade personal data, and we do not pass it to anyone for their own marketing. We disclose it to anyone else only where the law compels us to, and where we are permitted to say so we will tell you.

Our database and backups are hosted in Canada on our hosting provider's infrastructure. Our payment processor is a Canadian payment institution and processes the transaction in Canada. Our fraud-screening provider is operated in the United States, so if you are in the European Economic Area the device data described above is transferred there under standard contractual clauses. Nothing else leaves Canada.

You may ask us for a copy of the personal data we hold about you, ask us to correct anything wrong, ask us to delete anything we are not obliged to keep, ask us to restrict what we do with it, object to processing, and ask for it in a portable machine-readable form. You may also withdraw consent at any time where consent is the basis for processing — for example by unsubscribing.

Write to privacy@northstarcart.com and we will respond within 30 days. There is no charge. We may ask you to confirm your identity first, so that we do not hand your data to somebody else.

If you are not satisfied with our answer you may complain to the Office of the Privacy Commissioner of Canada, or in the EU and UK to your national supervisory authority. We would rather you came to us first.

The site is served over TLS. Card data is transmitted directly from your browser to our payment processor and never touches our servers, which is what keeps our own obligations under the card scheme rules at the lowest level. Passwords for the back office are stored as scrypt hashes, and the back office is reachable only over an authenticated session.

This shop sells to adults. We do not knowingly collect personal data from anyone under 16, and if you believe a child has given us data, write to us and we will delete it.

We may update this policy. The version that applies to your order is the one published when you placed it, and the date below changes whenever the text does.

Northstar Cart Inc.
4-400 Esna Park Drive
Markham, Ontario L3R 3K2
Canada

Privacy: privacy@northstarcart.com
Everything else: support@northstarcart.com
Telephone: +1 (942) 380-9665

Last updated November 2026.