Privacy policy

Privacy Policy

Last updated: September 18, 2026

Waffle Haus Inc., carrying on business as Waffle Hau5 (“Waffle Hau5,” “we,” “us,” or “our”), operates www.wafflehau5.com and its related store, accounts, products and services (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose and otherwise process personal information when you visit or use the Services, create an account, check out as a guest, purchase from us, communicate with us, subscribe to marketing, submit content or otherwise interact with us. It also explains your privacy choices and rights.

Our store is hosted by Shopify. We also use providers and advertising technologies that may process personal information, including Shopify Payments, PayPal, Klaviyo, Meta and TikTok. Nothing in this Policy limits any non-waivable right under applicable law.

1. Personal Information We Collect

Depending on how you interact with us, we may collect:

  • Contact and identity information, such as your name, email address, telephone number, billing address and shipping address.

  • Account information, such as login credentials, saved addresses, preferences and account activity. Passwords are processed in protected form through our platform provider.

  • Order and transaction information, including products viewed or purchased, cart activity, order history, returns, exchanges, refunds, discounts and delivery status.

  • Payment information, such as payment method, billing details, payment confirmation and transaction identifiers. Full card details are generally processed directly by Shopify Payments, PayPal or another authorized processor and are not stored by us in unencrypted form.

  • Communications, including messages, support requests, survey responses and other information you provide when contacting us.

  • Marketing information, including email or SMS subscription status, marketing preferences and campaign engagement.

  • Reviews and customer content, including ratings, reviews, photographs, videos, social-media handles and other content you voluntarily submit. Content submitted for public display may be visible to others.

  • Device and technical information, including IP address, browser, operating system, device identifiers, language, time zone and network information.

  • Usage and online activity, including pages viewed, links clicked, products viewed, searches, referring pages, approximate location derived from IP address, session activity and interactions with advertisements.

  • Fraud and security information, including risk indicators and information used to authenticate transactions or investigate misuse.

  • Inferences, such as likely product interests or shopping preferences derived from browsing and purchase activity, where permitted by law.

We do not intentionally collect sensitive personal information unless reasonably necessary and permitted by law. Please do not send sensitive information through ordinary email or other unsecured channels.

2. How We Collect Personal Information

We may collect personal information:

  • Directly from you when you order, create an account, check out as a guest, subscribe to email or SMS, contact us or submit content.

  • Automatically through cookies, pixels and similar technologies.

  • From Shopify and payment providers, including Shopify Payments and PayPal.

  • From service providers, including Klaviyo, our warehouse or third-party logistics provider, couriers, and current or future providers of product reviews, customer rewards, loyalty programs, referrals, user-generated-content features and related store technology.

  • From advertising and social-media partners, including Meta and TikTok, where permitted by law and consistent with your settings or consent.

  • From other lawful sources, including fraud-prevention providers, business partners and parties involved in a corporate transaction.

3. How We Use Personal Information

Providing the Services

We use personal information to process payments; provide customer accounts and guest checkout; fulfil, ship, deliver, return, exchange and refund orders; communicate about orders and accounts; provide support; maintain records; remember preferences; and otherwise perform our agreement with you.

Marketing and communications

Where permitted by law, we may use personal information to send promotional email through Klaviyo or Shopify, send promotional SMS messages, manage subscriptions, personalize communications and measure campaign performance.

Marketing email and SMS are optional and are not required to purchase. We seek consent where required and include a way to unsubscribe. Standard message and data rates may apply to SMS. Opting out of marketing does not prevent necessary transactional messages, such as order and delivery updates.

Advertising, analytics and personalization

Subject to applicable law and your choices, we may use Meta Pixel and TikTok Pixel to measure traffic and advertising performance, understand whether an advertisement led to a visit or purchase, build or measure audiences, personalize or retarget advertisements and improve our Services.

These technologies may allow Meta and TikTok to receive identifiers, device information, site activity, product interactions and transaction-related events. They may combine this information with information collected elsewhere and process it under their own privacy policies. Depending on where you live, this may be considered targeted advertising, cross-context behavioural advertising, “sharing” or a “sale” of personal information, even though we do not sell personal information for money.

Reviews and customer content

We use ratings, reviews, photographs and other customer content to operate review and loyalty features, respond to feedback and display content that you submit for public display. We may use current or future third-party providers to collect, host, verify, moderate, display or administer reviews, rewards, referrals and related customer-content features.

We will reuse an identifiable customer photograph or video in paid advertising, promotional email, organic social-media marketing or other brand advertising only where the customer has given appropriate permission or submitted the content under terms that clearly authorize that use. Permission may be withdrawn for future uses by contacting our Privacy Officer, subject to reasonable processing time and any use already lawfully completed. Public content may still be indexed, copied or reshared by others. Our Terms of Service contain additional terms for submitted content.

Security, legal compliance and business operations

We use personal information to secure accounts and transactions, investigate fraud or misuse, enforce our policies, comply with law, respond to lawful requests, manage suppliers and logistics, improve our store, conduct internal reporting, resolve disputes and support a merger, financing, restructuring or sale.

4. Consent and Other Legal Bases

Where Canadian privacy law applies, we obtain meaningful consent for the collection, use and disclosure of personal information unless an exception applies. The appropriate form of consent depends on the sensitivity of the information and reasonable expectations.

Some processing is necessary to provide a requested product or service—for example, using your address to deliver an order. Other activities, including promotional email, SMS and certain advertising cookies, are optional and subject to applicable consent and opt-out requirements.

Where European Economic Area (“EEA”) or United Kingdom (“UK”) law applies, we rely on one or more recognized grounds, including performance of a contract, legal obligations, legitimate interests that are not overridden by your rights, and consent where required.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already lawfully completed. If information is necessary to provide a requested product or service, withdrawal may mean we cannot provide it.

5. Cookies, Pixels and Similar Technologies

We and our providers use cookies, pixels and similar technologies to operate the website, remember preferences, maintain sessions and carts, secure transactions, understand use and deliver or measure advertising. These technologies may be:

  • Strictly necessary for checkout, security, accounts and core functions.

  • Functional to remember settings and provide enhanced features.

  • Analytics to understand use and improve performance.

  • Advertising, including Meta Pixel and TikTok Pixel, to measure campaigns and personalize or retarget ads.

We provide a cookie-consent and preference banner where required by applicable law. In regions requiring prior consent, non-essential analytics and advertising cookies or pixels will not be activated until the required consent is obtained. You can use the banner or preference tool to accept, reject or manage non-essential technologies, and you can change your selection later where that option is available. You may also adjust your browser to block or delete cookies and use the privacy or advertising controls provided by Meta and TikTok. Blocking cookies may affect functionality, and browser controls may not prevent every form of pixel or server-side processing.

6. How We Disclose Personal Information

We may disclose personal information to:

  • Shopify, which hosts and supports our store.

  • Payment processors, including Shopify Payments and PayPal, to complete transactions, manage disputes and prevent fraud.

  • Klaviyo and communications providers to manage email and SMS subscriptions, send messages, personalize campaigns and measure engagement.

  • Advertising partners, including Meta and TikTok, as described above.

  • Warehousing, fulfilment and delivery providers, including our third-party warehouse or 3PL and shipping carriers.

  • Current or future review, loyalty, rewards, referral and customer-content providers used to collect or display reviews, administer rewards or referrals, host customer content and provide related store features. These providers may receive contact, account, transaction, review, engagement or reward information reasonably necessary to provide the applicable feature.

  • Professional advisers and authorities, including lawyers, accountants, insurers, regulators, courts and law-enforcement agencies where reasonably necessary or legally required.

  • Corporate transaction participants in connection with a proposed or completed merger, financing, reorganization, bankruptcy or sale, subject to appropriate safeguards where required.

  • Other parties at your direction or with your consent.

We require providers processing information on our behalf to use it for authorized purposes and protect it appropriately, subject to applicable law and our arrangements with them. Some recipients, including payment providers and advertising platforms, may also process information independently under their own policies.

7. Shopify

Shopify processes personal information to provide and improve its commerce services. Information submitted through our store may be transmitted to Shopify and its providers in other countries. Shopify may also process information from your interactions with our store together with information from other merchants or Shopify services for purposes described in its documentation.

For more information, review Shopify’s Consumer Privacy Policy and Shopify’s Privacy Portal.

8. International Processing and Transfers

We are based in Canada and sell internationally. Personal information may be transferred to, stored in or processed in Canada, the United States and other countries where Shopify, Klaviyo, Meta, TikTok, PayPal, our 3PL, carriers or other providers operate.

Privacy laws in those countries may differ from those where you live. Information processed abroad may be accessible to courts, law-enforcement, national-security authorities or regulators in accordance with local law.

Where information is transferred to a provider processing it on our behalf, we remain accountable as required by Canadian privacy law and use contractual or other appropriate measures designed to provide comparable protection. Where EEA or UK transfer law applies, we rely on a legally recognized mechanism where required, such as an adequacy decision or contractual safeguards implemented by the relevant provider.

9. Retention

We retain personal information only as long as reasonably necessary to provide the Services, manage accounts, complete orders, maintain business and tax records, process returns and chargebacks, prevent fraud, resolve disputes and comply with law.

Periods vary based on the nature and sensitivity of the information, the purpose, limitation periods and legal requirements. When information is no longer required, we take reasonable steps to delete, destroy or anonymize it, subject to permitted backup and archival practices.

10. Security and Privacy Incidents

We use reasonable administrative, technical and physical safeguards designed to protect personal information against loss, theft, misuse and unauthorized access, use, disclosure, alteration or destruction. Access is limited to personnel and providers requiring information for authorized purposes.

No security measure or transmission method is completely secure. Use a unique password, protect your credentials and avoid sending sensitive information through unsecured channels. Contact us promptly if you believe an account or information has been compromised.

We investigate suspected privacy and security incidents and provide legally required notifications to individuals, regulators or other parties.

11. Children’s Privacy

The Services are intended for a general audience and are not directed to children. We do not knowingly collect personal information from children under 13 or anyone below the applicable minimum age for independent consent where they live. Purchases must be made or authorized by a person legally capable of entering a contract.

If you believe a child provided information without appropriate authorization, contact the Privacy Officer.

12. Your Privacy Rights and Choices

Depending on where you live and subject to lawful exceptions, you may have the right to:

  • access personal information and learn how it has been used or disclosed;

  • correct inaccurate or incomplete information;

  • request deletion;

  • withdraw consent or object to certain processing;

  • restrict certain uses or disclosures;

  • request a portable copy of certain information;

  • opt out of targeted or cross-context behavioural advertising or certain data sharing;

  • challenge or appeal a decision concerning a request; and

  • complain to an applicable regulator.

Submit requests to the Privacy Officer below. We may verify your identity and, for an authorized agent, request proof of authority. We will not discriminate against you for exercising a privacy right. Rights are not absolute; a request may be limited where permitted by law, such as where information must be retained for legal or fraud-prevention purposes. We will respond within the legally required period.

Marketing choices

Unsubscribe from promotional email through the link in the message. Opt out of promotional SMS using the instructions in the message, such as replying STOP, where supported. You may still receive non-promotional messages about orders, accounts, security or support.

Advertising choices

Where available, use our cookie-preference tool to decline non-essential advertising technologies. You may also adjust preferences with Meta and TikTok or contact us. Choices may be device- or browser-specific.

13. Additional Information for EEA and UK Residents

Where EEA or UK data-protection law applies, you may have rights to access, correct, erase, restrict or object to processing, receive certain data in portable form, withdraw consent and complain to your local supervisory authority. Where we rely on legitimate interests, you may object to that processing.

Waffle Haus Inc. is the controller where it determines the purposes and means of processing. Shopify, payment providers, advertising platforms and other recipients may act as separate controllers for certain activities described in their own policies.

14. Additional Information for United States Residents

Residents of certain U.S. states may have additional rights, including rights to know, access, correct or delete information and to opt out of targeted advertising, cross-context behavioural advertising, certain data sharing or sales as defined by applicable law.

We do not sell personal information for money. However, Meta Pixel, TikTok Pixel and similar technologies may be treated as a “sale,” “sharing,” targeted advertising or cross-context behavioural advertising under some laws. Where applicable, opt out through our cookie-preference tool or by contacting us. We do not knowingly sell or share personal information of consumers under 16 where affirmative authorization is required.

15. Third-Party Websites and Services

The Services may link to third-party websites, social platforms or services. Their privacy and security practices are governed by their own policies. We are not responsible for third-party practices merely because we provide a link or integration.

16. Complaints

Please direct privacy complaints to our Privacy Officer first so we can investigate and respond. If you are not satisfied, you may contact the privacy or data-protection regulator where you live. In Canada, you may contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy commissioner.

17. Changes to This Policy

We may update this Policy to reflect changes to practices, providers, technology or law. We will post the revised version, update the date and provide additional notice where required. Material changes apply prospectively unless applicable law permits otherwise.

18. Contact the Privacy Officer

For questions, requests, complaints or withdrawal of consent, contact:

Elyse Mathias, Privacy Officer
Waffle Haus Inc., carrying on business as Waffle Hau5
Email: shopwafflehaus@gmail.com