Privacy policy

Effective Date: November 6, 2026

1. Who we are

This Privacy Policy explains how Hemlock & Oak Stationery Inc. ("Hemlock & Oak," "we," "us") collects, uses and shares personal information when you visit www.hemlockandoak.com (the "Site"), buy from us, or interact with our emails, texts, ads, surveys and customer service.

Hemlock & Oak Stationery Inc. is responsible for the personal information described in this policy. Our Privacy Officer oversees how we handle it and answers privacy questions and requests:

  • Privacy Officer: Chief Operating Officer
  • Email: hello@hemlockandoak.com
  • Mail: Hemlock & Oak Stationery Inc., 128-2660 Barnet Hwy, Coquitlam, BC V3B 0S4, Canada

2. Information we collect

We collect information you give us, information collected automatically when you use the Site, and information from partners.

  • Order information: name, billing and shipping address, email address, phone number, payment details, and any personalization or gift message you add. Payments are processed by our payment providers (Shopify Payments, PayPal and Sezzle); we do not see or store your full card number.
  • Account information: if you create an account, your login details, order history, saved addresses, wishlist and preferences.
  • Device and usage information: browser version, IP address, time zone, cookie identifiers, pages and products viewed, search terms, and how you interact with the Site, our emails and our ads. This is collected through cookies, log files, web beacons, tags and pixels (see section 4).
  • Session recordings: if you allow analytics, we use PostHog to record how visitors move through the Site (clicks, scrolling, page changes) so we can find and fix problems.
  • Support and communications information: customer service messages, marketing preferences, reviews, testimonials and other feedback, including photos or screenshots you send us.
  • Survey and feedback information: responses to surveys and questionnaires hosted on platforms such as Jotform. This may include product preferences, demographic information (such as age range and gender), and optional contact details for prize fulfillment or follow-up.
  • Referral and affiliate information: if you join our referral program (which we run ourselves) or our affiliate program (run through GrowthHero), your name, email, referral or affiliate links, referred sales and reward or payout details. If a friend refers you, we record that the referral came from them.
  • Information from partners: advertising platforms tell us when someone interacted with one of our ads before visiting the Site, and review platforms (Judge.me) share the reviews you submit through them.

3. How we use and share information

We use personal information to process and ship orders, provide customer service, prevent fraud, improve the Site, send marketing you have agreed to receive, show and measure our ads, and enforce our rights, including protecting our intellectual property.

We share information with the partners below. The table lists our main providers; we may use others for the same purposes, under the same protections.

Type of partner Who Why
Store platform and payments Shopify, PayPal, Sezzle Run the Site, process payments, detect fraud
Email and SMS marketing Klaviyo Send emails and texts you signed up for, and measure them
Customer support Commslayer, Google Workspace (Gmail) Answer your messages and chats
Shipping Canada Post, UPS, DHL, Chit Chats, Stallion Express, and shipping software (ShipStation, ClickShip, netParcel) Create labels, deliver your order, clear customs
Accounting and tax QuickBooks Online, Sidr Keep financial records, calculate sales tax
Advertising and analytics Meta (Facebook and Instagram), Google (Analytics, Ads, Merchant Center), TikTok, Pinterest, PostHog Show and measure our ads, understand how the Site is used
Affiliate program GrowthHero Track affiliate sales and pay affiliates
Reviews and surveys Judge.me, Jotform Collect and display reviews, run surveys
Account sign-in HIKO Social Login Let you sign in with a social account, if you choose
Backups Rewind Keep backup copies of our store data
AI tools Anthropic (Claude) Help our team draft customer service replies and analyze sales trends

Meta Pixel and Conversions API. When marketing cookies are allowed, the Meta Pixel on our Site records actions such as viewing a product, adding to cart and purchasing. We may also send order details from our store system directly to Meta (the Conversions API) so our ads can be measured accurately. Google, TikTok and Pinterest tags work in a similar way.

Customer lists. We may upload hashed (scrambled) email addresses or phone numbers to Meta and other advertising platforms, either to show ads to existing customers, to stop showing them ads, or to find people with similar interests. You can ask us to leave you out of these uploads by contacting our Privacy Officer.

AI tools. Our team uses AI assistants to help draft replies to customer service messages and to understand sales and customer trends, mostly in aggregate. A team member reviews everything before it is sent or acted on, and we do not use AI to make decisions that have a legal or similarly significant effect on you.

Our service providers may use your information only to provide services to us. Advertising platforms such as Meta, Google, TikTok and Pinterest also act under their own privacy policies, and may use information they receive from our Site to deliver, measure and improve ads. See Meta's Privacy Policy and Google's Privacy Policy.

We may also disclose personal information if required by law, in connection with a legal claim, or to protect our rights and our customers, including investigating fraud, abuse or intellectual property infringement. We do not sell your personal information for money.

Our relationship with Shopify. Our store is hosted by Shopify, which processes personal information to provide and improve its services. We also use Shopify features that combine information about your visits to our store with information from other merchants and from Shopify. For those features, Shopify is responsible for that processing, including responding to your rights requests. See Shopify's privacy information and request portal at privacy.shopify.com.

Business transfers. If our business is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, under the protections of this policy.

4. Cookies, pixels and your choices

We use cookies and similar technologies (pixels, tags and local storage) in four groups:

Group What it does Examples
Necessary Runs the cart, checkout, login and security. Always on. Shopify
Preferences Remembers choices such as language and region Shopify
Analytics Shows us how the Site is used Shopify Analytics, Google Analytics, PostHog
Marketing Measures and personalizes our ads and emails Meta Pixel, Google Ads, TikTok, Pinterest, Klaviyo

Where we ask first. If you visit from Quebec, the European Economic Area, the United Kingdom or Switzerland, analytics and marketing technologies stay off until you turn them on in our cookie banner. They can identify you, locate you or build a profile of your interests, so we only use them with your consent. Elsewhere, they may be on by default and you can turn them off.

Changing your choice. You can change your choice at any time with the Cookie preferences link at the bottom of every page. You can also block or delete cookies in your browser settings; see www.allaboutcookies.org for how. Blocking cookies may stop parts of the Site from working.

Opting out of targeted ads on other platforms: Facebook, Google, Microsoft and the Digital Advertising Alliance.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control signal, depending on where you are, we treat it as a request to opt out of targeted advertising for that browser and device. We do not respond to other Do Not Track signals, because there is no consistent industry standard for them.

5. Transfers outside Canada

We are based in British Columbia, Canada. Our service providers store and process information in other countries, mainly the United States, and wherever they or their subcontractors operate. Information stored or processed outside Canada (or outside Quebec, for Quebec residents) is subject to the laws of those countries. It may be accessible to their courts, law enforcement and national security authorities.

We use contracts with our providers to protect your information, including data transfer terms such as Meta's Global Data Transfer Addendum and, where required, the European Commission's Standard Contractual Clauses. Before we send the personal information of Quebec residents outside Quebec, we assess whether it will be adequately protected.

6. Your rights

Everyone. You can ask to see the personal information we hold about you, correct it, withdraw your consent (for example, to marketing), or have it deleted, subject to legal and contractual limits. Email our Privacy Officer. We will reply within 30 days and may ask you to confirm your identity first.

Quebec residents. You also have the right to:

  • receive personal information you gave us in a structured, commonly used technological format, or have it sent to another organization
  • be told which technologies we use that can identify you, locate you or build a profile of you, and how to turn them on or off (see section 4)
  • be told if a decision about you was made only by automated processing, and to have it reviewed by a person (we do not currently make such decisions)
  • ask us to stop distributing or to de-index personal information where the law allows

If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec.

European Economic Area, UK and Switzerland. Hemlock & Oak Stationery Inc. is the controller of your personal data. We rely on these legal bases:

Purpose Legal basis
Processing and shipping your order, customer service Performance of our contract with you
Marketing emails and texts; analytics and marketing cookies Your consent, which you can withdraw at any time
Fraud prevention, Site security, improving our products Our legitimate interests
Tax, accounting and other legal records Legal obligation

You have the right to access, correct, delete, restrict or port your data, and to object to processing, including direct marketing. You can complain to the data protection authority where you live or work.

United States. Depending on your state, you may have the right to access, correct, delete or port your personal information, and to opt out of targeted advertising. You can opt out of targeted advertising on our Your privacy choices page. For other requests, email our Privacy Officer. You may use an authorized agent; we will ask for proof that you authorized them and may need to verify your identity directly. We will not treat you differently for using these rights.

7. Retention

We keep personal information only as long as we need it for the purposes in this policy. Order and payment records are kept as long as tax and accounting laws require (in Canada, generally six years). Marketing information is kept until you unsubscribe or ask us to delete it. Analytics data is kept according to each provider's retention settings. You can ask us to delete your information at any time, subject to these legal requirements.

8. Security

We use reasonable administrative, technical and physical safeguards to protect personal information, and we limit access to team members and providers who need it. If a privacy incident creates a risk of serious harm to you, we will notify you and the relevant authorities as the law requires.

9. Children

Our Site is not directed to children under 13. In Quebec, we do not collect personal information from anyone under 14 without the consent of a parent or guardian. If you believe a child has given us personal information, contact our Privacy Officer and we will delete it.

10. Reviews and other content you post

If you submit reviews, testimonials or comments, they may be publicly visible on the Site.

11. SMS marketing

By opting in to SMS marketing, you agree to receive texts about our products and offers. Message and data rates may apply. Reply STOP to +1 (844) 311-4928 at any time to opt out.

12. Enforcement and intellectual property protection

We may use personal information to investigate or act against misuse, including fraudulent orders, chargeback abuse, intellectual property infringement and violations of our Terms of Service.

13. Changes to this policy

We may update this Privacy Policy to reflect changes to our practices or for legal, operational or regulatory reasons. We will post updates here with a new Effective Date and, for significant changes, notify customers by email.

14. Contact and complaints

For questions, requests or complaints, contact our Privacy Officer at hello@hemlockandoak.com or by mail at Hemlock & Oak Stationery Inc., 128-2660 Barnet Hwy, Coquitlam, BC V3B 0S4, Canada.

If you are not satisfied with our response, you can contact: