Privacy Policy

Last updated: 2026-11-05

This policy explains what Chocobanana (thechocobananaclub.com and the Chocobanana iOS and Android apps) collects, why, how long we keep it and the choices you have. The website and the apps share one account system, so this policy covers both.

Who is responsible

Chocobanana Mail Club, run by Didem Keskin in Canada, is responsible for your personal information. Our person in charge of privacy is Didem Keskin, reachable at thechocobananaclub@gmail.com.

What we collect

Account details you give us: first and last name, email address, phone number, delivery address and a password (stored only as a secure hash).
Orders: items, amounts, the delivery address used, order number and fulfilment status. If you check out as a guest we keep the same order details without an account.
Payments are handled by Stripe. We never see or store your full card number; we receive the payment result and a Stripe customer reference.
Messages you send through the contact form or the withdrawal form, and your email if you join our mailing list.
In the app, only if you turn notifications on: a device notification token, the device platform and your language.
Technical data needed to run the site: your chosen language and currency, your sign-in session (cookies) and your shopping cart (stored on your device). Our host also keeps short-lived server logs (such as IP address and browser type) for security.

Why we use it and on what basis

To take, deliver and support your orders, and to manage your account (needed to perform our contract with you).
To send order and account emails such as confirmations, invoices, verification and password reset (contract).
To keep accounting and tax records (legal obligation).
To protect the site and prevent fraud (our legitimate interest).
To send our newsletter, only after you opt in and confirm your email (consent). You can withdraw consent at any time with the unsubscribe link in every email.
We do not sell or rent your personal information, do not share it for advertising, and do not use advertising or analytics trackers.

Cookies

We use only cookies that the site needs to work: language and currency choice, your sign-in session and security checks. We do not use advertising, analytics or social media cookies, so we do not ask for cookie consent. Your cart is saved in your browser's storage on your device.

Who we share it with

Service providers that run the shop for us: Stripe (payments), Vercel (website hosting), Neon (database), Resend (email delivery), Apple Push Notification service and Google Firebase Cloud Messaging (app notifications, only if you turn them on). They may only use your information to provide their service to us.
Postal services receive your name and address on the envelope. We may disclose information if the law requires it.

Where it is stored

We are based in Canada and our service providers store data mainly in the United States and Canada. If you live in the EU, the UK or Türkiye, your information is therefore transferred outside your country. Before communicating personal information outside Quebec we assess whether it will be adequately protected, as Quebec's Law 25 requires, and we rely on the safeguards these providers offer, such as the EU Standard Contractual Clauses and, where available, the EU–US Data Privacy Framework.

How long we keep it

Account data is kept while your account exists. Order and invoice records are kept for as long as tax law requires (in Canada, six years), even after an account is deleted, without being linked to the deleted account.
Newsletter data is kept until you unsubscribe. Contact and withdrawal messages are kept for up to two years, then deleted.

Security

We use encrypted connections (HTTPS), hashed passwords and access limited to the shop owner. If a breach ever creates a real risk of significant harm, we will tell you and the relevant authority as the law requires.

Your rights

You can ask to see, correct or delete your information, get a copy in a portable format, object to or restrict some uses, and withdraw consent at any time.
You can update your profile and address in My Account, and delete your account from My Account → Account settings → Delete account, on the website or in the app.
For any other request, email us. We answer within 30 days.
You can also complain to a privacy authority: in Canada the Office of the Privacy Commissioner of Canada (or the Commission d'accès à l'information in Quebec); in the EU your local data protection authority; in the UK the ICO; in Türkiye the KVKK.

Children

Chocobanana is not directed to children under 13 and we do not knowingly collect their personal information. If you think a child has given us information, contact us and we will delete it.

Changes

If we change this policy we will update the date above, and tell you by email if the change is significant.

Contact

Chocobanana Mail Club — Didem Keskin
Montréal (Québec), Canada
Email: thechocobananaclub@gmail.com