Privacy policy
This policy explains what information Coco's Crafts collects when you visit, shop and download files on www.cocoscrafts.ca, why we collect it, how long we keep it, who else handles it, and the choices you have.
Last updated: 8 October 2026
Who we are
Coco's Crafts is a brand of Durand's Designs, a small business owned and run by Brian Durand in Ontario, Canada. Brian is responsible for how your information is handled here.
- Email: sales@cocoscrafts.ca
- Mail: 300 Sheppard Ave W, Unit 101-31, Toronto, ON M2N 1N5, Canada
What we collect and why
When you buy: your email address, the items you bought, the prices, any tax, the currency, the order status, and the payment reference numbers that Stripe sends us. We use this to deliver your files, email your private download link, help you if something goes wrong, handle refunds and payment disputes, and keep the business records that tax law requires. (EU/UK legal basis: performing our contract with you, and our legal obligations.)
When you download: the time, which file, your IP address and a shortened version of your browser's identifier (user agent). We use this to keep downloads working, to prevent misuse of private links and fraud, and as evidence if a payment is disputed. (EU/UK legal basis: our legitimate interest in preventing fraud and defending payment disputes.)
When you use "Find my order": the email address you type. We use it only to email that address its download links, then delete the request (within 2 days at most). The page answers the same way whether or not we found an order.
When you write to us (email or the contact form): your name, email address and your message, so we can reply. (EU/UK legal basis: our legitimate interest in answering you, or taking steps you asked for.)
When you browse: our web host keeps standard server logs (IP address, pages requested, browser type, time) for security and to fix problems. We also use Cloudflare Web Analytics, which counts visits and page speed without cookies and without tracking you across other websites.
Counting visits (our own, no cookies): we count which pages and products are looked at, which pages lead people to add to a cart, start checkout or click out to another website (the website name only, plus the Amazon product code), and where a visit came from (for example a link in one of Coco's YouTube videos, or another website). Each visit gets a one-way code made from the day, your network address and browser type; the code is different every day, so nobody can be followed from one day to the next, and we never store your IP address, name or email with it. When you buy or join the newsletter, we keep the source of that day's visit (for example "YouTube video X") with the order or signup, so we know what is working. We don't count bots, or browsers that send Do Not Track or Global Privacy Control. (EU/UK legal basis: our legitimate interest in understanding which of our pages and videos help people; no personal data is kept.)
We never see or store your card number. We don't sell your information, we don't use it for targeted advertising, and we don't make automated decisions about you. (Stripe runs its own fraud checks on payments.)
Payments: Stripe and Link
Checkout happens on Stripe's secure payment page. Your order is sold through Link (Sold through Link, LLC, a Stripe company), which acts as the merchant of record: it takes your payment, works out and collects any sales tax or VAT, sends your receipt, and handles payment questions, refunds and disputes. Stripe and Link collect your payment details, billing information and email address themselves, under their own privacy policy: link.com/privacy and stripe.com/privacy. Stripe sends us only what we need to give you your files: your email address, the items, the amounts and payment references.
Cookies and your browser's storage
- Store cookie (
coco_store): a session cookie that keeps checkout and the download buttons safe from forged requests. It is needed for the shop to work, and it is not used for tracking or advertising. - Your browser's storage: your cart, your text-size choice, and a note that you started checkout are saved in your own browser so they are still there when you come back. They stay on your device; you can clear them in your browser settings at any time.
- No advertising cookies: we don't set any. Neither Cloudflare Web Analytics nor our own visit counting uses cookies or stores anything in your browser.
- Fonts: our pages load their fonts from Google Fonts. Your browser connects to Google's servers to fetch them, which means Google receives your IP address and browser details. Everything else on our pages, including the 3D viewer, comes from our own website.
- Videos: tutorial videos are YouTube videos. Some pages play them only after you press play; once a video loads, YouTube (Google) may set its own cookies under its own policy. Where we can, we use YouTube's privacy-enhanced mode.
- Affiliate links: some pages link to products on Amazon. We earn a small commission on qualifying purchases (see our affiliate disclosure). If you click one, Amazon may use cookies on its own website to credit the referral.
Who else handles your information
We share only what each service needs to do its job:
- Stripe / Link: payments, receipts, tax, fraud checks and payment support (USA, Canada, Ireland and elsewhere)
- Hostinger: hosts the website, our order records and download logs (United States, Boston, Massachusetts)
- PurelyMail: sends our order and "Find my order" emails and hosts our mailbox (USA)
- Cloudflare: privacy-friendly website statistics (global network)
- Google Fonts: the web fonts our pages use (global network)
Because these services work outside Canada, your information may be stored or processed in other countries and may be available to the authorities there under their laws. We may also share information when the law requires it, or to protect our rights in a payment dispute.
How long we keep it
- Orders: for 6 years after the end of the tax year of the order, because Canadian tax law requires us to keep business records that long. After that we delete them.
- Download records (time, file, IP address, browser): for 18 months after the download, long enough to answer card disputes, then deleted.
- "Find my order" requests: deleted as soon as the email is sent, and within 2 days at most.
- Messages you send us: up to two years after we last hear from you, unless they belong with an order record.
- Newsletter subscription: until you unsubscribe. Then only your address and signup record stay on a "do not email" list, so we never write to you again. Signups nobody confirms are deleted after 14 days.
- Server logs: kept by our web host (Hostinger) for a limited time for security, under its own retention policy.
How we protect it
The site uses HTTPS. Order records and paid files are kept in private storage outside the public website. Your private download link is stored only in scrambled (hashed) and encrypted form, and the links stop working if a payment is refunded or disputed. If a security breach involving your information creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner of Canada as the law requires.
Your choices and rights
Write to sales@cocoscrafts.ca to:
- see the personal information we hold about you, or get a copy of it
- correct it
- ask us to delete it (we may need to keep order records for the tax period above)
- object to how we use it, or withdraw a consent you gave
We answer within 30 days. We may ask you to write from the email address you used at checkout so we know the request is really from you. You won't be treated differently for using your rights.
Canada: if you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
EU and UK: you also have the rights to restrict processing and to data portability, and you can complain to your local data protection authority (in the UK, the ICO).
United States: we don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information.
Children
Coco's tutorials are for crafters of all ages, but this shop is meant for adults: purchases should be made by an adult, or with a parent's or guardian's permission. The site is not directed to children under 13, and we don't knowingly collect information from them. If you think a child under 13 has sent us information, write to us and we'll delete it.
Changes
If we change this policy, we'll update it here and change the date at the top. If a change is significant, we'll say so clearly on this page.
Coco's Crafts is a brand of Durand's Designs, 300 Sheppard Ave W, Unit 101-31, Toronto, ON M2N 1N5, Canada · sales@cocoscrafts.ca · Terms & licence · Refunds · Affiliate disclosure