Privacy policy

Short version. We collect what an order or a booking needs, keep it as long as the law and the work require, share it only with the services named below, and never sell it for money. The shop also uses analytics, advertising measurement and an automated chat assistant; the companies behind them also use what their tools collect under their own policies, including for advertising. If you want to see, correct or delete what we hold, write to shop@vaultrec.com.

Who we are

This shop and vaultrec.com are run by Aaron Zigabe under the studio name VaultRec. VaultRec is a studio name, not a registered company (yet). Business address: VaultRec Studio, 1800 Argyle Street, Suite 801, Halifax, NS B3J 3N8, Canada · (902) 932-7037. The person responsible for personal information, including under Quebec's private-sector privacy law (Law 25), is Aaron Zigabe, reachable at shop@vaultrec.com.

What we collect, and why

When you buy a printed piece: your name, email address, shipping address, billing address, what you ordered, and the payment's status. Phone number only if you choose to give it for the carrier. We need these to make the piece, ship it, send you the receipt and the tracking link, and answer you if something goes wrong. We never see your full card number; the payment processor does.

When you book a service: your name, email address, what you tell us about the name, the house, the page or the business, the files you send, and the invoices between us. We need these to do the work and to keep the records the tax rules require.

When you request a quote or write to us: your name, your reply address, your message and the answers you choose to give in the request form. We keep them in our customer records (HubSpot) so that no request is lost.

When you visit the shop: the shop runs on Shopify, which sets the cookies a cart and a checkout need to work, plus its own store analytics. On the shop, and only on the shop, we also use:

Microsoft Clarity (analytics). It records how pages are used, such as clicks, scrolling and which parts of a page are seen, as session recordings and heatmaps, so we can fix what is confusing. What you type into forms is masked and never reaches Clarity. Clarity uses cookies.
The Lieutenant (the "Ask the Lieutenant" chat). An automated assistant, not a person, provided by Microsoft Clarity Brand agents. It uses our catalogue, prices and policies to answer questions about our pieces and services. What you type in the chat and how you use it, including conversation text, interaction events and device information, is shared with Microsoft to answer you and to operate, secure and improve the service. Please do not type card numbers, passwords or private documents in it. Its answers are automated and can be wrong; the product pages and these policies are the final word. To have it forget what you told it, type "Delete my saved information" in the chat, or write to us. In Microsoft's words: "We partner with Microsoft to provide Clarity Brand agents, which use business and order management data to deliver a personalized experience. Order management data may be captured through first-party and third-party cookies and other tracking technologies. Information you provide to the Brand agents, including conversational content and interaction events, is shared with Microsoft and is used to operate, secure, and improve the service. For more information about how Microsoft collects and processes data, see the Microsoft Privacy Statement."
Meta pixel and Conversions API (Facebook and Instagram). They tell Meta which pages were viewed and whether a purchase was made, so we can measure our posts and any ads, and show them to people likely to be interested. With a purchase, the shop can also send Meta the buyer's email and phone in hashed (scrambled) form so Meta can match them; Meta also uses this for its own advertising. Meta may connect all of this to a Facebook or Instagram account. You can control it in Meta's Accounts Center, under "Your activity off Meta technologies".
Google (Ads, Merchant Center and YouTube). A Google tag tells Google which pages and products were viewed, what went into the cart and whether a purchase was made, so we can measure our listings and any ads. Google uses this under its own privacy policy.
Printful's shop pixel. Printful, which makes our printed pieces, also receives page and cart events from the shop.
Message buttons (Instagram, WhatsApp). If you choose to write to us through them, the conversation is carried by Meta's messaging services.

You can block or delete cookies in your browser at any time; the cart and checkout still need their own to work.

When you visit vaultrec.com: nothing. The site sets no cookies, runs no analytics scripts and loads nothing from third parties; its two forms carry a privacy-respecting bot check (Cloudflare Turnstile) and relay your message to the studio's phone without storing it on the site. The Wall shows only the name, place and line you choose to post, after a human check. The details are on vaultrec.com/security/.

Who receives it

We do not sell or rent personal information for money. These companies receive it so that an order, a booking or the shop itself can work, or, for the analytics and advertising tools above, as described there:

Shopify (Shopify Inc., Canada): the shop platform, its hosting, the checkout, order emails and the shop's contact and request forms. Shopify's own privacy policy applies to how it operates the platform.
Shopify Payments, which runs on Stripe: card payments. Your card details go to them, not to us.
Printful: makes and ships the printed pieces. It receives your name, shipping address, email (and phone if given) and what you ordered, and passes the address to the carrier. Its shop pixel also receives page and cart events. Printful operates facilities in several countries, including Canada.
Microsoft: Clarity analytics and the Lieutenant chat on the shop, as described above. See the Microsoft Privacy Statement.
Meta Platforms: ad measurement on the shop, and messages you choose to send us on Instagram or WhatsApp. See the Meta Privacy Policy.
Google: ad and listing measurement on the shop. See the Google Privacy Policy.
HubSpot: our customer records: the name, contact details and project notes of people who ask us for a quote or hire us.
Shopify apps that help run the shop (for example tax calculation, translation and fraud screening): each receives only the order details its job needs.
Cloudflare: serves vaultrec.com and provides the bot check on its forms. Like any network, it sees the technical details of a request (such as the IP address) while serving it. We set no cookies through it.
Telegram: carries messages from the vaultrec.com forms to the studio's phone. The message exists on that phone until it has been answered, then it is deleted.

Some of these processors store data outside Canada, mainly in the United States, under their own safeguards.

How long we keep it

Orders, invoices and receipts: at least six years after the end of the tax year they belong to, because Canadian tax rules require it.
Service files (drafts, studies, source files we made for you): twelve months after delivery, then deleted, unless you ask us to keep them or to delete them sooner. The final files are yours and you keep your own copy.
Messages, quote requests and the customer record made from them: deleted within ninety days if no work follows. If you become a client, your record stays while we work together and is then kept only as long as the tax rules above require.
Shopify customer records: kept while the order records above are kept; you can ask for your customer account data to be erased at any time, and we will do so where the tax rules allow.
Analytics and chat data: held by Microsoft, Meta and Google under their own retention periods, set out in their privacy statements. We do not copy it anywhere else.

Your rights

Under Canada's federal privacy law (PIPEDA) and, if you are in Quebec, under Law 25, you can:

ask what personal information we hold about you and receive a copy;
ask us to correct it;
withdraw your consent to uses that are not needed to complete an order or meet a legal duty, including analytics and ad measurement;
in Quebec, ask for your information in a structured, commonly used format (portability), and ask that a link to it be removed or de-indexed where the law provides;
complain to us first, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Write to shop@vaultrec.com. We answer within thirty days.

Marketing

If you subscribe to news from the shop with the sign-up box, we send you only that, with a working unsubscribe link in every message, as Canada's anti-spam law (CASL) requires. The box is never pre-ticked, and buying something from us does not put you on a list.

Security and incidents

Payments and the checkout are encrypted in transit; card data never reaches us. If an incident ever exposes personal information in a way that could cause real harm, we will tell the people affected and the privacy regulators the law names, keep a record of the incident, and say what we changed.

Children

This shop is not directed at children, and we do not knowingly collect personal information from anyone under fourteen.

Changes

This policy is dated. If it changes in substance, the date changes and the old version is kept on request. Last updated: 12 October 2026. (Previous version: 8 October 2026. What changed: the shop's analytics, chat assistant, Meta, Google and Printful measurement and our customer records are now named.)