STOHRX Privacy Policy

Effective Date: September 10, 2026
Last Updated: October 6, 2026

Draft for review. This document should be reviewed by a qualified Ontario privacy lawyer or privacy professional before it is relied upon, in particular Sections 1, 2, and 8.

STOHRX ("Company," "we," "us," or "our") operates a website hosting, ordering, and payment platform (the "Service") for business clients ("Clients") and processes information relating to Clients and to the customers who place orders on Client websites ("End Customers"). This Privacy Policy explains how we collect, use, disclose, and protect personal information, and is intended to comply with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), which governs the private-sector collection and use of personal information in Ontario.

This policy applies to three groups of individuals, described separately below where relevant: (1) individuals associated with our Clients (for example, business owners and staff who use our dashboard), (2) End Customers who interact with a Client's website, and (3) visitors to our own website, stohrx.ca, including people who contact us about our services. For End Customer personal information, the relevant Client is the organization accountable under PIPEDA, and we act as its service provider. Each Client is responsible for publishing its own privacy notice to its End Customers.

1. Information We Collect

From Clients:

• Business name, contact information, and business registration details;
• Subscription and billing information (billing period, payment method, invoices), processed through Stripe;
• Identity verification information collected by Stripe as part of Stripe Connect account onboarding (for example, owner/representative identity, date of birth, and business ownership details), required to enable payment processing and payouts;
• Website content, menu items, promotions, and configuration data the Client enters; and
• Account credentials and usage data related to the dashboard.

From End Customers (on behalf of Clients):

• Name, email address, phone number, and the pickup date and time, provided when placing an order;
• Order contents and order history;
• A stored payment card. When an order is placed, the End Customer's card is saved with Stripe for possible later use. Stripe collects and stores the full card details; we store only a Stripe reference token and limited card metadata (such as card brand and last four digits). No amount is charged or held at the time the card is stored;
• A record of the End Customer's authorization for a later No-Show Fee. For an order placed online, this includes the text shown, the date and time of acceptance, the End Customer's IP address, and the browser user-agent string. For an order a Client's staff enters directly into the dashboard (for example, an order taken by phone), this instead includes the date and time the staff member recorded that the End Customer agreed to the No-Show Fee policy. Retained as evidence of consent;
• Technical information such as IP address, browser type, and device information, collected automatically through use of the website (see Cookies, below); and
• Website usage information, where a Client has enabled website analytics: the pages and menus viewed, items opened or added to a cart, whether checkout was started or completed, how long each page was visible, general device type (phone, tablet, or computer), and the referring website. This is linked only to a random identifier held in the browser's session storage for a single tab, not to the End Customer's name, contact details, or order, and is stored without the IP address or browser user-agent string (see Cookies and Tracking, below).

From visitors to stohrx.ca:

• If you send us a message through our Contact form: your name and email address, and any phone number, business name, area of interest, and message you choose to include; and
• Website usage information about our own website (the pages viewed, how long each page was visible, whether the Contact form was sent, general device type, and the referring website), collected in the same way and with the same limits as website analytics on Client websites (see Cookies and Tracking, below).

2. How We Use Information

We use personal information to:

• Provide, operate, and maintain the Service (hosting, ordering, card storage, and No-Show Fee functionality);
• Bill Clients for subscription and build Fees, including automatic renewal of monthly or annual subscriptions;
• On a Client's instruction, charge a No-Show Fee to an End Customer's stored card through Stripe Connect and route the amount to the correct Client — payment for the underlying order itself is made directly between End Customer and Client (for example, in person) and is not processed through the Service;
• Communicate with Clients about their account, billing, and service updates;
• Enable Clients to manage orders, menus, and promotions;
• Provide Clients that enable website analytics with statistics about how their own website is used (for example, menu views, add-to-cart and checkout rates, and time on page);
• Respond to messages sent through our website's Contact form and follow up with prospective Clients about our services;
• Understand how our own website is used, so we can improve it;
• Detect, prevent, and respond to fraud, security incidents, or misuse of the Service;
• Investigate and resolve payment disputes, chargebacks, and No-Show Fee claims, including compiling and submitting relevant order, transaction, authorization, and communication records as evidence to Stripe or card networks;
• Charge or invoice a Client's payment method on file for amounts owed under our Terms of Service, including shortfalls resulting from disputed or reversed No-Show Fees; and
• Comply with legal obligations, including tax and financial recordkeeping requirements.

We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only with consent (which may be express or implied depending on the sensitivity of the information), consistent with PIPEDA's fair information principles.

3. How Information Is Shared

We do not sell personal information. We share personal information only as follows:

• With Stripe, Inc. and Stripe Payments Canada, Ltd. ("Stripe"), our payment processor, to store cards, process No-Show Fees, transfers, and payouts, and to investigate and resolve related payment disputes and chargebacks. Stripe's own privacy policy governs its handling of payment data.
• With card networks, where necessary to contest or resolve a payment dispute or chargeback.
• With the relevant Client, so that Client can fulfill orders placed by its End Customers and manage its own customer relationships.
• With service providers who help us operate the Service (for example, cloud hosting and database providers), under contractual obligations to protect the information and use it only for the purposes we specify.
• With Formspree, which delivers messages sent through our website's Contact form to our email, and Google, whose reCAPTCHA service checks Contact form submissions for spam and abuse. Google's Privacy Policy and Terms of Service apply to reCAPTCHA.
• As required by law, such as in response to a court order, subpoena, or regulatory request.
• In connection with a business transaction, such as a merger, acquisition, or sale of assets, subject to the acquiring party's obligation to handle the information in a manner consistent with this policy.

4. Cross-Border Data Storage

Some of our service providers, including Stripe and our cloud infrastructure providers, may store or process personal information outside of Canada, including in the United States. Where this occurs, information may be subject to the laws of the jurisdiction in which it is held, including lawful access by that jurisdiction's authorities. By using the Service, you acknowledge this possibility.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy, including to satisfy legal, accounting, or reporting obligations. Records relating to a payment dispute or chargeback, including No-Show Fee authorizations and claims, are retained for as long as needed to resolve the dispute and for any applicable card network or regulatory record-keeping window thereafter. When information is no longer needed, we take reasonable steps to securely delete or anonymize it. Website usage information collected for website analytics is automatically deleted 90 days after it is collected; aggregated statistics that do not identify any individual may be kept. Messages sent through our Contact form are kept only as long as needed to respond and follow up, and you can ask us to delete yours at any time.

6. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction, appropriate to the sensitivity of the information. Full card numbers are held by Stripe, not on our own servers. No system is completely secure, and we cannot guarantee absolute security.

7. Data Breach Notification

If we become aware of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm to an individual, we will notify the affected individual(s) and report the breach to the Office of the Privacy Commissioner of Canada, as required under PIPEDA, and will notify any affected Client so it can meet its own obligations. We will keep a record of every such breach, regardless of whether it meets this threshold, for at least 24 months.

8. Cookies and Tracking

Client websites hosted on the Service use only cookies that are strictly necessary for core functionality, such as maintaining an order session and remembering menu selections, together with cookies set by Stripe (for example __stripe_mid and __stripe_sid) that Stripe uses for payment security and fraud prevention. We do not use advertising cookies, and we do not place third-party analytics or advertising tools on Client websites.

Where a Client has enabled website analytics, its website also uses first-party analytics that we operate on the Client's behalf. It does not use cookies: it stores a random identifier in the browser's session storage, which is deleted when the browser tab is closed and is not used to recognize a visitor across visits or on other websites. It does not record keystrokes, form contents, or the visitor's screen. The resulting information is used only to give that Client statistics about its own website and to operate and secure the Service; it is never sold, used for advertising, or shared with other Clients. Analytics is switched off automatically for browsers that send a Global Privacy Control or Do Not Track signal, and each Client website provides a way for visitors to turn it off.

Our own website, stohrx.ca, uses the same first-party analytics, with the same limits, and you can turn it off for this browser below. Turning it off doesn't affect anything else on the site. When our Contact page is opened, Google's reCAPTCHA may set cookies that it uses for security and spam prevention. If we add advertising or other non-essential tracking in the future, we will update this Privacy Policy and, where required by law, obtain consent before using it.

9. Your Rights (Access and Correction)

Under PIPEDA, individuals have the right to:

• Access the personal information we hold about them;
• Request correction of inaccurate or incomplete information; and
• Withdraw consent for certain uses, subject to legal or contractual restrictions and reasonable notice.

For personal information we hold as a service provider to a Client, we may direct the request to that Client, or handle it together with them. Requests can be directed to our Privacy Officer using the contact information below. We will respond within a reasonable time and in accordance with applicable law.

10. Children's Privacy

The Service is intended for use by businesses and their adult representatives, and is not directed at children. We do not knowingly collect personal information from children.

11. Accountability — Our Privacy Officer

In accordance with PIPEDA's accountability principle, we have designated an individual responsible for our compliance with this policy and applicable privacy law:

Privacy Officer: Youssef H.A. Awadalla
Email: stohrx@gmail.com
Address: 384 Nautical Blvd., Oakville, Ontario, Canada, L6L 6W7

12. Complaints

If you have a concern about how we've handled your personal information, please contact our Privacy Officer first. If you remain unsatisfied, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version with a revised "Last Updated" date, and, where changes are material, provide additional notice.

14. Contact Us

STOHRX
384 Nautical Blvd., Oakville, Ontario, Canada, L6L 6W7
stohrx@gmail.com
289-707-2128