Legal

Privacy Policy

Effective date: January 1, 2026  ·  Last updated: June 2026
This policy applies to East City Smithy, a sole proprietorship registered in Ontario, Canada, operating at EAST CITYforge.com.

East City Smithy is committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law. This policy explains what information we collect, why we collect it, how we use it, and your rights regarding it.

1. Who We Are

East City Smithy is a one-person blacksmithing and bladesmithing business based in Ontario, Canada, operated by Jared Lucas. We sell hand-forged knives, blades, and ironwork directly to customers across Canada and the United States.

2. Information We Collect

a) Information you provide directly

• Orders: When you purchase through our site, Stripe collects your name, email address, shipping address, phone number, and payment card details. We receive a summary of your order but do not handle or store your card details at any point — those remain with Stripe.
• Contact and commission forms: Your name, email address, and the message content you submit.
• Newsletter signup: Your email address, collected only with your explicit consent.

b) Information collected automatically

• Cart data: Your shopping cart is stored in your browser's local storage on your own device. It does not leave your device except when you proceed to checkout.
• Server logs: Netlify (our hosting provider) automatically collects standard server logs including IP addresses and browser type for security and reliability purposes. We do not use these for marketing.

c) What we do NOT collect

We do not use tracking cookies, advertising pixels, Google Analytics, Facebook Pixel, or any other third-party tracking technology. We do not build profiles on visitors for advertising purposes.

3. Why We Collect It — Purposes

• Fulfilling your order: Processing payment, arranging shipping, and communicating order status.
• Responding to inquiries: Replying to commission requests and questions submitted through our contact form.
• Newsletter: Sending occasional updates about new work available for sale — only if you have given express consent.
• Legal compliance: Retaining records as required by Canadian tax law (CRA) and consumer protection obligations.

4. Legal Basis for Processing

Under PIPEDA, we rely on your consent (provided when placing an order or signing up for our newsletter) and legitimate business purposes (fulfilling contracts, legal obligations) as the basis for collecting and using personal information.

5. Third-Party Service Providers

We use the following trusted third parties to operate our business. Each has their own privacy policy:

• Stripe, Inc. — Payment processing. Stripe handles all card data under PCI DSS Level 1 compliance. Stripe Privacy Policy
• Netlify, Inc. — Website hosting and serverless functions. Netlify Privacy Policy
• Formspree — Contact and commission form submissions. Formspree Privacy Policy
• Google Fonts — Web fonts loaded from Google's servers. Google Privacy Policy

We do not sell, rent, trade, or share your personal information with any other third parties except as required by law.

6. Data Retention

• Order records: Retained for 7 years as required by the Canada Revenue Agency for tax purposes.
• Contact form submissions: Retained for as long as reasonably necessary to respond to and follow up on your inquiry, typically no more than 2 years.
• Newsletter subscriptions: Retained until you unsubscribe.

7. Data Storage and Security

Our website is hosted in the United States by Netlify. Payment data is processed and stored by Stripe, which operates globally. By purchasing from us, you acknowledge that your data may be processed outside of Canada. Stripe is certified to PCI DSS Level 1, the highest security standard for card data handling.

We implement reasonable technical and organizational measures to protect personal information, including HTTPS encryption on all pages and server-side validation of all checkout requests.

8. Your Rights Under PIPEDA

You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Ask us to correct inaccurate information.
• Withdrawal of consent: Withdraw consent for any purpose at any time (subject to legal and contractual restrictions), including unsubscribing from our newsletter at any time.
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe your privacy rights have been violated.

To exercise any of these rights, contact us at mjaredlucas@gmail.com. We will respond within 30 days.

9. Newsletter and CASL Compliance

Canada's Anti-Spam Legislation (CASL) requires that we obtain your express consent before sending commercial electronic messages. We only add you to our mailing list when you actively check the consent box on our signup form. Every newsletter we send includes a clear and easy unsubscribe option. We will honour all unsubscribe requests promptly.

10. Children's Privacy

Our site is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted information to us, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the most recent update. Continued use of our site after changes are posted constitutes your acceptance of the updated policy.

12. Contact