Privacy Policy

Effective September 9, 2026  ·  aylmereats.ca

This policy explains what aylmereats.ca collects, why, where it goes and how to get rid of it. It covers this website, the ordering kiosks in our shops, and our mobile apps. We have tried to describe what the software actually does rather than reserve every right a lawyer could imagine.

Who we are

aylmereats.ca is a local, pay-at-the-door delivery service operating in the Aylmer sector of Gatineau, Quebec, Canada. We are the party responsible for the personal information described here.

For any privacy question, request or complaint, including a request for deletion, contact us at support@aylmereats.ca. We will route it to the person responsible for the protection of personal information.

What we collect

Your account

An account is created the first time you confirm a phone number. Against that account we can hold:

• Your phone number. This is also your account identifier, in place of a username.
• Your name, as you typed it at checkout.
• A delivery address, apartment or unit, and postal code.
• Standing delivery instructions, if you leave any.
• Whether you have confirmed you are of legal age, and when.
• Whether you asked to receive SMS updates.
• When the account was created, when you last signed in, and a random sign-in token.

We do not store an email address for ordering. There is no email column on the account, and the one that used to exist on orders has been removed from the database. We do not store a password, because there isn't one.

Signing in

Sign-in is by text message. You enter your phone number, we generate a random six-digit code, store it, and text it to you. The code expires after five minutes and is marked as used once you enter it. We limit how many codes can be requested for one number in a fifteen-minute window, to stop the system being used to text somebody repeatedly.

Orders

When you place an order we record the items, the time, the name, phone number and address the order is going to, any note you attach, the delivery fee and total, the payment method, any tip, and which driver was assigned. Payment method is recorded as a category such as cash, card or unpaid, and for orders that reach us from a delivery app, which app they came from.

Delivery coordinates

This one deserves a plain answer. Every delivery order stores the latitude and longitude of the delivery destination. We need it to calculate the fee, to decide whether you are in our delivery area, and to put a pin on the driver's map.

That coordinate is the drop-off point you confirmed, not a trace of where you have been. If you tap the "find my location" button on the delivery map, your browser or phone asks your permission, hands us a single position, and we use it to centre the map and suggest the closest street address. You still have to confirm the address before ordering. We take one reading at the moment you tap the button. There is no background location, no always-on location, and no tracking of customers between orders.

Age confirmation

We sell alcohol and tobacco, so we ask you to confirm your age before showing those products. We remember that confirmation so you are not asked on every visit. If you are signed in, it is stored on your account; otherwise it lives only in a cookie in your browser. We do not collect or keep a date of birth or a copy of any identity document. Age is verified in person, by the driver or the clerk, at the point of sale.

Server logs

Like any website, our server keeps standard access logs: the address of the request, the page requested, the time, and the browser's user-agent string. These are rotated in the normal course.

Payments

We are a pay-at-the-door service. This website does not collect, process or store card numbers, expiry dates or security codes. There is nowhere on the site to type them. Card payments are taken in person on a payment terminal, and the card data goes from that terminal to the payment processor without passing through this website. Our records show only the amount, and that the payment method was a card.

Cookies

We use a small number of cookies. None of them are advertising cookies.

• Session cookie. Standard PHP session identifier, so your cart survives from page to page. Expires when you close your browser.
• remember_token and remember_user. Set when you sign in, so you do not have to request a code every time. They last thirty days and are marked Secure and HttpOnly, meaning they travel only over an encrypted connection and cannot be read by scripts on the page.
• ae_age. Remembers that you confirmed your age. Lasts one year.

Third-party scripts described in the next section may set cookies of their own, under their own policies.

Analytics and advertising

We run no analytics and no advertising trackers. There is no Google Analytics, no advertising pixel, no heatmap or session-recording tool, and no data broker. The site once carried a Google Analytics tag; it has been commented out of the page header and does not load.

Our mobile apps send a small diagnostic ping to our own server when the app starts, reporting whether the native layer loaded correctly and whether notifications were permitted. It carries no personal information and is not written to any database. This runs only inside the app, never on the website.

Who else sees your information

We do not sell personal information and we do not share it for anyone else's marketing. It reaches other parties only where the service requires it.

Service providers

• VOIP.ms sends our text messages. It receives your phone number and the message body, which for a sign-in is the six-digit code.
• Cluster, our point-of-sale and payment system, receives the order together with the customer name, phone number and delivery address, so the sale can be recorded and receipted as required.
• DreamHost hosts the website and its database.
• Apple and Google deliver push notifications, but only to our own staff devices. No customer is enrolled in push notifications.

Scripts loaded in your browser

Some pages load resources from other companies. When your browser fetches them, that company can see your address and the page you are on:

• Google Translate. The translate control in the navigation menu loads a script from Google on every page.
• Map tiles and map software. The delivery map draws tiles from OpenFreeMap, falling back to OpenStreetMap, and loads the MapLibre and Leaflet mapping libraries from the unpkg content delivery network.
• Facebook. A page of search results with no matches embeds one of our Facebook videos, which loads Facebook's script.

Delivery apps

Orders placed through Uber Eats, SkipTheDishes or DoorDash reach us from those platforms. Whatever you did on their app is governed by their privacy policy, not ours. We receive the order details they choose to pass on.

Law and safety

We may disclose information where the law requires it, or where it is necessary to establish or defend a legal claim, or to protect someone's safety.

Where your information is held

Our website and database run on a hosted virtual server, and our SMS and push-notification providers operate their own infrastructure. Some of these providers store or process personal information outside Quebec, including outside Canada. Information held in another country is subject to the laws of that country and may be accessible to its authorities. By using the service you acknowledge this transfer. If you would like the specifics for a particular provider, ask us.

How long we keep it

Order records are kept as business records. Sales records must be retained for tax and consumer-protection purposes, so we cannot delete an order the moment it is asked for; we keep them for as long as the law requires and no longer than we need to.

The "clear order history" control on your account hides orders from your view. It does not erase them. The underlying record stays in our database, flagged as hidden, and stays visible to us. We would rather say so than let the wording imply otherwise. The same is true of hiding a single order.

Deleting your account is different, and you can do it yourself. On your account page, below Log Out, “Delete my account” closes the account immediately. It clears your name, address, apartment, postal code and delivery notes; deletes your saved favourites; ends the SMS subscription; signs you out on every device; and hides your order history. Your phone number stops being linked to the account, so if you sign up again with the same number you get a new account with nothing carried over. We do not ask you to email us for this.

Two things deliberately survive it, and we would rather be plain about them than let the wording imply otherwise. Records of orders we have already delivered are kept, including the name, phone number and address the order was delivered to, because sales records must be retained for tax purposes. And because those records keep the phone number, our staff can still see that a number has ordered before. We use that to run the shop — recognising a caller, dealing with fraudulent orders, and honouring a block. It is not visible to customers anywhere.

If you want something erased beyond that, email us and we will do what we can, subject to the records we are legally obliged to retain.

Your rights

Under Canadian federal privacy law and Quebec's privacy legislation you may:

• Ask what personal information we hold about you, and get a copy.
• Have anything inaccurate corrected.
• Delete your account yourself, from your account page, subject to records we must keep.
• Withdraw consent, including for text messages.
• Ask us to stop using or sharing information where we have no lawful basis to continue.
• Receive the computerised information you gave us in a structured, commonly used format.
• Complain to us, and if we do not resolve it, to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Send any of these to support@aylmereats.ca. We may need to confirm you control the phone number on the account before acting, so that nobody else can request your data.

Text messages

We text you a code when you sign in. That message is part of signing in and is not marketing. At checkout there is a box asking whether you want SMS updates about your order; you can untick it, and you can ask us to change the setting at any time by emailing us. Standard message rates from your carrier may apply.

Security

The site is served over an encrypted connection. Sign-in cookies are marked Secure and HttpOnly. Sign-in codes are random, short-lived and single-use, and requests for them are rate-limited. Database queries handling personal information use prepared statements. Access to the administrative side of the system is restricted to staff accounts with individually granted permissions.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach that presents a risk of serious injury, we will notify the people affected and the appropriate regulator as the law requires.

Children

This service is not directed at children and we do not knowingly create accounts for them. Part of our catalogue is age-restricted by law, and the driver or clerk checks identification in person. If you believe a child has given us personal information, contact us and we will remove it.

Cameras in our apps

Our staff app can use a phone camera to scan a product barcode. The image is decoded on the device and only the resulting barcode number is used. No photograph or video frame is uploaded or stored. This feature exists only in the staff app; the customer-facing website and ordering kiosks never request camera access.

Changes to this policy

If we change this policy, we will change the effective date at the top of this page and post the new version here. If a change materially affects how we handle information we already hold, we will say so more prominently, on the site and, where it matters enough, by text message.

Contact

Questions, requests, corrections and complaints:
support@aylmereats.ca

aylmereats.ca
Aylmer, Gatineau, Quebec, Canada