Legal
Privacy Policy
Effective
ECAN Enterprises is a family-run sole proprietorship registered in Ontario (Business Identification Number 1001733988) that sells, builds, and repairs computers, builds software and websites, and develops and operates the Prep Buddies prep centre software, in London, Ontario. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and how you can access or correct it. We follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
The short version: this website sets no cookies, runs no analytics, and has no accounts. We collect only what you send us or what a job needs. We do not sell personal information. We do not look through files on devices you bring us for repair. Section 13 covers the Prep Buddies software, including the Amazon information it handles.
1. Privacy contact
Our Privacy Officer is accountable for how we handle personal information and answers all privacy questions, access requests, and complaints.
- Privacy Officer, ECAN Enterprises
- Email: info@ecanenterprises.ca (put "Privacy request" in the subject line)
- A mailing address for written requests is available by email on request.
2. This website
ecanenterprises.ca is a mostly static website. It has no login, no shopping cart, and no comment forms, and it does not store anything in your browser.
- No cookies, analytics, or advertising trackers. We do not use Google Analytics, social media pixels, or similar tools. Fonts, images, and scripts are all served from our own domain.
- Hosting logs. The site is hosted by Cloudflare, Inc. Like any web host, Cloudflare automatically receives your IP address, browser type, the page requested, and the time of the request so it can deliver the page and block attacks. Cloudflare may also ask your browser to report network connection errors. We do not use this data to identify visitors.
- The quote form sends your request to us by email. When you press "Send Inquiry", the details you entered are sent to our website host and emailed to info@ecanenterprises.ca through Resend, our email delivery provider. The website does not keep a copy. We keep the email as described in section 8.
3. What we collect and why
We collect personal information directly from you, from the marketplaces where you buy from us, or from the business that hired us. We use it only for the purposes below, or for other purposes you agree to or the law requires.
| When | What we collect | Why |
|---|---|---|
| You ask for a quote or email us | Name, email address, phone number if you give it, and what you tell us about the job | To reply, prepare a quote, and schedule work |
| You book a repair, build, or on-site visit | Contact details, service or pickup address, device make, model, and serial number, the problem description, and any password or PIN you choose to give us | To do the work, contact you about it, return the device, and handle warranty claims |
| You buy from us | Name, contact details, shipping address, what you bought, and payment confirmation | To complete the sale, ship or hand over the item, and honour returns and warranties |
| You buy through Amazon.ca, eBay, Facebook Marketplace, or Kijiji | The order and shipping details the marketplace gives us | To fill the order. The marketplace's own privacy policy also applies. |
| You sell us a used device | Name, contact details, the device, and the price paid. We may also ask to see ID to confirm the device is yours to sell. | To record the purchase and reduce the risk of buying stolen property |
| You hire us for software or web development | Business contact details, project information, and account access you give us | To scope, build, deliver, and support the project |
We also keep invoices and payment records because tax law requires it.
4. Data on devices we repair
Computers and phones hold some of the most private information people have. When you leave a device with us:
- We access the device only as far as the job needs, for example to run diagnostics, install an operating system, or remove malware. We do not open, browse, or copy your personal files, photos, messages, or accounts.
- We copy or recover your data only when the job requires it and you ask for it, for example a data transfer, backup, or recovery. Any temporary copy is deleted within 30 days after you collect the device, unless you ask us to keep it longer.
- If you give us a password or PIN, we use it only for your job and delete our record of it when the job is finished. We recommend changing it afterwards.
- Before drop-off, please back up your data and remove or lock anything you would rather we not have access to.
- If we come across content that we are legally required to report, we will report it.
5. Devices we buy or resell
Every used or refurbished computer, drive, or phone we buy is erased before resale using methods based on the NIST SP 800-88 media sanitization guidelines. Drives that cannot be reliably erased are physically destroyed. We do not look at, keep, or use personal information left on devices we buy.
6. Who we share it with
We do not sell, rent, or trade personal information. We share it only with service providers that help us run the business, and only what they need:
- Cloudflare, Inc. (United States): website hosting and domain name service.
- Google LLC (United States): Google Workspace, including Gmail and Google Groups, where we receive, send, and store business email.
- Resend (United States): delivery of automated email from our website, including quote requests sent through the website form.
- Payment providers: Stripe, Square, or PayPal when you pay by card or PayPal, and your bank for Interac e-Transfer. These providers process your card or account details under their own policies. We never see or store full card numbers.
- Couriers and Canada Post: your name, address, and phone number when we ship to you.
- Marketplaces: Amazon.ca, eBay, Facebook Marketplace, and Kijiji, for sales made through them.
- Manufacturers and distributors: your name, contact details, and proof of purchase when we handle a warranty claim for you.
- Professional advisers such as our accountant, and government or law enforcement when the law requires or allows it.
7. Storage outside Canada
Several of our service providers store or process information in the United States and other countries. While it is there, it is subject to the laws of those countries and may be accessed by their courts, law enforcement, and national security authorities. We choose providers that commit to protecting the information.
8. How long we keep it
| Information | Kept for |
|---|---|
| Quote requests and emails that do not lead to a job | 12 months |
| Work orders, invoices, receipts, and payment records | 6 years after the end of the tax year they relate to, as required by tax law |
| Temporary copies of customer data made for a repair or transfer | Deleted within 30 days after you collect the device |
| Passwords and PINs you give us | Deleted when the job is finished |
| Records of devices bought from the public and erasure logs | 2 years, or longer if the law requires |
| Development project files | As set out in the project agreement |
When we no longer need information, we securely delete or destroy it.
9. How we protect it
- Business accounts use strong, unique passwords and two-step verification.
- Customer devices and storage media are kept in a secure area and handled only by the people working on them.
- Paper records are stored securely and shredded when no longer needed.
- Our website is served over HTTPS only.
No method of storage or transmission is completely secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires. To report a security problem with this website, email info@ecanenterprises.ca.
10. Your choices and rights
- Access and correction. You can ask what personal information we hold about you and ask us to correct it. We respond within 30 days.
- Withdrawing consent. You can withdraw consent at any time, subject to legal or contract limits. We will explain what that means, for example that we may not be able to finish a job.
- Complaints. Contact our Privacy Officer first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada. Quebec residents may also contact the Commission d'accès à l'information du Québec.
We may need to confirm your identity before we act on a request.
11. Emails from us
We email you about your quote, order, repair, or project. We do not send newsletters or promotions. If we start, we will send them only to people who have agreed or where Canada's anti-spam law (CASL) otherwise permits it. Every such email will identify us and include a working unsubscribe link, and we will act on unsubscribe requests within 10 business days.
12. Client development work
When we build or maintain software or websites for a business, we may handle that business's customer data. In that role we act only on the client's instructions, and the client's own privacy policy applies to its customers. If you are a customer of one of our clients, please contact that business directly.
13. Prep Buddies (prep centre software)
ECAN Enterprises develops and operates Prep Buddies, software that an Amazon FBA prep centre uses to receive, store, prep, and ship its merchants' inventory, with a portal where each merchant follows their own inventory and invoices. This section covers the information Prep Buddies handles. Everything else in this policy also applies to it.
What Prep Buddies holds and why
| Information | Whose | Why |
|---|---|---|
| Name, email address, phone number if given, role, and sign-in details: a hashed password, an encrypted two-factor secret, and sign-in times | Prep centre staff and merchant users | To create accounts, sign people in securely, and show each person only what their role allows |
| Business name, contact name, email, phone, address, billing settings, and rates | Merchants of the prep centre | To run the merchant's account, record work, and prepare invoices |
| Products, inbound and outbound shipments, inventory, issues, photos of received items, and invoices | Merchants of the prep centre | To receive, prep, store, and ship inventory and to bill for the work |
| A record of sensitive actions, such as sign-ins, Amazon connections, and data deletions, with the IP address and browser type of the request | Staff and merchant users | To protect accounts, detect misuse, and prove what happened |
| Amazon information, described below | Merchants who connect their Amazon seller account | To create FBA shipments and labels for inventory the prep centre ships to Amazon on the merchant's behalf |
Prep Buddies uses a cookie only to keep a signed-in user signed in. It has no advertising or analytics trackers. It does not take card or online payments.
Amazon information
Prep Buddies connects to a merchant's Amazon seller account through Amazon's Selling Partner API only after the merchant's account owner authorizes it on Amazon's own Seller Central page. It requests the Amazon Fulfillment and Product Listing roles only.
- What it uses: the marketplaces the seller sells in; catalogue details for the seller's products, such as titles, identifiers, dimensions, and weights; FBA inbound eligibility; FBA inventory levels; and FBA inbound shipment plans, shipments, item labels, box labels, and bills of lading for inventory the prep centre ships on the seller's behalf.
- What it never receives: Amazon orders, buyer or customer names, addresses, or any other information about Amazon customers, and the seller's financial data, messages, or reports.
- Purpose limit: we use Amazon information only to provide Prep Buddies to that merchant and their prep centre. We do not sell it, share it with other merchants, use it for advertising, or combine it with information from other sources to profile anyone.
- Access token: the authorization token Amazon issues is encrypted (AES-256-GCM) before it is stored and is never sent to a web browser.
- Source tagging: product details that came from Amazon are marked as such, so they can be found and deleted separately from details the merchant or staff entered.
- Disconnecting: the merchant's account owner can disconnect Prep Buddies at any time from the merchant portal or in Seller Central.
- Deletion: when a merchant disconnects, Amazon ends the authorization, or a merchant asks us to delete their Amazon information, we delete the Amazon information held for that merchant within 30 days and keep a record of what was deleted. Product dimensions that staff have locked as their own measurements are kept, because invoices rely on them.
Who Prep Buddies information is shared with
- The prep centre and its staff, according to each person's role. Warehouse staff do not see prices or billing.
- Amazon, when a connected merchant's shipments and labels are created through the Selling Partner API.
- Resend (United States), to deliver Prep Buddies email such as receiving reports, shipment notices, invoices, and account and security notices.
Prep Buddies runs on servers operated by ECAN Enterprises. If we move it to a hosting provider, we will name that provider in this section before any merchant's information is moved. The optional AI assistant in the merchant portal is switched off, and no Prep Buddies information is sent to an AI provider.
How long Prep Buddies keeps it
| Information | Kept for |
|---|---|
| Amazon information for a merchant | Until the authorization ends or the merchant asks, then deleted within 30 days |
| User accounts and merchant account details | While the account is active, then deleted on request unless invoices or the law require us to keep them |
| Invoices and the work records behind them | 6 years after the end of the tax year they relate to, as required by tax law |
| The record of sensitive actions | Up to 2 years. Sign-in and Amazon deletion records are kept for at least 1 year. |
How Prep Buddies protects it
- Every account signs in with a password and a two-factor code. Ten failed attempts in a row lock the account for 30 minutes.
- Passwords must be at least 12 characters with four character types, and recent passwords cannot be reused.
- Each user sees only what their role allows, and merchants see only their own business. Requests for another merchant's records are refused.
- Two-factor secrets and Amazon tokens are encrypted, and only a fixed list of Amazon operations can be called.
- If a security incident affects Amazon information, we notify Amazon within 24 hours of detecting it, as Amazon's Data Protection Policy requires, and we notify affected merchants and the prep centre.
Requests about Prep Buddies information
Merchants and users can ask for access to, correction of, or deletion of their Prep Buddies information, or deletion of their Amazon information, by emailing info@ecanenterprises.ca with "Prep Buddies privacy request" in the subject line. The rights in section 10 apply. The prep centre's own privacy policy also applies to how it uses its merchants' information.
14. Children
Our website and services are not directed to children. We do not knowingly collect personal information from children under 13. A parent or guardian should arrange repairs of a child's device.
15. Changes to this policy
We will update this policy when our practices change, and we will change the effective date at the top of this page. If a change significantly affects how we use information we already hold, we will ask for your consent where required.