Privacy Policy

North Lucid ("we," "us," or "our") is committed to protecting the privacy and personal information of our customers and website visitors. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at northlucid.com, create an account, or make a purchase. This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information), and other applicable Canadian privacy legislation. Optional analytics remain off until you choose Allow analytics.

We collect the following categories of personal information: Information You Provide Directly: • Account registration: name, email address, and password • Orders: shipping address, billing address, phone number • Payment: card entry is handled by the external provider; our checkout receives a token and limited payment references. Interac e-Transfer uses the information needed to match and confirm your payment • Communications: contact-form messages, support emails, and messages or audio you choose to send to the optional assistant • Reviews and feedback: product reviews, ratings, and testimonials • Referral program: referral codes and associated activity Information Collected Automatically: • Device information: IP address, browser type and version, operating system • Operational and security request information: referring-page addresses, browser/security attributes and available request or session identifiers may be processed with account or order activity independently of optional analytics • Optional usage statistics: aggregate page visits, navigation and referring-site information, only after analytics consent • Cookies and similar technologies: session identifiers, language preferences, cart contents, age verification status • Location data: approximate geographic location derived from IP address (city/province level only)

We use personal information for the purposes below. We seek consent where required by applicable privacy law. Collection, use or disclosure without consent is limited to specific legal exceptions or requirements. Order Fulfillment: Processing and shipping orders, sending confirmations and shipping notifications, and handling support requests. Account Management: Maintaining your account and the features you choose to use, including saved addresses, wishlists and rewards. Communications: Sending promotional emails and newsletters only with your opt-in consent. You may unsubscribe at any time. Optional Analytics: Measuring aggregate site usage with Plausible only after you allow analytics. Security: Protecting accounts, detecting suspicious activity and limiting repeated authentication requests. Legal Requirements: Handling information when required or permitted by applicable law, including responding to valid legal requests.

We use the following safeguards: • HTTPS protects information in transit between your browser and the Site. • Passwords are stored as hashes. Admin sign-in requires a password and an emailed verification code. • Role-based checks restrict administrative features, and authentication requests are rate limited. • Database backups are encrypted. Hosting and database providers operate their own infrastructure safeguards. • Card entry is handled by the external payment provider. Our checkout receives a token and limited payment references. • Essential error diagnostics help us identify and fix failures; browser session replay is disabled. The safeguards and encryption used by each external provider depend on that service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Cookies and browser storage serve different purposes: Sign-in, age status and language: Cookies maintain your signed-in session, remember that the age check was completed and select your language. Your browser can block or remove them, although some features may then be unavailable. Preferences and local history: Local storage remembers your analytics choice, language, theme, recently viewed items, recent searches, comparisons and guest cart. Some notices use local or session storage to remember that they were dismissed. These records are separate from your account wishlist, which is stored with your account. Optional analytics: Plausible uses cookieless aggregate measurement and runs only after you allow analytics. It does not use a persistent visitor identifier to follow you across websites. Privacy settings in the footer controls optional analytics. Decline analytics prevents optional analytics; it does not erase preferences, history or cart data. Withdrawing analytics consent reloads the page to stop the previously loaded script. Use the relevant clear-history controls or your browser’s site-data settings to remove other stored data. We do not use advertising cookies or cross-site advertising networks.

We use external providers for the functions below. The information disclosed depends on the feature you choose to use. • BluePeak / PCIVault (Card Payments): Card entry is handled by the provider; our checkout receives a token and limited payment references. Order and billing information supports payment processing. • Interac e-Transfer Payment Operator: Order number, amount and billing name/reference needed to match and confirm your payment. • BTCPay (Cryptocurrency Payments): Order identifiers, amount, buyer name and email are included in invoice processing when this payment method is used. • Shipping Services: ShipStation and delivery carriers can receive shipping and contact details, order items, amounts, notes and payment status to arrange delivery and tracking. • Resend (Email): Email addresses and message content support confirmations, support messages and, with consent, newsletters. Email delivery and engagement information may also be processed. • ElevenLabs (Optional Chat and Voice): When you start the assistant, typed messages or voice audio and conversation context are processed through ElevenLabs. Voice requires microphone permission. Avoid sharing passwords, payment-card details or sensitive health information in the assistant. • Plausible (Optional Analytics): Cookieless aggregate usage measurement after consent, without cross-site tracking. • Sentry (Error Monitoring): Essential diagnostics help fix bugs. Browser session replay and automatic browser performance tracing are disabled. Browser error reports remove user context, request bodies, cookies, headers and URL query strings. • Vercel & Neon (Hosting and Database): These services host the application and its data. Providers may process information outside Canada under their applicable terms and privacy practices. We do not sell, rent or trade personal information for marketing, or share it with data brokers or advertising networks.

Under PIPEDA and Quebec's Law 25, you have the following rights regarding your personal information: Right of Access: You may request a copy of all personal information we hold about you. We will respond within 30 days of receiving your request. Right of Correction: You may request that we correct any inaccurate or incomplete personal information. You can also update most information directly through your account settings. Right of Deletion: You may request that we delete your personal information, subject to our legal obligations to retain certain records (e.g., transaction records for tax purposes). Right to Withdraw Consent: You may withdraw your consent for marketing communications at any time by clicking the unsubscribe link in any email or contacting us directly. Right to Data Portability: You may request your personal information in a structured, commonly used, machine-readable format. Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). To exercise any of these rights, contact our Privacy Officer at [email protected]. We will verify your identity before processing any request and respond within 30 calendar days.

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected: • Account information: Retained while your account is active and for 2 years after account deletion to handle potential disputes. • Order and transaction records: Retained for 7 years to comply with Canadian tax and financial reporting requirements. • Marketing preferences: Unsubscribing stops marketing emails. An inactive subscription record may be retained to respect your choice. • Analytics statistics: Plausible collects aggregate statistics after consent. Its data policy describes its retention practices. • Support communications: Retained for 3 years after resolution. • Browser storage: Customer sign-in and age-verification cookies last up to 30 days. Administrator sessions last up to eight hours and expire after 30 minutes of inactivity; the language cookie lasts one year and the admin sidebar cookie seven days. Local storage has no automatic expiry for most preferences and history: it remains until you clear site data or the relevant feature removes it. Session storage lasts for the browser page session. When personal information is no longer needed, we securely delete or anonymize it using industry-standard methods.

Account and purchase features are restricted to adults aged 19 and older. Privacy, contact and safety information can be read without providing a date of birth. We do not knowingly collect personal information from anyone under the age of 19. If we become aware that we have inadvertently collected personal information from a minor, we will take immediate steps to delete that information from our records. If you believe that a minor has provided us with personal information, please contact us immediately at [email protected].

Further privacy information

• Plausible data policy
• Privacy Commissioner of Canada: consent