Privacy policy
Last updated: October 23, 2026
A&Y – À Cœur d’Enfant (sole proprietorship, NEQ 2282405705, 2600 Cavendish Boulevard, Montreal, Quebec H4B 0A8) protects its customers’ personal information in accordance with Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and the federal PIPEDA. This policy explains what we collect, why, who we share it with and how to exercise your rights. The French version of this policy prevails.
Person in charge of the protection of personal information
Lamyaa Grich, owner. Email: boutique@acoeurdenfant-aety.com · Phone: +1 263 378-5505 · Address above.
Information we collect
| Category | Examples | Why |
|---|---|---|
| Identity and contact details | name, shipping and billing address, email, phone | process and deliver your order, contact you |
| Order | items bought, amounts, returns, messages to customer service | perform the contract, warranties, accounting |
| Payment | payment method used and confirmation; card numbers are processed by Shopify Payments or Stripe and never stored by A&Y | collect payment, prevent fraud |
| Customer account (optional) | login, order history, loyalty points | save you from re-entering details, rewards program |
| Marketing (with your consent) | email or mobile number, language preference | newsletter, offers, cart reminders |
| Browsing | IP address, device, pages viewed, products viewed, add-to-cart actions | run the site, measure traffic, advertising (only with your consent) |
| Reviews | display name, rating, comment, photo sent | publish your review on the product page |
We only collect what is needed for these purposes. We do not sell your personal information.
Cookies and tracking technologies
Essential cookies (cart, checkout, security) are always on. Analytics cookies (Google Analytics) and advertising cookies (Meta, Google Ads) stay off until you accept them in the banner shown on your first visit. You can change your mind at any time with the “Cookie preferences” link at the bottom of every page.
Who we share your information with
We entrust some processing to service providers, bound by contract to confidentiality, who use your information only for the service provided:
| Provider | Service | Where data is stored |
|---|---|---|
| Shopify | store hosting, checkout, orders | Canada and United States |
| Stripe | ZEM Instalments (pay in several payments) | United States |
| Klaviyo | newsletter and automated emails | United States |
| Judge.me | customer reviews | United States or Europe |
| Smile.io | rewards program | Canada and United States |
| Sleek Bundles | bundle offers in the cart | United States |
| Google (Analytics, Ads) | traffic measurement and advertising, with your consent | United States |
| Meta (Facebook, Instagram) | advertising, with your consent | United States |
| Canada Post, Purolator | delivery | Canada |
We may also disclose information when required by law (for example a court order).
Disclosure outside Quebec
Several of the providers above store data outside Quebec. Before entrusting them with information, we assessed that its protection is adequate, as required by section 17 of Law 25. This information may be subject to the laws of the country where it is stored.
Retention
- Orders and invoices: 6 years after the end of the fiscal year, for our tax obligations.
- Email or SMS list: until you unsubscribe.
- Inactive customer account: deleted after 3 years with no order or login.
- After that, the information is destroyed or anonymized.
Your rights
You may at any time ask to access your information, have it corrected, withdraw your consent, stop its dissemination (de-indexing) or receive a copy in a structured technological format. Write to the person in charge above; we answer within 30 days, free of charge. If you are not satisfied with our answer, you may contact the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).
Emails and texts
We send you promotional messages only if you have consented, in accordance with Canada’s Anti-Spam Legislation. Every message contains an unsubscribe link, processed within 10 business days.
Children
The shop is intended for parents and adults. We do not knowingly collect information from people under 14. Information about a child that you send us (for example a size or a care need for a ZEM garment) is used only to handle your request.
Security and incidents
Information is protected by our providers’ security measures (encryption, restricted access). If a confidentiality incident presents a risk of serious injury, we notify the people concerned and the Commission d’accès à l’information.
Changes
We post any change on this page with a new update date. A significant change is announced on the site or by email.
