Privacy Policy

Effective Date: June 11, 2026

This Privacy Policy explains how Baked by Two, a home-based bakery operating out of Ontario, Canada, collects, uses, and protects personal information submitted through this website’s contact and order forms.

This policy is written to comply with Canada’s federal Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and applicable Ontario privacy considerations.

1. What Information Is Collected

When you submit the contact form or order form on this website, the following information may be collected:

  • Name: Your first and last name, used to address you and process your order.
  • Email address: Used to reply to your message and confirm orders.
  • Phone number: (optional) Used to contact you regarding your order if needed.
  • Address: Used for billing and order processing (orders only).
  • Order details: Cookie selections, quantities, special requests, and allergy information.
  • Message content: The text of your inquiry (inquiries only).
  • IP address & user agent: Automatically recorded in server audit logs for security.

No payment card information is collected through this website. Payment is arranged separately via email.

2. Why This Information Is Collected

Your information is collected for the following purposes:

  • To respond to your inquiry or process your cookie order;
  • To confirm pricing and order details;
  • To communicate about your order status;
  • To maintain server audit logs for security (IP address and user agent);
  • To detect and prevent abuse, spam, or malicious use of the forms.

Your information will not be used for marketing or advertising without your express consent.

3. Cloudflare Turnstile (CAPTCHA)

This website uses Cloudflare Turnstile, a privacy-preserving CAPTCHA service, to protect forms from automated spam. Cloudflare may process certain technical information as part of verification. Cloudflare’s privacy policy is available at cloudflare.com/privacypolicy.

Aside from Cloudflare Turnstile, no personal information is shared with any third party — no analytics, no advertising networks, no data brokers.

4. How Your Information Is Stored

Form submissions are received securely by Baked by Two. Server audit logs (IP addresses, user agents) are retained for 90 days, then automatically deleted.

Order details, name, and email may be retained in our email records for as long as necessary to fulfil and manage your order. Reasonable safeguards are in place to protect your information.

5. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

  • Access: Request a copy of personal information held about you (responded to within 30 days).
  • Correction: Request correction of inaccurate information.
  • Deletion: Request deletion of your personal information, subject to legal retention obligations.
  • Withdraw consent: Withdraw consent for processing at any time (does not affect prior processing).

To exercise these rights, please contact us using the form on this website with “Privacy Request” in your message.

6. No Sale of Personal Information

Personal information collected through this website is never sold, rented, or traded to any third party.

7. Cookies & Tracking

This website does not use tracking cookies, analytics cookies, or advertising cookies. (We only bake the edible kind.)

8. Changes to This Policy

This Privacy Policy may be updated from time to time. The effective date at the top will be updated accordingly. Continued use of the forms constitutes acceptance of the revised policy.

9. Contact & Privacy Requests

For privacy questions or requests, please use the contact form on this website or reach out via our Instagram page. We will respond within 30 days consistent with PIPEDA requirements.

If you are unsatisfied with how a concern has been handled, you may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Baked by Two — Ontario, Canada