Legal
Privacy Policy
Last updated: June 24, 2026
Ocean Tails Music (Jen Smith Lanthier, sole proprietor, Owen Sound, Ontario, Canada) operates this website and is the data controller of personal information collected through it. This page explains what we collect, why, how long we keep it, who we share it with, and the rights you have. It is written to satisfy the EU/UK GDPR and Canada's PIPEDA. It is not legal advice.
1. Who to contact (Privacy Officer)
Privacy Officer: Jen Smith Lanthier
Email: info@oceantailsmusic.com
Postal: Ocean Tails Music, 110 Cottage Lane, Owen Sound, ON N4K 5N4, Canada
For requests covered by GDPR/PIPEDA (access, correction, deletion, export, complaints), use the email above. We respond within 30 days.
2. What we collect and why
The table below summarises the categories of personal data we process and the lawful basis we rely on.
| Category | Examples | Purpose | Lawful basis / region |
|---|---|---|---|
| Account | Email, name, password hash, sign-in provider | Create and operate your account | Contract (GDPR 6(1)(b)) / Consent at sign-up (PIPEDA) |
| Orders & payments | Shipping/billing address, items purchased, order amount, refund status, last-4 of card (held by Stripe, not us) | Fulfil your order, issue receipts, comply with tax law | Contract (GDPR 6(1)(b)) / Legal obligation for tax records (GDPR 6(1)(c)) |
| Course progress | Lessons completed, quiz attempts, certificates earned | Show your progress and issue certificates | Contract (GDPR 6(1)(b)) |
| Marketing email | Email, first name, opt-in source, opt-in timestamp, wording version | Send the free sampler, monthly newsletter, and product news you asked for | Consent (GDPR 6(1)(a) / CASL express opt-in / PIPEDA opt-in) |
| Contact form | Name, email, message content | Reply to you and keep a record of the conversation | Legitimate interest (GDPR 6(1)(f)) and consent at submission (PIPEDA) |
| Site logs & security | IP address, browser/user-agent, requested URL, timestamps, error reports | Prevent abuse, debug errors, keep the site available | Legitimate interest (GDPR 6(1)(f)) |
| Cookie & consent log | Your cookie choices, version of wording, page, user agent | Prove we honoured your consent choices | Legal obligation (GDPR 7(1)) / Accountability (PIPEDA) |
3. How long we keep it (retention)
- Account & profile: while your account is open, plus 30 days after deletion (purge buffer).
- Orders, invoices, refunds: 7 years after the transaction, to meet Canadian tax-record obligations (CRA). After your account is deleted these records are de-identified — your user link is removed and only the email on the receipt remains.
- Course progress & certificates: deleted when you delete your account.
- Marketing contact: kept while you remain opted in. After unsubscribe, the email is added to a suppression list so we don't accidentally re-mail you (CASL requirement); everything else is deleted within 30 days.
- Contact-form messages: 2 years.
- Site logs: up to 30 days, then rotated out.
- Cookie consent log: 24 months from the decision.
4. Who we share it with (subprocessors)
We do not sell your personal information. We use the service providers below to run the site. Each is bound by a Data Processing Agreement and processes data only on our instructions.
| Category | Examples | Purpose | Lawful basis / region |
|---|---|---|---|
| Supabase (Cloud hosting, database, auth) | Account, orders, course data, contacts | Database & authentication | Region: Canada / United States |
| Cloudflare | All traffic (IP, headers) | CDN, DDoS protection, edge runtime | Region: Global edge |
| Stripe | Card details, billing address, order amount | Payment processing | Region: United States / Canada |
| Resend (via Lovable Email) | Email address, email content | Sending transactional and marketing email | Region: United States |
| YouTube (Google) | IP, device info if you play an embedded video | Video playback (consent-gated) | Region: Global / United States |
International transfers. Several of these providers are based in or process data through the United States. We rely on the EU Standard Contractual Clauses and each provider's published transfer safeguards. Because we are based in Canada, your personal information may be accessed under Canadian law (e.g. lawful production orders).
5. Your rights
You have the right, at any time and free of charge, to:
- Ask what personal data we hold about you (access).
- Ask us to correct inaccurate data (rectification).
- Ask us to delete your data (erasure / right to be forgotten), subject to legal retention for tax records above.
- Receive a machine-readable copy of your data (portability).
- Object to processing or ask us to restrict it.
- Withdraw marketing consent at any time.
- Lodge a complaint with your supervisory authority — in Canada, the Office of the Privacy Commissioner (priv.gc.ca); in the EU/UK, your national data-protection authority.
Self-serve. If you have an account, sign in and go to My account to download a copy of your data or delete your account in one click. Otherwise, email info@oceantailsmusic.com and we'll handle it within 30 days.
6. Email marketing & consent
When you sign up for the free sampler or the Ocean Tails Music newsletter, you actively tick a consent box on the form. We store the date, source, and version of the wording you agreed to. We send you only what you opted in for: your sampler, the monthly newsletter, and occasional product news. We never share or sell your email address.
Every marketing email has a one-click unsubscribe link in the footer; unsubscribing is honoured immediately. Transactional emails (order confirmations, course access, replies to contact-form messages) are sent under contract or your request and aren't covered by marketing unsubscribe.
7. Cookies & embedded content
We use essential cookies for login, the cart, and Stripe checkout. We do not run Google Analytics, Meta Pixel, or other third-party analytics. Embedded YouTube videos are blocked until you give consent. See the cookie notice for the full list and use “Cookie preferences” in the footer to change your choice at any time.
8. Security & breach notification
We use industry-standard administrative, technical, and physical safeguards: TLS for data in transit, encryption at rest at our cloud providers, row-level access control on the database, and least-privilege admin access. No system is perfectly secure.
If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you, and the Office of the Privacy Commissioner of Canada, as soon as feasible — as required by PIPEDA — and (for EU/UK residents) within 72 hours of becoming aware, as required by GDPR Art. 33.
9. Children
The site is not directed at children under 13 (or under 16 in the EU/UK). We don't knowingly collect personal information from them. If you believe a child has provided us personal data, email our Privacy Officer and we'll delete it.
10. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
11. Changes to this policy
If we make material changes we'll update the “Last updated” date at the top and, for active subscribers, send a note in our next email.