Last updated 2026-09-20. Puzzle Lodge ("we") operates puzzlelodge.com from Toronto, Ontario, Canada. This policy follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
Orders: your name, email, shipping address, phone (optional, for the carrier), what you bought, and the text you enter for a personalized puzzle. Payment: handled entirely by Stripe; we never see or store your card number. Subscriptions: the child's first name and birthday, entered by the parent, used only to match the box to their age. Newsletter: your email, only if you sign up. Site use: privacy-friendly, cookieless analytics (Cloudflare Web Analytics) that counts visits without identifying you; your cart is kept in your own browser's storage until you check out.
To take payment, fulfil and ship your order (including passing your name and address to the supplier or print partner who ships it and to the carrier), to send order and shipping emails, to answer support requests, to run your subscription, to prevent fraud, and, with your consent, to send occasional marketing emails, which you can unsubscribe from in one click.
Only the service providers needed to serve you: Stripe (payments and subscriptions), Cloudflare (hosting and email routing), our fulfilment partners and print partners (name, address and order contents only), Canada Post and other carriers, and Klaviyo (newsletter, if you subscribe). We never sell or rent personal information. Some providers store data in the United States; they are bound by contracts that protect it.
Order records for 7 years, as Canadian tax rules require. Newsletter data until you unsubscribe. Subscription details until 90 days after cancellation. Personalized-puzzle text until the order is complete plus 30 days for reprints.
Our site sells to adults. We do not knowingly collect information from anyone under 18 directly; the child's first name and birthday on a subscription are provided by a parent or guardian and are used for nothing else.
You can ask to see, correct or delete the personal information we hold about you, withdraw consent to marketing, or complain about how we handled it, by emailing [email protected]. We reply within 30 days. You may also contact the Office of the Privacy Commissioner of Canada.
We do not use advertising or tracking cookies. Stripe sets cookies during checkout for fraud prevention. Your browser's local storage keeps your cart and preferences on your device.
The site is served over HTTPS, payment data goes straight to Stripe, and order data is stored encrypted at rest on Cloudflare with access limited to the owner.
If this policy changes materially we will post the new version here with a new date and, where required, email you.