Privacy policy

Last Updated: September 5, 2025

Rocky Tales Inc. (“Rocky Tales,” “we,” “us,” or “our”) operates our websites and our Shopify-powered online store, together with related content, features, tools, and services (the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit, shop, or otherwise interact with the Services. 

By using the Services, you acknowledge you have read and understood this Privacy Policy. If anything here conflicts with our Terms of Service, this Privacy Policy controls for the collection, processing, and disclosure of personal information.

1. Scope & Who We Are

This Policy applies to all Rocky Tales websites, domains, applications, products, and our Shopify-powered store. It does not apply to third-party websites or services we link to. Those have their own privacy practices. 

Because our store is hosted on Shopify, Shopify collects and processes certain personal information to operate the ecommerce experience. Some processing is as our service provider/processor; in limited cases (e.g., aggregated platform safety/fraud or cross-merchant features) Shopify may act as an independent controller. See Section 8 (Relationship with Shopify) for details. 

We are committed to protecting your privacy in accordance with the highest level of privacy regulation. As such, we follow the obligations under the below regulations: 

  • Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable provincial legislations 
  • Quebec Law 25 
  • the EU's General Data Protection Regulation (GDPR) 
  • Brazil’s Data Protection Legislation (LGPD) 
  • California's Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and California Online Privacy Protection Act (CalOPPA) 
  • Colorado Privacy Act (CPA) 
  • Utah Consumer Privacy Act (UCPA) 
  • Connecticut Data Privacy Act (CTDPA) 
  • Virginia Consumer Data Protection Act (VCDPA)
  • Texas Data Privacy and Security Act (TDPSA) 
  • Oregon Consumer Privacy Act (OCPA) 
  • Montana Consumer Data Privacy Act 
  • Delaware Personal Data Privacy Act 
  • Nebraska Data Privacy Law 
  • New Hampshire Data Privacy Act 
  • New Jersey Data Privacy Act 
  • Minnesota Consumer Data Privacy Act 
  • Maryland Online Consumer Protection Act 
  • South Africa’s Protection of Personal Information Act (POPIA) 

Scope

This policy applies to the Rocky Tales Inc. websites, domains, applications, services, and products. This Policy does not apply to third-party applications, websites, products, services or platforms that may be accessed through (non-Rocky Tales Inc.) links that we may provide to you. These sites are owned and operated independently from us, and they have their own separate privacy and data 

collection practices. Any Personal Data that you provide to these websites will be governed by the third-party’s own privacy policy. We cannot accept liability for the actions or policies of these independent sites, and we are not responsible for the content or privacy practices of such sites.

2. Personal Information We Collect

The personal information we collect depends on how you use the Services. We may collect: 

  •  Identifiers & Contact Details: name, email, phone, billing/shipping addresses.
  • Account Information: username, password, preferences, saved items. 
  • Order & Transaction Data: items viewed, cart, wishlist, purchases, returns/exchanges, order history. 
  • Payment Information: payment method, billing details, and confirmations (card numbers are handled by our payment processors; we do not store full card numbers). 
  • Communications: messages you send us (support, email, social, forms, reviews).
  • Device/Usage Data: IP address, device type, browser, OS, referring/exit pages, time stamps, pages viewed, on-site actions, and general location (derived from IP). 
  • Marketing & Inferences: preferences, survey responses, and inferences we create to personalize your experience. 

We do not intentionally collect sensitive personal information unless you provide it to resolve support, fraud, or legal issues; we do not use sensitive information for targeted advertising or to infer characteristics. 

3. How We Collect Information

  • Directly from you: when you browse, create an account, purchase, contact support, or subscribe to marketing. 
  • Automatically: via cookies, pixels, SDKs, and similar technologies (see Section 6). 
  • From third parties: payment processors, shipping carriers, analytics/advertising partners, and social sign-ins. 
  • From Shopify: to enable the storefront, checkout, fraud prevention, and platform services. 

4. How We Use Information (Purposes & Legal Bases)

We use personal information to:

  • Operate & deliver the Services (process orders, payments, shipping, returns, account management, customer support). (Contract / Legitimate Interests) 
  • Personalize & improve (remember preferences, tailor content/products, develop new features). (Legitimate Interests / Consent where required) 
  • Marketing & advertising (email/SMS with consent where required; onsite and cross-site ads; see Section 7 for your choices). (Consent / Legitimate Interests) 
  • Security & fraud prevention (detect, investigate, and prevent fraud, abuse, or security incidents). (Legitimate Interests / Legal Obligation) 
  • Legal & compliance (respond to lawful requests; enforce our terms; keep business records). (Legal Obligation / Legitimate Interests)

If you’re in the EEA/UK or another jurisdiction requiring consent for certain cookies/analytics/ads, we rely on your consent for those activities. You can withdraw consent anytime (see Section 7). 

5. Google Analytics (and Other Analytics/Advertising Tools)

We use Google Analytics to understand how visitors use the Services and to help improve our content and products. Google Analytics may set cookies and collect data such as IP address, device/browser info, pages viewed, time on page, and actions on our site. We may also enable Google Analytics Advertising Features (e.g., Remarketing, Demographics & Interests, Google Signals for cross-device insights where available). 

  • IP Anonymization: Where supported and feasible, we enable GA IP masking to reduce the identifiability of your IP address. 
  • How Google uses data: Learn more at www.google.com/policies/privacy/partners/ and Google’s Privacy Policy. 
  • Opt-outs: 
    • GA Browser Add-On: http://tools.google.com/dlpage/gaoptout 
    • Google Ads Settings (control personalized ads): https://adssettings.google.com 

We also use Meta Pixel and Shopify analytics (and may use other ad/measurement partners) to measure performance, detect fraud, and deliver or cap ads. See Section 7 for opt-out and cookie choices. 

Note on “Sale”/“Sharing” (CPRA): We do not sell personal information for money. Some analytics/advertising uses (e.g., cross-context behavioral ads via pixels) may be considered “sharing” under certain U.S. state laws. See Section 11 for how to opt out and your state rights. 

6. Cookies & Similar Technologies

We use the following categories of cookies/technologies: 

  • Strictly Necessary: required for core site functions (cart, checkout, security).
  • Functional/Preferences: remember choices and settings.
  • Analytics/Performance: help us understand site usage (e.g., Google Analytics, Shopify analytics). 
  • Advertising/Retargeting: deliver and measure ads (e.g., Meta Pixel; Google Ads/GA Advertising Features).

Your controls: 

  • Manage cookies in your browser (blocking may affect site functionality).  
  • Use our cookie banner/preferences (where provided) to toggle non-essential cookies. 
  • Use platform tools: Google Ads Settings; Meta ad preferences; Network Advertising Initiative/DAA opt-outs. 
  • Enable Global Privacy Control (GPC) in supported browsers; we treat that signal as an opt-out of “sale/share” where legally required. 

7. Your Choices (Marketing, Analytics, Ads)

  • Email/SMS marketing: unsubscribe via the link in messages or contact us.
  • ‍Analytics/Ads: use the tools noted in Sections 5–6 and your browser’s cookie controls. 
  • Consent withdrawal: where we rely on consent (e.g., EU/UK analytics/ads cookies), you can withdraw via the cookie banner/preferences or by contacting us. 
  • Do Not Sell or Share (US states): see Section 11. 

8. Relationship with Shopify

Our store is hosted by Shopify. Shopify provides ecommerce infrastructure, payments, analytics, and security services that involve processing your personal information.

  • In many cases Shopify acts as our service provider/processor. 
  • For certain cross-merchant features (e.g., platform fraud/security, aggregated insights, or enhanced Shopify services), Shopify may act as an independent controller and is responsible for honoring data-subject rights for those activities.

To learn how Shopify processes data and to exercise rights related to Shopify’s independent processing, visit: https://www.shopify.com/legal/privacyand the Shopify Privacy Portal at https://privacy.shopify.com

9. How We Share Information

We share personal information only as described below:

  • Service Providers / Processors: payment processing, hosting, cloud storage, shipping/fulfillment, customer support, IT/security, analytics, and marketing vendors—bound by contracts to protect your data. 
  • Advertising/Analytics Partners: to measure performance and (where permitted) deliver relevant ads (see Sections 5–6 for controls). 
  • Affiliates: within our corporate group for the purposes described here. 
  • Legal & Safety: to comply with law, enforce our terms, protect rights/safety, or respond to lawful requests. 
  • Business Transfers: as part of a merger, sale, financing, or acquisition (your info may be transferred as a business asset). 
  • With Your Direction/Consent: e.g., social logins, reviews, public posts. 

We do not sell personal information for money. Certain analytics/ads uses may be deemed “sharing”; see Section 11 for your opt-out rights.

10. International Transfers

We and our providers (including Shopify, Google, Meta) may process information outside your country (e.g., Canada, U.S., EU). Where required, we use appropriate safeguards (such as Standard Contractual Clauses) to protect international data transfers. 

11. Your Privacy Rights

Your rights depend on your location. Subject to legal limits, you may have some or all of the following: 

  • Access / Know: request information about the categories and specific pieces of personal information we hold.
  • Correction: ask us to rectify inaccurate data. 
  • Deletion: request deletion of personal information (subject to lawful exceptions).
  • ‍Portability: receive certain data in portable format. 
  • Restriction / Objection: limit or object to certain processing (e.g., analytics/ads) where applicable. 
  • Withdraw Consent: for consent-based processing (e.g., non-essential cookies/ads in the EEA/UK). 
  • Non-Discrimination: we won’t discriminate against you for exercising your rights.
  • ‍Appeal (certain U.S. states): if we deny a request, you may appeal. 

California/US State “Sale/Sharing” Opt-Out ‍

We don’t sell personal information for money. To the extent our use of analytics/ads is considered “sharing” under CPRA (or “targeted advertising” under other state laws), you can opt out by: 

  • Using our “Do Not Sell or Share My Personal Information” link (site footer) or emailing privacy@rockytales.com; and 
  • Enabling Global Privacy Control (GPC) in your browser (we honor it where required).

How to Exercise Your Rights 

Email privacy@rockytales.comor info@rockytales.com (or use our site form, if available). We may request information to verify your identity. You may authorize an agent to act for you; we may require proof of authorization and verification. 

For data where Shopify is an independent controller, use the Shopify Privacy Portal at https://privacy.shopify.com 

Supervisory Authorities / Complaints 

You may lodge a complaint with your local data protection authority. We invite you to contact us first so we can address your concerns. 

12. Security

We use administrative, technical, and physical safeguards designed to protect personal information. No system is 100% secure; transmission and storage carry risk. If we learn of a breach affecting your data, we will notify you and regulators as required by law.

13. Retention

We keep personal information only as long as necessary for the purposes described here (e.g., to fulfill orders, provide the Services, comply with legal, tax, accounting, and fraud-prevention obligations), after which we delete or de-identify it. 

  • Analytics: we configure analytics tools to retain event/aggregated data for a limited period consistent with our needs and applicable law. 

For current retention settings or specific timelines, contact us. 

14. Children’s Privacy

The Services are not directed to children under 16 (or the age of consent where you live). We do not knowingly collect their personal information. If you believe a child provided data, contact us and we will delete it. 

15. Third-Party Links & Social Features

Links to other sites and embedded third-party features (e.g., maps, social widgets) are governed by those parties’ privacy policies. We are not responsible for their practices. 

16. Changes to This Policy

We may update this Privacy Policy periodically. We will post the updated version with a new “Last Updated” date and take any additional steps required by law. 

17. Contact Us

For questions about these Terms or your purchases: 

Rocky Tales Inc. 

21 Fireside Street, Unit 102 
Cochrane, Alberta, Canada, T4C 3H4 

Email: info@rockytales.com

To request a copy for your information, unsubscribe from our email list, request for your data to be deleted, or ask a question about your data privacy, we've made the process simple.