Privacy Policy
Last updated: August 27, 2026
LEO Hardware Inc. uses personal information to operate our storefront, fulfil orders, provide account and support features, and run the optional community and part-identification tools described below.
1. Information we collect
Account, contact, billing, shipping and order information you provide.
Cart, wishlist, return, customer-service and newsletter information.
Forum questions and replies, product reviews, Property Book records, and photos, videos or documents you choose to upload.
Security and operational information such as IP address, browser type, request time, consent choices and error records.
Optional storefront performance events only after you select “Allow analytics.” Search text and URL query values are removed before those third-party events are sent.
Unless you decline analytics: the words typed into our product search, with how many results they matched, so we can decide which products to stock. Entries that look like personal details (an email address or a long number) are discarded in your browser before anything is sent, and the stored counts are not linked to your account, and are not stored with your IP address.
2. How we use information
To price, process, deliver, recover and support carts and orders.
To authenticate customers, administer Net Terms, returns, wishlists and Property Book organizations.
To moderate and publish approved forum and review content.
To identify hardware from a submitted photo when you expressly request and consent to that service.
To prevent fraud and abuse, enforce usage limits, diagnose failures and improve reliability.
To count product searches (including searches that returned nothing) so we can decide which products to stock.
3. Service providers and disclosures
We do not sell personal information. We disclose information to providers only as needed for the requested service, legal compliance, security, or business operations:
BigCommerce provides catalog, customer, cart, order, newsletter and hosted-checkout services. Payment information is handled in the hosted checkout by BigCommerce and the configured payment provider.
Vercel hosts the storefront and, only after analytics consent, receives privacy-limited performance events.
Supabase stores server-managed forum, review, visual-search, contractor-request and Property Book data, uploaded files, and the unlinked product-search counts described above.
Cloudflare Turnstile processes verification and network information to prevent automated abuse on protected forms.
Resend delivers transactional and service emails.
Google and Apple process information when you choose their sign-in service. Google Places or Maps may process a property address when you use an address or Street View feature.
For Find a Part by Photo, the provider named beside the consent control (Google Gemini for the public service; approved OpenAI or Anthropic models for staff evaluation) receives an EXIF-stripped, resized image and the product context needed to return suggestions.
Shipping carriers and professional advisers receive information where necessary to deliver orders or meet legal and accounting obligations.
Some providers process information outside Canada and protect it under the laws and contractual safeguards applicable to their services.
4. User content and photo identification
Forum posts and product reviews are submitted for moderation and, if approved, are public. The relevant form asks you to agree before submission. Do not upload personal, confidential or unnecessary information.
Find a Part by Photo requires a separate unchecked consent for every submission. We remove image metadata and resize the image. The processed private image may be retained in Supabase for no more than 180 days to provide the result and improve identification quality, then a daily deletion worker removes it. A failed deletion remains queued and creates an operational alert rather than being reported as complete.
5. Cookies and local storage
Necessary cookies support authentication, cart recovery, security and private account features. A local-storage preference remembers whether you allowed optional analytics; declining also stops search-term counting. Session storage briefly remembers which search terms were already counted so one visit is never counted twice. Declining analytics does not disable shopping, checkout or account functions. Turnstile is loaded when you use a protected form.
6. Retention and deletion
Order and accounting records are retained for business and legal requirements. Public forum and review content is retained until it is removed through moderation or an approved deletion request. Unfinished review-upload sessions are scheduled for cleanup after 24 hours. Product-search counts are deleted after 365 days, and the short-lived network identifier used to rate-limit them after 2 days. Other support, security and operational records are kept only as long as reasonably needed for their purpose.
7. Your choices and requests
You can decline optional analytics, avoid optional uploads, unsubscribe from marketing email, and request access, correction or deletion where applicable. Some order or legal records cannot be deleted immediately. Contact brett@leohardware.ca or use our contact form. You may also request early deletion of a visual-search photo.
8. Security and children
We use access controls, encryption in transit, rate limits and restricted service credentials, but no system can guarantee absolute security. Our services are not directed to children; a parent or guardian can contact us about information submitted by a child.
9. Changes
We may update this policy as our services or providers change. The date above identifies the current version.