Privacy Policy

Signup collects your email, password and optional first and last name. Supabase Auth receives passwords securely and stores salted bcrypt hashes; our store does not store password text. Profile and address forms collect the contact and delivery details you choose to save. Checkout collects the email, name, delivery address and optional phone needed for your order. Guest checkout is available. Signing in with a verified email can link guest orders placed with that email to your account.

Sign-in sessions, private form drafts and account-email prefill stay in this page’s memory. Refreshing or closing the page ends this continuity and requires signing in again. Private drafts expire after 30 minutes or clear after confirmed payment. Cart, wishlist, recent product links and consent choices may remain in browser storage; these do not contain account contact details, passwords or payment credentials. A non-sensitive sidebar preference may use a cookie.

Stripe handles card entry, payment authentication and payment processing. We send the checkout email, delivery name and address, purchased items, prices and payment references needed to process the order and calculate tax. Stripe may collect billing, device, network and fraud-prevention information directly. Full card numbers and security codes are not stored in our database.

With your permission, we collect page and product visits, shopping events, foreground duration, a coarse device category, selected referral hosts and recognized campaign categories. Events use a random session identifier and are not linked to your account ID. Private form values, raw search queries, arbitrary campaign text, order numbers and payment session tokens are excluded from event payloads. Configured Google Analytics and Meta Pixel may receive shopping events and their own device/network information. Essentials-only stops optional collection. Analytics sessions stay in page memory and restart after inactivity or a full reload.

Newsletter signup collects an email. Contact forms collect a name, email, subject and message. Authentication and order emails use our email delivery provider; pending messages contain the recipient and rendered content needed for delivery. Operational email logs redact recipients and exception details. Reviews publish only approved content, your chosen public display name and any approved photos. New review uploads are re-encoded to remove embedded location and camera metadata. Do not include private contact details in a public review.

Lovable and Supabase provide hosting, authentication, database, storage and email infrastructure. Google processes optional Google sign-in. Stripe processes payments. Instagram photos are relayed through our service; clicking Instagram, WhatsApp or carrier tracking links connects you to those services. Store administrators can view order and support details and download records for fulfilment. Admin-only AI product tools send selected product text, instructions or images to the configured AI gateway; customer accounts and orders are not automatically included. An explicitly authorized AI shopping connection can retrieve your own filtered order status and purchase details. Providers may process data outside Canada.

Saved account, order, support and newsletter records remain until removed or no longer needed for service and record keeping. The store does not promise a universal automatic deletion period. Failed or expired authentication-email payloads are cleared or minimized; login-rate-limit identifiers are keyed hashes cleaned after one day, and operational email logs are redacted and expire after 90 days. Used unsubscribe tokens expire after 30 days. Cart and wishlist persist until removed or site data is cleared; recent product links expire after seven days. Hosting, authentication, payment and email providers control separate security logs and backups.

Edit your profile and saved addresses in your account. Use Delete account on your profile page to remove account details, addresses, reviews, associated newsletter and contact records, and direct personal information from completed orders. Recent sign-in and explicit confirmation are required. Open orders and refunds must be completed first; administrator accounts need support assistance. Minimal transaction amounts, items and payment references remain for reconciliation, and payment providers may retain financial records. Previously delivered emails, administrator exports, provider logs and backups are outside the live account deletion process. For guest records, access requests, corrections or provider follow-up, contact support@rksignature.com; identity verification may be required.

13 October 2026. Use the Cookie & Browser Storage Policy page to change optional tracking choices.