What we collect, and what we don’t.

The short version

We sell one product from one small operation in Canada. We collect as little as we can get away with, we do not sell or share your information, and there is no advertising tracking on this site.

Payment happens on Shopify, not here. We never see or store your card details.

What this site stores on your device

A cart cookie, so the items you add survive a page reload. It holds a Shopify cart identifier, not your name, email, or address. It expires on its own, and clearing your browser data removes it.

A short-lived browser storage entry recording that you dismissed the announcement bar, and one holding your checkout link so the cart can hand you to Shopify.

If you run a shop we supply and sign in to see your wholesale prices, we set one more cookie. It holds the sign-in Shopify gives you, which includes the email address on your account, and the location you are ordering for. It is encrypted so that only this site can read it, it is never sent anywhere else, and it is deleted when you sign out or after 24 hours, whichever comes first. A second cookie lasts ten minutes while you sign in, to check that the answer from Shopify belongs to you.

If analytics is enabled (see below) and you have not asked us not to, PostHog also stores an anonymous identifier in local storage and a cookie. A small record of your own analytics choice is stored too — that one we keep whatever you choose, because remembering a “no” is what stops us asking again.

Analytics

We use PostHog to count page views and see which pages people read. It is configured with autocapture switched off, meaning we do not harvest every click, form field, and keystroke. Alongside page views we record a short, named list of shopping steps — choosing a finish, adding to the cart, changing a quantity, removing an item, and heading to checkout — with the product, the option chosen, and the cart total attached.

We do not send PostHog your name, email, or address. Analytics runs only when the site is configured with PostHog keys; if they are unset, no analytics loads at all. Session recording — replaying what someone did on a page — is switched off in the code, not merely left unconfigured.

If you are visiting from the EU, the EEA, or the UK, we ask before any of that starts: nothing is stored on your device and nothing is sent until you answer. Everywhere else, including Canada where we sell, analytics runs on this disclosure alone, which is what Canadian law allows. You can change your answer at the bottom of this page whichever country you are in.

Choosing “anonymous only” does not switch analytics off — it makes it anonymous. Nothing is stored on your device, no profile is built, and your IP address is not recorded, so page views still count but nothing joins them up into a person. Choosing it also deletes the identifier PostHog had already stored, if there was one.

We do not use Google Analytics, and there is no Meta, TikTok, or other advertising pixel on this site.

Buying something

Checkout is handled by Shopify. When you check out, Shopify collects the details needed to take payment and ship your order (name, email, shipping address, and payment information) under its own privacy terms. Waverley receives your order and shipping details so we can make and send your board.

Card numbers never reach this website or our systems. Shopify is the payment processor and holds PCI scope.

Joining the Bath Club

If you sign up for the Bath Club, we store your email address as a customer record in Shopify, along with the date and time you gave consent and a note of the wording you agreed to. We keep those because Canadian anti-spam law (CASL) puts the burden on us to show that you asked to hear from us, and what you were told at the time.

We use it to send you Bath Club emails and your member discount, nothing else. We do not sell it, rent it, or share it with anyone outside Shopify, which stores it on our behalf.

You can withdraw consent at any time using the unsubscribe link in any email we send, or by emailing us and asking. Withdrawing stops the emails; it does not affect any order you have already placed.

Getting in touch

The contact form on this site opens your own email program with a pre-filled message. It does not submit anything to us in the background. If you email us, we keep that correspondence so we can help you, and for as long as we might need it for warranty or order questions.

Where your information is handled

We use two outside services: Shopify, which runs the checkout and holds your order, and PostHog for page-view analytics. Both are operated outside Canada, which means information they hold on our behalf may be stored or processed outside the country and can be subject to the laws where it is held.

We do not use any other processor, and we do not transfer your information anywhere else. If you want to ask about this before you buy, email us and we will answer.

How long we keep things

Order records are kept as long as we need them for warranty, tax, and accounting obligations. Analytics data is retained on PostHog’s default schedule and holds no name, email, or address. Emails you send us are kept while they are useful for supporting you.

Your rights

Under Canadian privacy law (PIPEDA) you can ask what personal information we hold about you, ask us to correct it, and ask us to delete it. Email us and we will do it. We are small enough that this is a person reading your message, not a ticketing system.

For order data held by Shopify, we can action the same requests through Shopify on your behalf.

Changes

This policy was last updated in September 2026. If we change what we collect, we will change this page, and if the change is significant, we will say so rather than quietly editing it.