← Back to FrostySpot

Privacy Policy

Effective date: July 11, 2026  ·  Governing law: Province of Ontario, Canada  ·  Compliant with PIPEDA

1. Who We Are

FrostySpot ("we," "us," or "our") operates the FrostySpot platform — a hyper-local ice cream ordering service available at frostyspot.com. We are responsible for the personal information we collect and maintain.

2. Information We Collect

Information you provide directly:

• Account information: name, email address, and password when you create an account.
• Order information: items ordered, tip amount, and order notes.
• Communications: messages you send to us via email or in-app support.
• Marketing preferences: your opt-in or opt-out choice for promotional emails at sign-up or in your profile.

Information collected automatically:

• Location data: your GPS coordinates when you use the Service to find nearby trucks and confirm a delivery spot. We only access location when the app is actively in use.
• Device and usage data: browser type, operating system, pages visited, and app interactions — collected via Firebase Analytics.
• Cookies and local storage: we use browser local storage and cookies to maintain your session, remember your sound preferences, and store your cookie consent choice. See Section 7 for details.
• Push notification tokens: if you grant permission, we store an FCM device token to send you order status updates.

3. How We Use Your Information

We use your personal information to:

• Create and manage your account;
• Process and fulfill your orders and communicate order status to you;
• Display nearby ice cream trucks on the map;
• Send push notifications about your orders (if you have opted in);
• Send promotional emails about FrostySpot offers and updates (only if you have opted in);
• Improve and troubleshoot the Service using aggregated, anonymized analytics;
• Comply with our legal obligations under Ontario and Canadian law;
• Enforce our Terms of Service and protect the security of the Service.

4. Legal Basis for Processing

Under PIPEDA, we collect and use your personal information only with your knowledge and consent, or as otherwise permitted by law. By creating an account and placing an order, you consent to the collection and use described in this policy. Where we rely on consent, you may withdraw it at any time (see Section 8).

5. Sharing Your Information

We do not sell your personal information. We share it only in the following limited circumstances:

• Truck operators: we share your order details (items, tip, GPS delivery spot) with the operator fulfilling your order. Operators do not receive your email address or password.
• Runners: the runner assigned to your delivery receives your approximate delivery location only.
• Service providers: we use Google Firebase (Firestore, Authentication, Cloud Functions, Hosting, FCM, Analytics) and Google Maps. These providers process data on our behalf under their own privacy and security standards. Google is certified under various international privacy frameworks.
• Legal requirements: we may disclose your information if required by law, court order, or governmental authority in Ontario or Canada.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

6. Data Retention

We retain your account information for as long as your account is active. Order records are retained for a minimum of 7 years to comply with Canadian tax and business record-keeping obligations. If you request deletion of your account, we will remove your personal profile data within 30 days, subject to legal retention requirements.

Push notification tokens that become invalid are automatically purged by our systems. Analytics data is retained in aggregated, anonymized form.

7. Cookies and Local Storage

FrostySpot uses browser cookies and local storage for the following purposes:

• Essential: session management, authentication state, and your delivery preferences. These cannot be declined without breaking core functionality.
• Functional: remembering your sound toggle preference and runner login state.
• Analytics: Firebase Analytics uses cookies to help us understand how users interact with the Service. This data is anonymized and aggregated.

When you first visit FrostySpot, you will be shown a cookie banner asking you to accept or decline non-essential cookies. You can update your choice at any time by clearing your browser data or contacting us.

We do not use advertising or tracking cookies. We do not share cookie data with ad networks.

8. Your Rights Under PIPEDA

As a Canadian resident, you have the right to:

• Access: request a copy of the personal information we hold about you;
• Correction: request that we correct inaccurate or incomplete information;
• Withdrawal of consent: withdraw your consent to the collection or use of your information (subject to legal and contractual restrictions);
• Deletion: request deletion of your account and associated personal data;
• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe we have mishandled your information.

To exercise any of these rights, email us at hello@frostyspot.com. We will respond within 30 days.

9. Marketing Emails

We only send promotional or marketing emails to users who have expressly opted in at sign-up or in their profile settings. Every marketing email includes an unsubscribe link. Opting out of marketing emails does not affect transactional communications related to your orders.

We comply with Canada's Anti-Spam Legislation (CASL) in all commercial electronic messages.

10. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information without parental consent, please contact us and we will delete it promptly.

11. Security

We use industry-standard technical and organizational measures to protect your personal information, including encrypted data transmission (HTTPS/TLS), Firebase security rules restricting data access, and authentication controls. No system is perfectly secure, and we cannot guarantee absolute security of your data.

12. Third-Party Links

The Service may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy with a revised effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

14. Contact Our Privacy Officer