Privacy Policy

1. Who We Are

Sahand Farm Inc. (operating as Barn2Box; “Barn2Box”, “we”, “us”, or “our”) operates the website barn2box.com and provides farm-direct lamb delivery services across the Greater Toronto Area through a marketplace of partner Ontario family farms. Our registered address is 3944 Line 8, Bradford, Ontario, Canada. You can reach us at info@barn2box.com.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law.

2. Information We Collect

We collect the following personal information when you use our services:

• Identity information: First name, last name
• Contact information: Email address, phone number
• Delivery information: Street address, city, province, postal code (for delivery orders)
• Payment information: Credit/debit card details — processed and stored securely by Stripe Inc. We never see or store your raw card number.
• Order information: Items ordered, weight, fulfillment preferences, special requests
• Usage information: Pages visited, browser type, IP address (collected automatically via server logs)
• Waitlist information: Email address if you join our waitlist

3. How We Use Your Information

We use your personal information to:

• Process and fulfill your meat orders
• Send order confirmations, invoices, and delivery updates by email
• Send a one-time magic link to log you into your account (passwordless login)
• Calculate delivery fees and distance from the partner farm fulfilling your order
• Process payments securely through Stripe
• Notify you if a weekly cycle is cancelled or rescheduled
• Respond to your questions and support requests
• Notify waitlist members when delivery zones open
• Improve our website and services
• Comply with applicable law

We do not sell your personal information to third parties. We do not use your information for automated profiling or targeted advertising.

4. Legal Basis for Processing

We process your personal information on the following bases:

• Contract performance: To fulfil orders you place with us
• Consent: When you join our waitlist or subscribe to updates
• Legitimate interests: To improve our services and prevent fraud
• Legal obligation: When required by applicable law

5. Who We Share Your Information With

We share your information only with trusted service providers necessary to operate our business:

• Stripe Inc. — payment processing (stripe.com/privacy)
• Resend Inc. — transactional email delivery
• Google LLC — distance and address calculation via Google Maps API (server-side only)
• Vercel Inc. — website hosting and infrastructure
• Neon Inc. — database hosting (encrypted at rest)

All service providers are contractually bound to process your data only as instructed by us and in accordance with applicable privacy law.

We may also disclose your information if required by law, court order, or to protect the rights and safety of our customers, staff, or the public.

6. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes described in this policy, or as required by law:

• Order records (invoices, sheep ownership documentation): at least 2 years, and up to 7 years where required for tax and accounting purposes. Sheep ownership audit logs are retained as legal evidence of the live-animal sale model under Ontario's Meat Regulation.
• Account information: Until you request deletion
• Magic link tokens: 15 minutes from creation, then automatically deleted
• Session data: 30 days from login
• Waitlist emails: Until you unsubscribe or we notify you

7. Your Rights

Under PIPEDA, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Withdraw consent to non-essential processing at any time
• Request deletion of your personal information (subject to legal retention requirements)
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)

To exercise any of these rights, contact us at info@barn2box.com. We will respond within 30 days.

8. Cookies and Tracking

Our website uses essential cookies to maintain your login session. We do not use advertising cookies, third-party tracking pixels, or analytics that share data with ad networks.

Session cookies are httpOnly and expire after 30 days. You can delete cookies at any time via your browser settings, but this will log you out of your account.

9. Security

We implement industry-standard security measures including HTTPS encryption, hashed authentication tokens, and secure database access controls. Payment data is handled entirely by Stripe and is never stored on our servers.

No method of internet transmission is 100% secure. If you have concerns about the security of your information, contact us at info@barn2box.com.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions or requests, contact: