Privacy policy

What we collect

We only ask for what a parts counter needs to sell you a part and hand it over:

• Your account. Your email address and name when you create an account or sign in with Google. If you use a password, it is handled by Google Firebase Authentication — we never see it and never store it.
• Your order. The name, phone number and email you enter at checkout, what you ordered, the price and tax, how you chose to pay, and when the part was pulled and picked up. The contact details are kept as a snapshot on that order — it is how we reach you about that specific part.
• Your messages. Anything you write to us through the site's message thread, and our replies.
• Your cart. The items you have put in the cart, stored in a cookie on your own browser until you order or clear it.
• Basic technical records. Our hosting and database providers keep ordinary server logs (IP address, browser type, pages requested) for security and troubleshooting. We do not build customer profiles from them.

We do not ask for your date of birth, your address, your driver's licence or your VIN. If you tell us a VIN so we can check whether a part fits your car, we use it for that question and it is not tied to your identity.

Payment information

We never see, handle or store your card number. Online payments are processed by Stripe on Stripe's own hosted checkout page. We receive back only the result: paid or not, the amount, and an invoice reference. Stripe processes your payment details under its own privacy policy.

If you pay at the counter when you pick the part up, the payment happens in the shop and nothing about your card is recorded on this site.

How we use it

• To take, prepare and hand over your order.
• To tell you what is happening with it — that it was received, paid, is ready for pickup, or was cancelled or refunded. These are service messages about your own order, not marketing.
• To answer your questions about fitment, price and availability.
• To keep the books: sales records, tax and refunds, as Canadian law requires of any business.
• To keep the site working and secure, and to prevent fraud and abuse.

We also measure our own advertising: if you reached us from a Google or Facebook ad, those platforms are told that a visit turned into an order, and the order total. That is how we find out which ads are worth paying for.

We do not sell, rent or trade your personal information. We do not send advertising email, and we do not share your details with data brokers.

Who we share it with

Only the service providers that make the shop run, and only what each of them needs:

• Stripe — online card payments, invoices and refunds.
• Google (Firebase Authentication) — sign-in and passwords.
• Vercel — hosting for this site.
• Neon — the database our orders and messages live in.
• Resend — sending the order emails.
• Google (Ads and Merchant Center) — measuring our advertising, and, if you agree to it on the order page, sending you one email asking how the purchase went. Google receives details of that order, and your email address only if you accept that survey.
• Meta (Facebook) — measuring the same thing for ads shown on Facebook and Marketplace.

Some of these providers store or process data outside Canada, including in the United States, where it may be accessible to foreign courts and authorities under the laws of that country. Beyond them, we disclose personal information only when the law requires it, or to establish or defend a legal claim.

Our use of AI

We use AI to identify parts, write their descriptions and estimate prices — it looks at photographs of parts on our shelves and at public catalogue and market data. It is a tool for describing our own inventory. Your account, your order details and your messages are not sent to it.

Cookies

The cookies the shop itself needs to work:

• Session — keeps you signed in.
• Cart — remembers what you put in the cart before you order.
• Theme — remembers light or dark mode. This one is stored in your browser and never sent to us.

Third-party advertising cookies. Google and Meta also place cookies and similar web beacons through their measurement tags on this site, and they can read cookies they have already set in your browser. We use them to count sales that came from our ads — not to build a profile of you, and not to show you ads anywhere else.

You can control or block these in your browser settings — most browsers let you refuse third-party cookies without breaking the shop, since ours are separate. You can also turn off ad personalisation in your Google account and your Facebook settings. Blocking them costs you nothing here: checkout, sign-in and the cart do not depend on them.

How long we keep it

Orders, invoices and refunds are kept as business records for at least six years, which is what the Canada Revenue Agency requires. We cannot delete a completed sale before then.

Your account, your saved contact details and your message threads are kept while your account is open. Ask us to close it and we will delete them, leaving only the sales records described above.

How we protect it

The site is served over HTTPS, sign-in cookies cannot be read by scripts in your browser, passwords are held by Firebase rather than by us, and card numbers never reach our systems at all. Access to customer data inside the shop is limited to the staff who need it to fill your order. No system is perfect, but we do not keep what we do not need — which is the part that matters most.

Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the information we are not required to keep;
• stop using your information, where we are not required to keep using it.

Write to us at main@tshauto.com and we will answer within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Children

This is a shop for car owners and repair trades. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us their information, tell us and we will delete it.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top of it. Material changes to how we use information you have already given us will be explained here before they take effect.