Last updated: June 23, 2026 · Effective immediately
Privacy is not an afterthought at CarefulTO — it is a core part of what we do. We handle legal contracts, medical records, confidential business documents, and personal correspondence every day. Our clients trust us with items that are not only physically fragile but often deeply sensitive. That trust extends to the personal information they share with us when booking.
CarefulTO is an owner-operated courier service based in Ontario, Canada. We do not operate a call centre, a warehouse, or a sales team. The person you book with is the person who handles your parcel — and your information. That means your data is seen by as few people as possible, used for exactly the purpose you provided it, and nothing else.
We collect only the information necessary to complete your delivery. We do not build advertising profiles, sell data, or share your details with anyone who does not need them to fulfil your booking. This policy tells you exactly what we collect, why, who sees it, and how we protect it.
This policy applies to personal information collected through our website at carefulto.ca, our booking form, our email correspondence, and any other interaction you have with CarefulTO.
We collect only the information required to book, fulfil, and confirm your delivery. This includes:
Payment is processed entirely by Stripe, our third-party payment processor. CarefulTO does not collect, see, store, or have access to your credit card number, CVV, or banking details at any point. When you click "Proceed to Secure Payment," you are redirected to Stripe's hosted checkout. Any payment data you enter is handled exclusively by Stripe under their own privacy and security standards.
Upon completion of every delivery, a photograph of the delivered parcel at its destination is taken as proof of delivery. This photo is shared with you — the booking client — by email, and retained briefly by CarefulTO for dispute resolution purposes before deletion.
Our website is hosted on Netlify. Standard web server logs (such as IP addresses and page request times) may be collected automatically by Netlify as part of normal website operation. CarefulTO does not access or use these logs for tracking or marketing purposes. We do not use cookies for advertising or analytics.
The personal information you provide is used exclusively to deliver the service you have requested. Specifically:
We do not use your information for marketing. We will not add you to a mailing list, send you promotional emails, or contact you for any purpose unrelated to your delivery. The only communications you will receive from CarefulTO are transactional — directly related to a booking you have made.
CarefulTO does not sell, rent, trade, or otherwise transfer your personal information to any third party for commercial, marketing, or advertising purposes — ever.
Your information may be shared with the following service providers, solely to the extent necessary to fulfil your delivery:
No other third parties receive your personal information. All deliveries are performed personally by CarefulTO — we do not subcontract to other couriers or share your pickup or delivery addresses with any external logistics provider.
CarefulTO may disclose your information if required to do so by law, court order, or governmental authority, or if we have a good-faith belief that such disclosure is necessary to comply with applicable law or to protect the rights, property, or safety of CarefulTO, our clients, or the public.
When your information is shared with a third-party service provider (Stripe or Netlify), it is transmitted exclusively through encrypted, secure channels:
There is no manual handoff of your data to any third party. We do not print, fax, or verbally relay your personal information to external parties. We do not share your information with data brokers, analytics companies, advertising networks, or social media platforms.
Your delivery addresses stay private. The recipient of your parcel is not provided with your personal contact details, and your details are not shared with the sender (if you are the recipient). We handle deliveries discreetly, as befitting a courier trusted with confidential documents.
We retain your personal information only for as long as is necessary for the purpose for which it was collected, or as required by applicable law.
Completed booking records — including name, contact details, pickup and delivery addresses, parcel type, and booking date — are retained for a reasonable operational period for accounting, tax compliance, and dispute resolution purposes. Records that are no longer required are securely deleted.
Proof-of-delivery photographs are shared with you upon delivery and retained by CarefulTO for a short period sufficient to resolve any claim or dispute (aligned with the 48-hour claim window in our Terms of Service). Photos are then deleted from our records.
CarefulTO does not store payment card data. Stripe retains transaction records in accordance with their own data retention policies and applicable financial regulations. Your Stripe-issued receipt is the authoritative record of your payment.
Emails exchanged with CarefulTO — including booking confirmations and delivery updates — are retained in our email account for operational purposes. You may request deletion of your correspondence at any time (see Section 8).
CarefulTO takes the security of your personal information seriously and implements practices appropriate to the nature of our business and the sensitivity of the data we handle.
Our entire website operates over HTTPS, ensuring that all data transmitted between your browser and our website — including your booking form submission — is encrypted in transit using TLS (Transport Layer Security).
Payment card data is handled exclusively by Stripe, which maintains PCI-DSS Level 1 certification — the highest standard for payment card security. CarefulTO's servers and systems never receive, process, or store your card number, expiry date, or CVV. This is by design. The moment you click "Proceed to Secure Payment," you are on Stripe's infrastructure, not ours.
CarefulTO is an owner-operated business. Your personal information is accessed only by the owner in the course of fulfilling your booking. There are no employees, contractors, or third parties with routine access to customer data.
We do not embed third-party tracking scripts, advertising pixels, or analytics tools on our website that would expose your browsing behaviour to external companies. Our site is intentionally lean — it exists to serve you, not to profile you.
Many of our clients entrust us with legal contracts, medical records, and confidential business correspondence. These items are handled personally and discreetly. We do not photograph, copy, scan, or read the contents of documents we are engaged to deliver. Confidentiality in transit is an absolute standard for us.
No system is perfectly impenetrable, and we do not make representations to that effect. However, the security measures we have put in place — HTTPS-only communications, Stripe-handled payments, minimal data collection, and owner-only access — are designed to significantly reduce risk and limit the impact of any potential incident.
CarefulTO is a proud member of the Canadian Internet Registration Authority (CIRA) — the national not-for-profit organization that manages the .ca domain and champions a trusted, secure Canadian internet. As a CIRA member, CarefulTO is part of a community of businesses and individuals committed to a safer online experience for all Canadians. This membership reflects our ongoing investment in operating with transparency, security, and accountability — the same values we bring to every delivery we make.
As a resident of Ontario or Canada, you have rights regarding your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. These include:
To exercise any of these rights, please contact us in writing at info@carefulto.ca. We will respond to all privacy requests within a reasonable time, typically within 10 business days.
We will never retaliate against, penalize, or discriminate against any person for exercising their privacy rights. Requesting access to or deletion of your data will have no effect on the quality of service you receive from CarefulTO.
If you have any questions, concerns, or requests regarding this Privacy Policy or the way CarefulTO handles your personal information, please contact us directly:
We are committed to addressing all privacy-related concerns promptly and transparently. If you are not satisfied with our response, you have the right to escalate your concern to the Office of the Privacy Commissioner of Canada.
CarefulTO reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Continued use of CarefulTO's services following a policy update constitutes your acceptance of the revised terms. If a change materially affects how we handle information you have already provided, we will make reasonable efforts to notify you directly.
This Privacy Policy should be read alongside our Terms of Service & Liability, which govern your use of CarefulTO's delivery services more broadly.