Privacy
I run Sidra myself, and I look after your details the way I'd want mine looked after.
Last updated Oct 21, 2026.
The short version
- I collect only what I need to take your order, pack your box and deliver it. I never sell it.
- Stripe holds your card. I never see your full card number.
- On this website, the Meta Pixel tells Meta about visits and orders, so I can measure my ads and Meta can show them to people likely to want them. It is never on your account page.
- You get offers by text only if you say yes. Offer emails stop with one tap.
- Most of what I keep is stored in the United States, by Google and Stripe.
- You can see, correct or delete what I hold, apart from records the law makes me keep. Email me and I reply within 30 days.
- If your information is ever exposed, I email you as soon as I know.
The full policy below is what counts.
Sidra Microgreens Inc. is a small business in Richmond, British Columbia. It is responsible for the information this page describes.
Questions about your information come to me: Atheeb Azeem, Director of Operations, Sidra Microgreens Inc., hello@sidramicrogreens.ca.
This page covers this website, your Sidra account page, and the emails and texts I send. I follow British Columbia's Personal Information Protection Act and Canada's anti-spam law (CASL).
Here is each kind of information I keep, why I need it, where it comes from and who sees it.
2.1 Your order
- What:
- your name, mobile number, email, street address, postal code and delivery notes. What you ordered and when, your delivery Tuesdays, and which version of my terms you agreed to. Any notes I add about your deliveries.
- Why:
- to pack and deliver your box, take payment, send your copy of the agreement, and keep my sales records.
- Where it comes from:
- you, on the order form or by email.
- Who sees it:
- me. Anyone who helps me pack or deliver sees only what that job needs, such as your name, address and delivery notes. Google stores it for me. Stripe gets your email and what you're buying. Google Maps gets your address to plan the delivery route.
2.2 Payments
- What:
- that you paid, the amount, and how you paid (card, Apple Pay, Google Pay or Link). Your card's brand and last four digits when Stripe shows them, and your credits and refunds. Never your full card number.
- Why:
- to charge your plan, show you which card pays it, give credit and refunds, and keep tax records.
- Where it comes from:
- Stripe. You type your card details on Stripe's own page, and Stripe emails your receipt.
- Who sees it:
- Stripe holds your card. I see only what this list names.
2.3 Your account
- What:
- each change you make, and when: skips, pushes, holds, extras, plan switches, stops, cancellations and payments. When you last opened your account. Changes to your email, delivery notes, address or sign-in number, with the old and the new. Your choice about offers by text, and a review if you write one. If you start to cancel your plan, the reason you tap and any note you add. These are kept from the moment you tap, even if you then keep your plan.
- Why:
- to make your changes, keep your money right, and understand why people skip or stop, so I can plan and price my greens better.
- Where it comes from:
- you, in your account.
- Who sees it:
- me. Changes that move money also go to Stripe.
2.4 The chef form
- What:
- your restaurant or business name, your name and role, mobile number, email, neighbourhood or address, roughly how much you need a week, the kind of kitchen, and your notes.
- Why:
- to reply to you and plan a sample or supply.
- Where it comes from:
- you, on the chefs page.
- Who sees it:
- me. Your answers are also kept in your browser, so the collection stays open for you on that device (see section 7).
2.5 Messages
- What:
- the emails and texts you send me, and my replies.
- Why:
- to answer you and keep track of your orders.
- Where it comes from:
- you.
- Who sees it:
- me. Google runs my email.
2.6 Where you came from
- What:
- if an ad or a link brought you here: its campaign words, the click code Facebook or Instagram adds to the link, the first page you opened on this site, the name of the website that sent you (never the page on it), and when.
- Why:
- to know which ads and links bring people who order, so I spend less on the ones that don't.
- Where it comes from:
- your browser keeps a small note for 30 days. It reaches me only if you order, sent with your order, and I keep it with your order and your customer details.
- Who sees it:
- me.
2.7 Emails I send you
- What:
- a copy of each email I send you, whether it was delivered, and your choice about offer emails.
- Why:
- to show what I told you and when, and to respect your choice.
- Where it comes from:
- my email system.
- Who sees it:
- me. Google sends them for me.
2.8 Visits and technical records
- What:
- like any website, Google's servers record technical details of each visit and request, such as your internet address and browser type. To slow down robots, the order form and the chef form also count tries from each internet address. The count is kept as a scrambled code, never the address itself.
- Why:
- to keep this website and my systems safe.
- Where it comes from:
- your browser.
- Who sees it:
- Google, and me when I look into a problem.
- The postal code check on the homepage runs in your browser. The code isn't sent to me, and Meta learns only that a code was checked, never the code.
- Your basket stays in your browser tab until you close it.
- I never see or keep your full card number.
- When you sign in, wrong postal codes are counted, but the codes you type are never kept.
- Your account page has no Meta Pixel and no ad cookies.
- I don't buy contact lists or get your details from data brokers.
About your plan or order. These emails are part of the service, so they always come: your welcome email (your copy of the agreement), changes to your plan, and notices about your deliveries. They never carry offers. Stripe emails your receipts.
Offers by email. I may send news and offers to customers, and to past customers for up to 2 years after their last order or the end of their plan, as Canada's anti-spam law allows. If you start an order and don't finish paying, I may send you one reminder. Every offer email has a one-tap link to stop them, with no sign-in, and your email app's own Unsubscribe button works too. It takes effect straight away, and never later than 10 business days.
Offers by text. Only if you say yes, with an unticked box on the order form or the switch in your account. The words you agree to name my business, a mailing address and my email. You never need to say yes to buy. To stop, reply STOP to any offer text, turn it off in your account, or email me. I stop as soon as I see it, and always within 10 business days.
Your choices are kept. I keep each yes and no with the exact words you saw and the date, as the law asks. Saying no never changes your deliveries or your price.
You sign in with the mobile number you gave me with your order. Google Firebase texts a one-time code to that number. The sign-in page uses Google reCAPTCHA to stop robots, so Google checks your browser for signs of one. reCAPTCHA may keep its own note in your browser, under Google's privacy policy.
After each new code, I also ask for the postal code of your delivery address, so a phone number that changes hands can't open your account. Five wrong tries in an hour lock the account for an hour, and ten in a day lock it until I unlock it.
You stay signed in on that device until you sign out or your browser clears its data. Your sign-in is kept in your browser under the account page's own web address, so nothing on this website can read it. Signing out clears everything the account page kept on your device.
Keep your number current. If your number changes, change it in your account when it offers that, or email me. If you lose your phone, email me right away so I can change the number on your account.
If you write a review in your account, I read it before it can show on this website. I publish honest reviews, low ones too, and hide one only for abuse or someone's personal details. If you change your review, I read it again before it shows.
A review shows your stars, your words, your first name and last initial, "Vancouver", and the month it went up. Choose "Keep my name off it" and it shows "A Sidra customer" instead. A review with stars and no words never shows on this website.
Ask me any time and I take your review down. You're always free to review Sidra anywhere else too.
The Meta Pixel. To measure my Facebook and Instagram ads, and to help Meta show them to people likely to order, this website runs the Meta Pixel, a small piece of code from Meta. It runs on the homepage, the chefs page and the thank-you page after you pay. It is never on your account page, and it isn't on this page or my terms.
It tells Meta when you:
- open a page
- open a green to read about it
- add a pack to your basket
- open the order form, with the plan or basket and its price
- check a postal code, never the code itself
- send the chef form, or ask about a green on the chefs page
- pay, with the plan, the amount in Canadian dollars, and an order code so a payment is counted once
Like any web request, Meta also receives your internet address and browser details. If you're signed in to Facebook or Instagram in the same browser, Meta can link the visit to your account there. I don't send Meta your name, email, phone number, address or postal code. What Meta does with this is covered by Meta's privacy policy.
Its cookies. The Pixel sets a cookie called _fbp on this website's own address. It holds a random code, not your name, and lasts about 90 days. If you arrive from a Facebook or Instagram ad, it also sets _fbc, which holds the ad's click code, for about 90 days.
Turning it off. You can:
- choose which ads you see in your Meta ad preferences
- disconnect past website visits in Your activity off Meta technologies
- opt out of interest-based ads at youradchoices.ca
- block or clear this website's cookies in your browser's settings
Blocking them never stops you ordering.
Google Fonts. Every page of this website and your account page loads its typefaces from Google Fonts. To send them, Google receives your internet address and browser details. Google Fonts sets no cookies. Google's note on Fonts and privacy.
What stays in your browser. These are not cookies. They stay on your device unless the table says otherwise.
| Name | Where | What it holds | How long |
|---|---|---|---|
sidra-src | this website | where you came from (section 2.6), sent to me only with an order | 30 days, then your next visit replaces it |
sidra-cart | this website | your basket | until you close the tab |
sidra-order | this website | the plan or basket and price you chose, for the thank-you page | until you close the tab |
sidra-purchase- and an order code | thank-you page | a mark so the Meta Pixel counts a payment once | until you clear it |
sidra-chef | chefs page | your chef form answers, so the collection stays open. Anyone using that device can see them. | until you clear it |
| your sign-in | account page | keeps you signed in, kept by Firebase | until you sign out or clear it |
other sidra- notes | account page | which account you last opened, changes still being sent, the calendar view you picked, notices you've seen | until you sign out |
Only the companies that help me run Sidra, and only for that:
| Company | What it does for me | Its privacy policy |
|---|---|---|
| Stripe | card payments, receipts, and the secure pages where you pay or update your card | stripe.com/privacy |
| hosts this website and your account page, runs my order and delivery system (Firebase), texts your sign-in codes, runs reCAPTCHA, runs and sends my email (Google Workspace and Gmail), turns addresses into a delivery route (Google Maps), and serves the fonts (Google Fonts) | policies.google.com/privacy | |
| Meta | measures my Facebook and Instagram ads on this website (section 7) | facebook.com/privacy/policy |
If you pay with Link, Apple Pay or Google Pay, that service keeps your card for you under its own privacy policy.
No supplier of mine ever gets your details. Anyone who helps me pack or deliver sees only what that job needs. I never sell or rent your information, and I share it with anyone else only if the law requires it.
Where it's stored. My order and account records are kept in Google's data centre in Oregon, in the United States. Stripe, Google and Meta may also keep information in the United States and other countries. There it is protected by their security, and it can be subject to those countries' laws, including requests from their authorities.
I keep information only while I need it, then I delete it.
| What | How long |
|---|---|
| Your customer details, and the emails and texts you send me | while you're a customer, then 7 years after your last box or order |
| Sales, payments, credits and refunds, and each change that moved money or changed your plan (a skip, push, hold, extras, a switch, a stop or a cancel) | 7 years, because the Canada Revenue Agency asks for 6 years after the tax year |
| The record of other changes in your account, like a new email | 90 days. The details themselves, your review and the reasons you tapped stay with your customer details. |
| Each yes or no to offers, with the exact words you saw | as long as I keep your customer details, then 3 more years. If you never became a customer, 3 years after your checkout. |
| Copies of emails about your plan or order | 7 years |
| Copies of offer emails | 3 years |
| A checkout you started but never paid | 30 days |
| A change of sign-in number in progress | 7 days |
| The count of wrong postal codes at sign-in | until a day passes with no wrong try. A lock after ten wrong tries in a day lasts until I unlock it. |
| The scrambled count of tries from an internet address | 1 day |
| Your sign-in record at Firebase (your number and when you signed in) | until you ask me to delete it, or I delete your customer details |
| A chef enquiry | while you and I talk about supplying your kitchen. If it doesn't go ahead, until you ask me to delete it, and no longer than 2 years. |
| Technical records of visits | about 30 days |
Your details are kept in password-protected systems. Only I and the people who help me run Sidra can open them, and each person sees only what their job needs. Everything travels encrypted. Card details never reach my systems at all: you type them on Stripe's page.
Your account page has its own web address and strict security rules, so no other script on this website, ads included, can reach your sign-in.
If something goes wrong. If your information is ever exposed, I email you as soon as I know, and tell you what happened and what you can do.
You can ask me to:
- show you the information I hold about you
- correct it
- stop using it for something you agreed to
- delete it, apart from records the law makes me keep
Email me at hello@sidramicrogreens.ca. I may ask you to confirm it's you, for example by writing from the email I have for you. I reply within 30 days.
You can also change your email, delivery notes and offers by text yourself in your account, and your address and sign-in number when your account offers that.
If you're not happy with my answer, you can contact the Office of the Information and Privacy Commissioner for British Columbia.
When this page changes, the date at the top changes too. If a change affects how I use information you've already given me, I tell you by email first.