Privacy policy

Last updated: October 13, 2026

Kilo · 6746 Quebec St, Vancouver, BC V5X 0A8 · +1 604-690-6760 · hello@kilobrewer.com

This policy explains what personal information we collect, why, who we share it with, and the choices you have. It applies to kilobrewer.com, our Shopify store, our email list and our emails to you. We're a small company in Vancouver, and we collect as little as we need.

1. Who is responsible

Timeless Mechanics Inc., the British Columbia company behind Kilo, is responsible for the personal information we collect. We follow British Columbia's Personal Information Protection Act (PIPA). When your information crosses a provincial or national border, we also follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Privacy contact: Privacy Officer, Kilo, hello@kilobrewer.com, 6746 Quebec St, Vancouver, BC V5X 0A8.

2. What we collect

  • At checkout (paying a deposit): your name, email address, billing address, phone number (optional), and order details and history. Card details go directly to our payment processor, Shopify Payments. We never see or store your full card number.
  • Email signup form: your email address only.
  • When you contact us: your email address and whatever you write to us. If you chat with us on the site, we also see your messages, the name and email you give, and what's in your cart while you chat.
  • Kickstarter matching: when the campaign ends, we receive a backer report from Kickstarter as the project creator. We use the email address in it to match your pledge to your deposit.
  • Browsing the site: Shopify sets cookies that the store needs to work (for example, your cart and checkout), and records basic device and usage information such as your IP address and browser.
  • Videos: some pages show our videos through YouTube's privacy-enhanced mode (youtube-nocookie.com). When a video loads or plays, YouTube (Google) receives your IP address and device information and may store cookies or similar data on your device, under Google's own privacy policy (policies.google.com/privacy). We don't receive that information.

We don't knowingly collect information from children. You must be an adult to pay a deposit.

3. Why we use it

  • To take your deposit, send your receipt and reservation terms, and hold your spot.
  • To send your private Kickstarter link and other messages about your reservation.
  • To match your deposit to your Kickstarter pledge, and to process refunds.
  • To answer your questions.
  • To send marketing email, only if you've opted in.
  • To prevent fraud and enforce "one deposit per person".
  • To meet legal, tax and accounting obligations.

We tell you these purposes before or when we collect your information. If we want to use it for a new purpose, we'll ask you first, unless the law allows otherwise.

4. Consent and your choices

  • Your order. When you pay a deposit, you consent to us using your information to process it as described above.
  • Marketing email. We send marketing email only if you sign up for it, and nothing is pre-ticked. Every marketing email has an unsubscribe link, and we act on it within 10 business days (usually sooner). Emails about your deposit itself (your receipt, your private link and refund confirmations) aren't marketing, and we still send them after you unsubscribe.
  • Cookies. Our cookie banner lets you accept or decline non-essential cookies. Our "Your Privacy Choices" page lets you opt out of sharing for targeted advertising. We honour those opt-outs from anyone, wherever you live, and we treat a Global Privacy Control signal from your browser as an opt-out for that browser.
  • Analytics and advertising tools. We don't use analytics or advertising tools (such as Google Analytics or the Meta Pixel) right now. If we add analytics or advertising tools, we'll update this policy before we do.
  • Withdrawing consent. You can withdraw consent at any time by emailing hello@kilobrewer.com or unsubscribing. If you withdraw consent to something we need to process your deposit, we may have to cancel and refund your deposit instead.

We don't sell your personal information.

5. Who we share it with

We share personal information only with the service providers who help us run Kilo, and only what they need:

  • Shopify: hosts our store, checkout, customer list, order emails and site chat. It may process data in Canada, the United States and other countries.
  • Shopify Payments (card processing provided with Stripe): processes payments and refunds, in Canada, the United States and other countries.
  • MailerLite: sends our email newsletter and holds our email list, in the European Union. For subscribers who signed up through our store, it also receives your name and a summary of your purchases (such as number of orders and amount spent).
  • Kickstarter: runs our crowdfunding campaign in the United States. As creator, we receive its backer report and compare its email addresses with our deposit list.

We may also share information:

  • with our accountant and legal advisers, under a duty of confidentiality;
  • when the law requires it, or to protect our rights or the safety of others;
  • with a buyer or successor if our business is sold or reorganized, under the same protections.

Shopify runs some features (such as the Shop app and Shop Pay) for which Shopify itself is responsible. See Shopify's Consumer Privacy Policy at shopify.com/legal/privacy/app-users.

6. Storage outside Canada

Some of our providers store or process information outside Canada, including in the United States and the European Union. While it's there, it may be accessible to the courts, law enforcement and national security authorities of those countries. We use providers whose contracts require them to protect your information.

7. How long we keep it

  • Order, payment and refund records: six years after the end of the tax year they relate to, as Canadian tax law requires.
  • Information we used to make a decision about you (for example, a refund decision): at least one year after the decision, as BC law requires.
  • Marketing email list: until you unsubscribe. We keep a record of your consent and unsubscribe for as long as we need it to show we followed the law.
  • Messages to us: as long as needed to deal with your question and keep a record of it.

After that, we delete the information or make it anonymous.

8. How we protect it

We use the security built into Shopify, Shopify Payments and MailerLite, and only the people who run Kilo have access. We don't keep card numbers. No system is perfectly secure, but we take reasonable steps for the kind of information we hold.

9. Access, correction and deletion

You can ask us what personal information we hold about you, how we've used it and who we've shared it with. You can also ask us to correct it, or to delete it unless we have to keep it (for example, for tax records). Email hello@kilobrewer.com. We may ask you to confirm your identity. We'll respond within 30 business days, or tell you why we need more time, as the law allows. Access requests are free.

10. If something goes wrong

If there's a breach of security safeguards involving your personal information, we'll act quickly to contain it. If it's reasonable to believe the breach creates a real risk of significant harm to you, we'll tell you as soon as feasible and report it to the Office of the Privacy Commissioner of Canada. We'll also tell other regulators where their laws require it, and keep a record of every breach for at least 24 months.

11. International visitors

Québec: our Privacy Officer (section 1) is the person in charge of protecting personal information. You can ask us to stop sharing your information or to correct it, and you can complain to the Commission d'accès à l'information du Québec.

European Union and United Kingdom: the GDPR or UK GDPR may apply to how we handle your information. We rely on:

  • contract, to take and refund your deposit;
  • consent, for marketing email;
  • legitimate interests, for fraud prevention and record-keeping;
  • legal obligation, for tax records.

You have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent. You can complain to your local data protection authority. Our providers transfer data out of the EU and UK using approved safeguards, such as Standard Contractual Clauses.

12. Complaints

Please contact our Privacy Officer first. If you're not satisfied, you can contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca), in Québec the Commission d'accès à l'information (cai.gouv.qc.ca), or in the EU or UK your local data protection authority.

13. Changes

We may update this policy. We'll post the new version here with a new date. If a change affects how we use information we already hold, we'll tell you by email and ask for your consent where the law requires it.