Privacy Policy

Who is responsible

GRAEL EYEWEAR STORE ("GRAEL", "we", or "us") is a British Columbia sole proprietorship, registration FM1118401. Baraa Jayousi is the proprietor and Privacy Officer.

The Privacy Officer works part-time. The privacy inbox is the primary contact channel, and requests are handled as soon as reasonably possible within applicable legal time limits.

What this launch is

This Canadian pre-launch website measures interest in possible eyewear products, starting in British Columbia. Joining is not a purchase, reservation, deposit, or guarantee that a frame will launch. We do not request payment information or prescriptions through the waitlist. Please do not send health information by form or email.

Information we collect

• Your email address.
• The server-verified frame, variant, and colour connected to your request.
• Limited campaign fields: UTM source, medium, campaign, content, term, and an experiment label. We do not retain the complete page query string or advertising click identifiers in a waitlist row.
• Whether you selected the separate optional marketing checkbox, its wording version, and lifecycle records such as pending, confirmed, withdrawn, or suppressed status.
• Basic network, browser, request, and security information processed by our service providers.
• Counts of how often each frame page is viewed, by day, with the campaign source and name from the page address. The counts store no IP address, cookie, or other identifier, so they are collected whatever you choose in the cookie banner.
• If you allow advertising cookies, the website activity described below, including details you enter in forms on this site, such as your email address, which the Meta Pixel sends to Meta.
• If you take the GRAEL survey: the answers you give, the frames you were shown, the campaign fields above, when you started and finished, and the email address you give at the end in exchange for a founding-member code. The survey never asks for a prescription or anything about your eye health, and we ask you not to type any. Answers save as you go, so a survey you start and do not finish leaves the answers you had given. If you did not reach the last screen, those answers carry no email address.

Why we use it

• To record the product-availability request and prevent duplicates.
• To contact you if the selected frame becomes available.
• To measure demand by genuine, server-verified frame and campaign.
• To decide which frames to buy first, using what people tell us in the survey. Survey answers are stored by GRAEL in Canada, not with a survey company.
• To issue and honour a founding-member code for completing the survey, and to email it to you if you selected the optional marketing checkbox. The full terms of that offer are on our terms page.
• To send general marketing only if you selected the optional marketing checkbox.
• To operate, secure, troubleshoot, and improve the website.
• To meet legal obligations and respond to privacy requests or incidents.

We limit collection, use, and disclosure to appropriate stated purposes and obtain consent where required.

Waitlist and email choices

When you join, we email you a link to confirm your address. Your request only counts once you confirm it, and unconfirmed requests are deleted after 30 days.

The product-availability email you request is separate from general marketing. The general marketing checkbox is visible, optional, and off by default. You may join without selecting it.

Every email we send identifies GRAEL EYEWEAR STORE, gives our mailing address and contact details, and includes an unsubscribe link that works without logging in. The link takes effect straight away, and requests sent by email are honoured within the period Canada's anti-spam law requires. Unsubscribing stops all waitlist email to that address. We keep a minimal record that you unsubscribed so the address isn't emailed again by mistake; ask us if you would also like your request deleted.

Unsubscribing also deletes your survey answers and stops any founding-member code you hold from working. If you want to unsubscribe but keep your code, write to us at [email protected] first and we will do it by hand.

Analytics and advertising

You are asked about two things separately, and you can allow one without the other. Analytics covers Google Analytics, which measures which pages and frames get looked at. Advertising covers the Meta Pixel and Meta Conversions API, which measure GRAEL's ads and let Meta recognise your browser. Accept all allows both, Minimum allows neither, and "Choose what to allow" sets them one at a time. You can change your choice at any time using Cookie preferences. Our Cookies & Tracking page lists what each tool stores in your browser.

• Google Analytics 4 receives page and product views, waitlist intent, a waitlist-submit event, a lead event when you confirm your email, and general device, browser, and approximate-location information. Google is allowed to use this for advertising, such as measuring and personalising ads, only if you also allow advertising; with analytics alone we tell Google that advertising storage, advertising use of your data, and ad personalisation are all refused. See Google's Privacy Policy.
• Meta Pixel and Meta Conversions API receive a page or frame view, the frame's catalogue identifier, the page address, your IP address, browser and device information, and identifiers Meta stores in cookies on this site (including a click identifier when you arrive from a Meta ad). Frame views and waitlist events are sent from both your browser and our server, so an event is not lost when a browser blocks the Pixel. The Pixel also automatically reports buttons you click and descriptive information from the page, such as a frame's name. Submitting a waitlist request is reported to Meta as a lead, and confirming your email address as a completed registration. See Meta's Privacy Policy.

The Meta Pixel also uses Meta's automatic advanced matching. If you allow advertising and then enter details in a form on this site, such as your email address in the waitlist form, the Pixel reads them and sends them to Meta with the events above, so Meta can match your visit to people who use its services. When you submit a waitlist request and when you confirm your email address, our server also sends Meta your email address and your waitlist record's identifier with that event, each first turned on our server into a one-way SHA-256 hash, so Meta can match the event to the same people. Our server sends Meta the hash, never the address itself. Without advertising consent the Pixel is not loaded at all, nothing you enter is sent to Meta, and the Conversions API copy of those events, hashes included, is not sent from our server either.

We do not send Google your email address, and we do not send Meta or Google your name, mailing address, prescription or other health information, or payment information. We will update this policy before enabling a materially different provider or data flow.

Providers and processing locations

Contabo GmbH hosts the application and database in Frankfurt, Germany. Cloudflare provides content delivery, traffic security, rate-limiting support, and Turnstile anti-abuse verification. Zoho provides business email and sends the email that asks you to confirm a waitlist request. Google and Meta process the optional data described above.

Providers may process information outside British Columbia or Canada, including Germany and the United States, where it may be available to public authorities under local law. GRAEL remains accountable for information transferred to service providers and limits access to the service being provided. We do not sell personal information.

Retention

• Pending, unconfirmed waitlist entries are reviewed and deleted or anonymized after 30 days.
• Confirmed interest is reviewed at least annually and deleted or anonymized no later than 24 months after the last interaction, unless law requires longer.
• Minimum consent, unsubscribe, and suppression evidence may be kept for up to three years after the last relevant message or withdrawal.
• Survey answers are kept while they inform buying decisions, reviewed at least annually, and deleted the moment the address unsubscribes or asks to be deleted.
• Routine security logs are normally kept for 30 days unless needed for an incident.
• Privacy request and incident records are normally kept for two years after closure.
• Deleted information may remain in rolling backups for up to 30 additional days.

Safeguards

Safeguards include data minimisation, server-side catalogue validation, access controls, two-factor authentication for the business portfolio, transport encryption, anti-abuse controls, secret separation, and restricted administrative access. No online system is completely secure.

Encryption at rest for every current hosting, database, and backup layer has not yet been verified, so this policy does not claim that safeguard is implemented.

Your rights

You may withdraw optional consent, stop marketing, request access to personal information under our control, ask how it was used or disclosed, or request correction. Send a written request to the Privacy Officer. We may verify identity. Subject to permitted extensions and exceptions, access requests under British Columbia's Personal Information Protection Act are answered within 30 business days.

You may complain to the Office of the Information and Privacy Commissioner for British Columbia. We encourage you to contact us first so we can try to resolve the concern.

Minors

A parent or legal guardian should submit interest for a child's frame. We do not knowingly ask a child for a prescription, payment information, or other sensitive information through this waitlist.

Changes

We will update this page and date when practices materially change and provide additional notice or obtain new consent where required.