←  Don Yoku

Privacy Policy

Last updated: August 29, 2026

This Privacy Policy explains how Aidan McQuay, doing business as Don Yoku (“Don Yoku,” “we,” “us,” or “our”), an independent cut-and-sew denim studio based in Ontario, Canada, collects, uses, stores, discloses, protects, and otherwise processes personal information when you visit donyoku.ca, purchase a ready-made product, configure or order a made-to-order garment, upload a reference image, communicate with us, or otherwise interact with our services.

This Policy is intended to provide transparency under privacy and data-protection laws that may apply to our activities, including applicable Canadian privacy law, the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom GDPR and Data Protection Act 2018 as amended, applicable United States state privacy laws, and other applicable privacy and data-protection laws.

Different laws may apply depending on where you live, the nature of our relationship with you, and whether a particular law applies to Don Yoku. Additional regional rights are described later in this Policy.

  1. Who is responsible for your information
  2. Scope of this Policy
  3. Personal information we collect
  4. Sources of personal information
  5. How and why we use personal information
  6. Legal bases (EEA, UK, and similar)
  7. Sensitive or special-category information
  8. Browser storage, cookies, and tracking
  9. How we disclose personal information
  10. Sale, sharing, advertising, and profiling
  11. International processing and transfers
  12. How long we keep personal information
  13. Security
  14. Personal-data breaches
  15. Your privacy rights — general
  16. How to exercise your rights
  17. Canadian privacy rights
  18. EEA / European Union rights
  19. United Kingdom rights
  20. Switzerland and other jurisdictions
  21. United States state privacy rights
  22. California privacy disclosures
  23. Children and youth
  24. Automated decision-making and AI
  25. Changes to purposes
  26. Changes to this Policy
  27. Contact us

1. Who is responsible for your information

For personal information handled through Don Yoku, the person responsible for our privacy practices is:

Privacy Officer — Don Yoku
Aidan McQuay
149 Elgin Cres
Waterloo, Ontario N2J 2S5
Canada
Email: support@donyoku.ca

Where the EU GDPR, UK GDPR, or similar data-protection legislation applies, Don Yoku generally acts as the controller of personal information that we decide to collect and use for operating the store and fulfilling orders.

Our service providers, including Stripe, Netlify, Resend, and Sentry, may separately act as processors, service providers, contractors, or independent controllers for certain processing they perform under their own legal obligations and privacy practices.

2. Scope of this Policy

This Policy applies to personal information processed in connection with:

Where we currently sell and ship. Don Yoku is operated from Ontario, Canada, and our checkout currently accepts shipping addresses in Canada only. We do not currently market or ship to the European Economic Area or the United Kingdom. The regional sections below describe rights that may apply where the relevant law applies to Don Yoku and to the processing in question; we set them out so that our practices are transparent to every visitor, including visitors outside Canada.

This Policy does not govern the independent privacy practices of websites, platforms, payment services, shipping providers, or other third parties that operate under their own privacy notices.

3. Personal information we collect

The information we collect depends on how you interact with Don Yoku.

A. Identification and contact information

We may process information such as:

B. Order and commercial information

We may process:

C. Made-to-order garment information

If you configure or order a made-to-order garment, we may process information such as:

Measurements are used to produce the garment you request. They are not used to make health assessments, infer medical conditions, or create advertising profiles.

D. Reference images

You may optionally upload a reference photograph through the made-to-order configurator.

Before upload, the website is designed to resize and re-encode the image. Don Yoku does not intentionally retain the original uploaded file or original embedded metadata such as EXIF or GPS metadata in the stored reference image.

Reference images are stored separately in private storage provided through Netlify infrastructure and are not intended to be publicly accessible.

Stripe may receive an opaque reference-image identifier within order metadata so that Don Yoku can associate the privately stored image with the appropriate commission. The actual reference-image file is not intentionally sent to Stripe.

A reference image may contain personal information depending on what you choose to photograph. Please avoid including faces, documents, addresses, account information, health information, or other unnecessary personal or sensitive information unless it is genuinely necessary to communicate the garment request.

We do not use customer reference images for facial recognition, biometric identification, advertising, behavioural profiling, or training artificial-intelligence models.

E. Payment information

Payments are processed through Stripe-hosted Checkout.

Stripe may collect:

Don Yoku does not receive or store your complete payment-card number or card security code/CVC.

We receive information from Stripe necessary to confirm and administer orders, which may include payment status, amounts, customer contact information, shipping information, Stripe identifiers, and order information.

F. Technical and device information

When you access the website, our hosting and infrastructure providers may automatically process technical information generated by ordinary web requests, which may include:

We do not currently use this technical information to build behavioural advertising profiles.

G. Communications

If you contact us, we may process the information contained in your communication, such as:

Please do not send highly sensitive personal information unless it is genuinely necessary.

4. Sources of personal information

We may receive personal information:

We do not purchase customer profiles from data brokers.

We do not currently obtain personal information for behavioural advertising or third-party audience building.

5. How and why we use personal information

We may use personal information to:

We do not use personal information for purposes that are materially unrelated to those described in this Policy without providing additional notice or obtaining consent where required.

6. Legal bases for EEA, UK, and similar data-protection laws

Where a law such as the EU GDPR or UK GDPR requires us to identify a lawful basis, we generally rely on the following.

Performance of a contract or steps requested before a contract

We may process information necessary to:

This may include your contact information, shipping information, order details, garment specifications, measurements, commission notes, and reference material reasonably necessary for the garment.

Legal obligations

We may process or retain information when required to comply with tax, accounting, consumer-protection, fraud-prevention, regulatory, court, or other legal obligations.

Legitimate interests

Where permitted, we may rely on our legitimate interests in:

Where legitimate interests is relied upon, we consider whether our interests are overridden by your privacy rights and freedoms.

Consent

We may rely on consent when consent is required by applicable law.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not make processing that occurred before withdrawal unlawful.

7. Sensitive or special-category information

Don Yoku does not intentionally request information about:

except where information is voluntarily provided and genuinely necessary in connection with a request, or where law otherwise permits its processing.

A photograph may incidentally reveal personal characteristics. Don Yoku does not use customer photographs to infer protected characteristics or to perform biometric identification.

Full payment-card credentials are processed by Stripe rather than stored by Don Yoku.

8. Browser storage, cookies, and tracking

The public Don Yoku website does not currently use third-party behavioural advertising tools or advertising pixels such as:

Website analytics

We use Netlify Web Analytics to understand general website traffic. Netlify derives these analytics from server and content-delivery-network request logs. The resulting information may include pageviews, approximate unique visitors, requested pages, referral sources, and general geographic information inferred from IP addresses.

Netlify Web Analytics operates server-side and does not require Don Yoku to place an analytics cookie or advertising identifier in your browser. We use these analytics to understand aggregate traffic and improve the website, not to build behavioural advertising profiles.

Error and performance monitoring

We use Sentry to monitor application errors and limited performance diagnostics so that we can identify crashes, broken flows, and reliability problems. Sentry is used for troubleshooting and site reliability, not for behavioural advertising.

The Don Yoku storefront is configured not to send default personally identifying information, user profiles, HTTP request bodies, cookies, request headers, or URL query strings to Sentry. Where applicable, reported URLs are reduced to their origin and path. We do not use Sentry Session Replay.

The site does use browser storage necessary or useful for ordinary functionality.

Cart storage

Your cart may be saved in your browser's localStorage so that it remains available between visits.

Commission-draft storage

An unfinished commission configuration may be stored in your browser's localStorage.

Depending on what you have entered, this may include measurements, selections, notes, and the opaque identifier of an uploaded reference image.

Announcement storage

The website may use sessionStorage to remember whether you have dismissed a site announcement during the current browsing session.

Administrative authentication

The private Don Yoku administration area uses security-related authentication mechanisms, including an administrative session cookie, to keep authorized administrators signed in.

This cookie is not used for customer advertising.

Stripe

When you proceed to Stripe-hosted Checkout, Stripe may use cookies, browser storage, or similar technologies under Stripe's own privacy and security practices.

Do Not Track and opt-out preference signals

Don Yoku does not currently sell personal information or use cross-site behavioural advertising, so there is currently no behavioural-advertising sale or sharing activity to disable through a traditional browser “Do Not Track” signal.

Where an applicable privacy law requires recognition of a legally valid universal opt-out mechanism or preference signal, such as Global Privacy Control, we will honour the signal to the extent that it applies to processing in which we engage.

If we introduce non-essential advertising or client-side analytics technologies in the future, we will update our consent and cookie practices as required before using them.

9. How we disclose personal information

We do not sell customer personal information.

We disclose personal information only when reasonably necessary for the purposes described in this Policy or as otherwise permitted by law.

Stripe

We use Stripe to process payments and hosted checkout.

Stripe may receive customer information, shipping information, payment-related information, order details, and made-to-order metadata necessary to process and document a transaction.

For new made-to-order checkouts, the customer-facing Stripe product/receipt line is intentionally generic. Detailed garment specifications, measurements, notes, and a reference-image identifier are stored separately in Checkout Session metadata while needed to fulfill the commission.

Commission-specific Checkout Session metadata is subject to the deletion process described in this Policy.

Stripe independently retains payment and transaction information according to its own legal obligations and retention practices.

Netlify

Netlify provides hosting, serverless functions, storage infrastructure, and server-side web analytics used by Don Yoku.

Netlify may process technical request information, including IP addresses and requested pages, for hosting, security, troubleshooting, and aggregate website-traffic analytics, and hosts private customer reference images used in the made-to-order workflow.

Resend

We use Resend to send transactional Don Yoku order-confirmation emails and to receive delivery events needed to identify failures, bounces, or suppressions. Resend receives the recipient email address, the transactional message contents, and related delivery information necessary to provide that service.

Resend is used for order and service communications, not to build behavioural advertising profiles from customer activity.

Sentry

We use Sentry for application-error monitoring and limited performance diagnostics. Sentry may receive sanitized technical information associated with an error or performance event, such as a page path, runtime context, error message, or related diagnostic information. Our implementation is configured to exclude customer-identifying fields and request contents where possible.

Shipping and delivery providers

Where necessary to deliver a physical order, we may provide information such as your name, shipping address, and shipment details to postal, courier, or delivery providers.

Professional advisers and service providers

Where reasonably necessary, information may be provided to professional advisers, accountants, legal advisers, insurers, fraud-prevention providers, security providers, or other service providers acting for legitimate business or legal purposes.

Governmental, regulatory, and legal disclosures

We may disclose information if we reasonably believe disclosure is required or permitted by:

We may also disclose information where reasonably necessary to establish, exercise, or defend legal rights or protect customers, Don Yoku, or others from fraud, abuse, or security threats.

Business transfers

If Don Yoku is sold, reorganized, merged, transferred, or otherwise involved in a business transaction, information reasonably necessary to operate the business may be transferred as part of that transaction, subject to applicable privacy requirements.

10. Sale, sharing, targeted advertising, and profiling

Don Yoku does not currently:

Because we do not engage in these practices, there is currently no personal-information sale, targeted-advertising activity, or profiling activity for a customer to opt out of.

If these practices materially change, this Policy and any legally required opt-out mechanisms will be updated before or when required by law.

11. International processing and data transfers

Don Yoku is based in Canada.

Our service providers, including Stripe, Netlify, Resend, and Sentry, may process or store information in Canada, the United States, and other countries where they or their subprocessors operate.

This means personal information may be processed in a jurisdiction with privacy laws different from those where you live and may be subject to lawful access by courts, regulators, or government authorities in that jurisdiction.

Where the EU GDPR, UK GDPR, or another law imposes restrictions on international transfers, we will take measures required by applicable law.

Depending on the circumstances, those measures may include:

The exact mechanism may depend on the service provider, destination country, applicable law, and circumstances of the transfer.

12. How long we keep personal information

We aim to keep personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, accounting, tax, fraud-prevention, security, refund, chargeback, dispute-resolution, and recordkeeping requirements.

Different types of information have different retention periods.

A. Made-to-order commission information

While a made-to-order garment is being produced, we retain commission-specific information reasonably necessary to create and support the garment.

This may include:

When a commission has been completed, an authorized administrator marks the commission complete.

Commission-specific information that is no longer required is then scheduled for automatic deletion.

Don Yoku's system schedules this deletion at approximately 28 days after the commission is marked complete to provide operational margin within our stated maximum.

Commission-specific information is intended to be deleted no later than 30 days after the commission is marked complete, subject to circumstances in which continued retention is required or permitted by applicable law.

The completed-commission deletion process is designed to:

This process does not delete payment, shipping, tax, accounting, fraud-prevention, refund, chargeback, dispute, or other transaction records that Stripe, Don Yoku, or another provider may be required or permitted to retain.

Because deletion begins when a commission is marked complete, a commission that has not yet been marked complete continues to be retained while it is being produced and supported.

Customers may also request earlier deletion of commission-specific information after a commission is complete by contacting support@donyoku.ca.

B. Unclaimed, abandoned, removed, or replaced reference images

Reference images are uploaded when attached in the configurator, before payment necessarily occurs.

For reference images uploaded on or after August 29, 2026, when our automated reference-retention system was implemented, the image is given an automatic unclaimed-deletion deadline.

If the image never becomes associated with a paid Don Yoku order, it is scheduled for automatic deletion approximately 28 days after upload, allowing operational margin within our stated maximum.

An unclaimed reference image is intended to be deleted no later than 30 days after upload.

This may include an image that:

When Stripe confirms that an order containing the reference image has been paid, the reference is marked as belonging to a paid order so the unclaimed-image cleanup does not remove it while the commission remains active.

Once the paid commission is completed, the reference image is governed by the completed-commission deletion process above.

Reference images uploaded before August 29, 2026 may predate this automatic claim-and-cleanup system and may not contain the internal metadata necessary for safe automatic deletion. We do not automatically guess whether an older image belongs to a valid paid commission because doing so could delete information still needed for an existing order.

Deletion of an older image may be requested by contacting support@donyoku.ca.

C. Customer-service and privacy correspondence

Email and other correspondence you send us is retained for as long as reasonably necessary to answer your question, complete and support any related order, and keep a record of the matter.

Ordinary customer-service correspondence that is not attached to a transaction, a dispute, or a legal or regulatory obligation is generally retained for up to 24 months from our last exchange with you and is then deleted or otherwise disposed of.

Correspondence connected to an order, payment, refund, chargeback, dispute, or legal or regulatory matter is retained under the transaction and tax record periods described below.

Records of privacy requests, and of what we did in response, are retained for the period we are required or permitted to keep them in order to demonstrate compliance.

D. Browser-stored information

Information stored in your browser's localStorage or sessionStorage exists on your device rather than in Don Yoku's server-side reference-image storage.

Cart and commission-draft information may remain on your device until:

A commission draft may remain in your browser's local storage after an item has been added to the cart or after checkout has been completed. The made-to-order builder provides a reset control that clears the saved draft from your device.

Deleting server-side commission information does not remotely delete localStorage from your personal browser.

E. Transaction and tax records

Certain financial and business records may need to be retained substantially longer than commission-production information.

Where Canadian tax recordkeeping requirements apply, Don Yoku may retain required business and supporting records for the legally required period, which is generally six years from the end of the last tax year to which the records relate, and longer where law or a dispute requires it.

Information retained solely for legal, tax, accounting, fraud-prevention, refund, chargeback, or dispute purposes will not be used for unrelated purposes.

F. Security and technical records

Security or infrastructure logs may be retained for periods established by the relevant hosting or service provider and as reasonably necessary for security, troubleshooting, fraud prevention, and legal compliance.

G. Transactional email and diagnostic records

Transactional-email delivery records and application diagnostic records may be retained by Resend or Sentry according to our configured retention settings and their applicable service practices. We use those records only as reasonably necessary for email delivery, support, troubleshooting, security, and website reliability.

13. Security

We use reasonable technical and organizational safeguards appropriate to the nature of the information we process.

Measures used in the Don Yoku system include, where applicable:

No website, transmission system, payment system, or electronic storage method can be guaranteed to be completely secure.

Accordingly, we cannot promise absolute security.

14. Personal-data breaches

If we become aware of a personal-information breach, we will assess the nature and circumstances of the incident and take reasonable steps to contain, investigate, document, and remediate it.

Where applicable law requires notification to affected individuals, a privacy regulator, or another authority, we will provide notification in accordance with the applicable legal requirements.

We may also keep records of privacy and security incidents where required by law.

15. Your privacy rights — general

Depending on where you live and which law applies, you may have rights to:

These rights are not absolute. Applicable law may permit or require us to retain information for purposes such as completing a transaction, complying with law, maintaining tax records, preventing fraud, protecting security, or establishing or defending legal claims.

16. How to exercise your rights

Privacy requests may be submitted by email to:

support@donyoku.ca

or by post to:

Privacy Officer — Don Yoku
Aidan McQuay
149 Elgin Cres
Waterloo, Ontario N2J 2S5
Canada

Please describe the right you want to exercise and provide enough information for us to identify the information or order involved.

We may need to verify your identity before granting access, deleting information, or making another change so that we do not disclose or delete personal information belonging to somebody else.

Information collected solely for identity verification will be used for that purpose.

We will respond within the period required by the law applicable to the request.

Where legally permitted, we may deny or limit a request. If we do, we will provide the information about the decision or appeal rights that applicable law requires.

17. Canadian privacy rights

If you are in Canada, applicable federal or provincial privacy legislation may provide rights concerning your personal information.

Don Yoku follows privacy principles including:

You may request information about whether we hold personal information concerning you, how it has been used, and organizations to which it has been disclosed, subject to legal exceptions.

You may also request correction of information that is inaccurate or incomplete.

Where PIPEDA applies, requests for access are generally handled within 30 days, subject to legally permitted extensions and exceptions.

If you are dissatisfied with our handling of a privacy matter, please first contact the Privacy Officer — Don Yoku at support@donyoku.ca.

Depending on the applicable law and circumstances, you may also have the right to complain to the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator.

18. EEA / European Union privacy rights

If the EU GDPR applies to our processing of your personal data, you may have the following rights, subject to the conditions and exceptions provided by law.

Right to information

You have the right to receive transparent information about how your personal data is used.

Right of access

You may request confirmation of whether we process your personal data and obtain access to it.

Right to rectification

You may request correction of inaccurate information or completion of incomplete information.

Right to erasure

In qualifying circumstances, you may ask us to erase personal data.

Right to restriction

You may ask us to restrict processing in circumstances provided by the GDPR.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to obtain certain information you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller.

Right to object

You may object to processing based on legitimate interests in circumstances provided by law.

You have an absolute right to object to processing for direct marketing where applicable.

Don Yoku does not currently use customer information for behavioural direct marketing.

Withdrawal of consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing performed before withdrawal.

Automated decision-making

You may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Don Yoku does not currently make such decisions about customers.

Complaint rights

You may lodge a complaint with the data-protection supervisory authority in the EEA country where you live, work, or believe a violation occurred.

We encourage you to contact us first so we have an opportunity to address your concern.

19. United Kingdom privacy rights

If UK data-protection law applies, including the UK GDPR and Data Protection Act 2018 as amended, you may have rights including:

If you believe we have mishandled your personal information, you may contact the UK Information Commissioner's Office (ICO) where UK law gives you that right.

We encourage you to contact support@donyoku.ca first so we can attempt to resolve your concern.

20. Switzerland and other jurisdictions

If you reside in Switzerland or another jurisdiction with applicable privacy or data-protection legislation, we will honour the rights and obligations provided by that law to the extent it applies to Don Yoku and the relevant processing.

This may include rights of access, correction, deletion, information, objection, portability, or complaint.

Requests can be submitted to support@donyoku.ca.

21. United States state privacy rights

Residents of certain U.S. states may have rights under comprehensive state privacy legislation.

The exact rights, exemptions, applicability thresholds, response periods, and appeal procedures differ by state.

Where an applicable state law applies to Don Yoku, rights may include:

Sale, targeted advertising, and profiling

Don Yoku does not currently sell personal data or use customer information for targeted cross-site behavioural advertising.

Don Yoku does not currently conduct profiling in furtherance of decisions producing legal or similarly significant effects.

Accordingly, there is currently no such processing to opt out of.

Appeals

If the law of your state gives you the right to appeal a privacy-request decision, you may send an appeal to support@donyoku.ca with the subject line: Privacy Appeal.

We will review the appeal and respond as required by applicable law.

Authorized agents

Where applicable law permits an authorized agent to make a request on your behalf, we may request reasonable proof of the agent's authority and may take legally permitted steps to verify your identity.

22. California privacy disclosures

This section provides additional information for California residents.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies only when its statutory requirements and thresholds are met.

Regardless of whether Don Yoku currently meets every CCPA applicability threshold, the following disclosures describe our current practices.

Categories of personal information

During the preceding twelve months, depending on customer interactions, we may have collected or processed categories including:

Identifiers. Examples may include name, email address, shipping address, IP address, Stripe customer or Checkout Session identifiers, order numbers, and private reference-image identifiers. Sources include customers, Stripe, browsers/devices, and hosting infrastructure. Purposes include order fulfillment, customer service, security, fraud prevention, and legal recordkeeping.

California Customer Records information. This may include name, contact information, shipping address, billing-related information made available through Stripe, and transaction-related information.

Commercial information. This may include products purchased, purchase history, transaction information, commission specifications, order amounts, refunds, and related commercial information.

Internet or other electronic network activity. Our hosting and monitoring providers may process IP addresses, browser/device information, timestamps, requested resources, referral information, error information, performance diagnostics, and security logs resulting from website requests. We may use this information for website operation, aggregate traffic analytics, security, performance monitoring, and troubleshooting.

Approximate location information. Service providers may infer a general or approximate location from an IP address for security, fraud-prevention, operational, or aggregate analytics purposes. Don Yoku does not intentionally collect precise GPS location through the website.

Customer-provided content. This may include commission notes and optional reference photographs. We do not use reference photographs for biometric identification.

Categories we do not intentionally collect for profiling

Don Yoku does not intentionally collect or create customer profiles concerning race, religion, politics, medical conditions, sexual orientation, employment, education, or similar characteristics for advertising or profiling.

Categories of sources

Information may originate from:

Business or commercial purposes

Personal information may be used for the purposes described throughout this Policy, including:

Categories of recipients

Depending on the information and purpose, information may be disclosed to:

Sale and sharing

Don Yoku does not currently sell personal information.

Don Yoku does not currently share personal information for cross-context behavioural advertising.

We have not intentionally sold or shared customer personal information for cross-context behavioural advertising during the preceding twelve months.

We do not knowingly sell or share personal information of consumers under 16.

Sensitive personal information

Don Yoku does not use or disclose sensitive personal information for purposes intended to infer characteristics about consumers.

Complete payment-card credentials are collected and processed by Stripe rather than stored by Don Yoku.

California rights

Where the CCPA applies, California residents may have rights to:

Requests may be submitted to support@donyoku.ca.

Because Don Yoku operates primarily online and maintains a direct relationship with customers through the website and email, email is our primary privacy-request method unless another method is required by applicable law.

California Shine the Light

Don Yoku does not disclose customer personal information to third parties for those third parties' own direct-marketing purposes.

Do Not Track

Traditional browser “Do Not Track” signals do not change our ordinary functional processing because we do not currently operate third-party behavioural-advertising trackers.

Where a legally recognized opt-out preference signal applies to activity regulated by applicable law, we will process it as required.

23. Children and youth

Don Yoku is a general clothing store and is not designed as an online service directed specifically to children.

We do not knowingly collect personal information from children in circumstances prohibited by applicable children's privacy law, and we do not sell or share children's personal information for behavioural advertising.

Canadian federal privacy law does not set a single fixed age threshold, and we treat the personal information of a young person as sensitive.

Where Quebec's provincial privacy legislation applies, personal information of a minor under 14 is collected only with the consent of a person having parental authority, except where collecting it is clearly for the minor's benefit.

Where United States children's privacy law applies, we do not knowingly collect personal information online from a child under 13 without any legally required verifiable parental consent.

If we learn that we collected personal information from a child or young person in circumstances where legally required parental or guardian consent was not obtained, we will take appropriate steps to delete or otherwise address the information as required by law.

Where a young person is legally capable of providing meaningful consent for a particular processing activity, we aim to explain our information practices in reasonably understandable language.

A parent or guardian who believes a child provided information improperly may contact support@donyoku.ca.

24. Automated decision-making and artificial intelligence

Don Yoku does not currently use customer personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

We do not use customer reference images to train artificial-intelligence models.

We do not use automated systems to infer health, race, religion, sexual orientation, or other protected characteristics from customer photographs or measurements.

If we materially introduce this type of processing in the future, we will update our disclosures and provide any notices, consent mechanisms, assessments, or rights required by applicable law.

25. Changes to purposes

We will not use personal information for a materially new purpose that is incompatible with the purpose for which it was originally collected unless that use is permitted by law.

Where required, we will provide additional notice and obtain consent before using information for a new purpose.

26. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

The “Last updated” date at the top identifies the most recent revision.

If a change materially affects how personal information is collected, used, or disclosed, we will provide additional notice or obtain consent where required by law.

27. Contact us

Questions, privacy requests, access requests, correction requests, deletion requests, objections, complaints, or other privacy concerns may be sent to:

Privacy Officer — Don Yoku
Aidan McQuay
149 Elgin Cres
Waterloo, Ontario N2J 2S5
Canada
Email: support@donyoku.ca

We will review privacy requests and respond in accordance with applicable law.