🚚 No Tax + Free Shipping on $99+ | 🇨🇦 Canadian owned — ships from Canada
Last updated: September 6, 2026
BorealVapes ("we", "our", "us") is committed to protecting the privacy of our customers and visitors. This Privacy Policy describes how we collect, use, disclose, and protect your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
We collect the following types of information:
Name, email address, phone number, and language preferences when you create an account or place an order.
Shipping address, postal code, province, order details, and transaction history.
Payments are processed securely via Interac e-Transfer, Bitcoin (BTCPay), and — when available — our third-party card processor. We do not store full credit card numbers on our servers.
We collect age verification confirmation to comply with Canadian tobacco and vaping product laws. You must be of legal age to buy vaping products in your province to use this site.
We implement appropriate technical and organizational security measures to protect your personal information, including SSL/TLS encryption for all data transmissions, secure access controls, and regular security audits.
We do not sell your personal information. We may share your information with trusted third-party service providers who help us operate our business (payment processors, shipping carriers), government authorities when required by law, and professional advisors (legal, accounting) as needed.
Under PIPEDA, you have the right to:
We use cookies and browser local storage for sign-in, language preferences, age confirmation, the cart and your privacy choice. This browser data stays on your device until it expires or you clear it in browser settings.
Plausible and, when configured, PostHog provide optional statistics about visits and site usage. They load only after you choose to accept analytics. Essential Only leaves them disabled. PostHog may use its own browser storage when enabled.
You can change your choice at any time using Privacy settings in the footer. Withdrawing permission stops future optional collection; it does not retroactively erase data already transmitted.
Fraud prevention and security may use IP addresses, browser and device details, referrers and approximate geographic region. When error diagnostics are configured, technical error details may be sent to Sentry to investigate failures. These diagnostics are separate from optional visit analytics.
Account deletion removes profile contact details, erases or anonymizes personal information linked to the account and stops associated subscriptions. Some transaction identifiers, amounts and line items remain in financial records.
If ownership of your email address has been verified for the account, deletion also handles eligible records linked only to that address and retains one minimal inactive email entry to suppress future newsletter messages. Without that verification, email-only records and newsletter consent are not changed. Contact [email protected] to request their handling with proof that you own the address. Historical records linked only to an unverified phone number also require a verified support request.
This operation covers local account-linked data. It does not automatically erase delivered messages, in-flight provider requests, uploaded files, backups, hosting logs or copies held by payment and delivery providers. Those require separate handling under the applicable retention practices. For questions about retained information or further deletion requests, contact [email protected]; identity verification may be needed.
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at: [email protected]
