Privacy Policy
Last updated: November 10, 2026
LEO Hardware Inc. uses personal information to operate our storefront, fulfil orders, provide account and support features, and run the optional community and part-identification tools described below.
1. Information we collect
Account, contact, billing, shipping and order information you provide.
Cart, wishlist, return, customer-service and newsletter information.
Forum questions and replies, product reviews, Property Book records, and photos, videos or documents you choose to upload.
Security and operational information such as IP address, browser type, request time, consent choices and error records.
Optional page-view and storefront performance events only after you select “Allow analytics”: the page visited, the referring site, and your device type, browser and approximate location. These events use no cookies, and search text, URL query values and one-time link codes are removed before those third-party events are sent.
Unless you decline analytics: the words typed into our product search, with how many results they matched, so we can decide which products to stock. Entries that look like personal details (an email address or a long number) are discarded in your browser before anything is sent, and the stored counts are not linked to your account, and are not stored with your IP address.
2. How we use information
To price, process, deliver, recover and support carts and orders.
To authenticate customers, administer Net Terms, returns, wishlists and Property Book organizations.
To moderate and publish approved forum and review content.
After an order ships, to email you once (plus at most one reminder) asking you to review what you bought. The email’s review buttons are personal to you and work without an account. Every request includes an unsubscribe link, and we honour the review-email preference on your account if you have one.
To identify hardware from a submitted photo when you expressly request and consent to that service.
To prevent fraud and abuse, enforce usage limits, diagnose failures and improve reliability.
To count product searches (including searches that returned nothing) so we can decide which products to stock.
3. Service providers and disclosures
We do not sell personal information. We disclose information to providers only as needed for the requested service, legal compliance, security, or business operations:
BigCommerce provides catalog, customer, cart, order, newsletter and hosted-checkout services. Payment information is handled in the hosted checkout by BigCommerce and the configured payment provider.
Vercel hosts the storefront and, only after analytics consent, receives the privacy-limited page-view and performance events described above (Vercel Web Analytics and Speed Insights).
Supabase stores server-managed forum, review, visual-search, contractor-request and Property Book data, uploaded files, and the unlinked product-search counts described above.
Cloudflare Turnstile processes verification and network information to prevent automated abuse on protected forms.
Resend delivers transactional and service emails.
Google and Apple process information when you choose their sign-in service. Google Places or Maps may process a property address when you use an address or Street View feature.
For Find a Part by Photo, the provider named beside the consent control (Google Gemini for the public service; approved OpenAI or Anthropic models for staff evaluation) receives an EXIF-stripped, resized image and the product context needed to return suggestions.
Shipping carriers and professional advisers receive information where necessary to deliver orders or meet legal and accounting obligations.
Some providers process information outside Canada and protect it under the laws and contractual safeguards applicable to their services.
4. User content and photo identification
Forum posts and product reviews are submitted for moderation and, if approved, are public. Reviews show your first name and last initial. The relevant form asks you to agree before submission. Do not upload personal, confidential or unnecessary information.
Find a Part by Photo requires a separate unchecked consent for every submission. We remove image metadata and resize the image. The processed private image may be retained in Supabase for no more than 180 days to provide the result and improve identification quality, then a daily deletion worker removes it. A failed deletion remains queued and creates an operational alert rather than being reported as complete.
5. Find a Contractor referrals
When you ask us to find a contractor, we collect your name, email address, phone number, postal or ZIP code and the services you need, plus any job details you choose to add: property type, how many, timing, how you prefer to be contacted, a description and up to 6 photos. If no LEO Vetted Pro works in your area yet, the waitlist asks only for your name, email address, an optional phone number, your area and the services you need.
Pros we ask about your job see the job details, the description, your photos and your general area (the first three characters of a Canadian postal code, or a US ZIP code). They do not see your name, phone number, email address or full postal code, and we remove anything in your description that looks like them. We may ask more than one pro, one at a time, until one takes the job.
The pro we introduce you to receives your name, phone number, email address, full postal code, the job details and your photos, so they can contact you and quote. We send you their contact details in the same introduction. The introduction may include photos of the pro's past work, supplied by the pro and shared with their permission.
We work out your area on our own servers from public Statistics Canada and US Census Bureau data. Your postal or ZIP code is not sent to a mapping service.
We remove location and other metadata from every photo and resize it before storing it privately in Supabase. Pros see photos only on a private page, through links that expire. We delete your photos automatically 6 months after you send the request.
The form records the exact wording you agreed to and when. The current versions are 2026-11-09.v2 for a request and 2026-11-09.w1 for the waitlist. We use your details only for this request and do not add you to a mailing list.
We keep the rest of the request, and the record of which pros we asked and introduced, while it is useful for follow-up and our records. You can ask us to delete it sooner (see section 8).
6. Cookies and local storage
Necessary cookies support authentication, cart recovery, security and private account features. A local-storage preference remembers whether you allowed optional analytics; declining also stops search-term counting. Session storage briefly remembers which search terms were already counted so one visit is never counted twice. Declining analytics does not disable shopping, checkout or account functions. Turnstile is loaded when you use a protected form.
7. Retention and deletion
Order and accounting records are retained for business and legal requirements. Public forum and review content is retained until it is removed through moderation or an approved deletion request. Unfinished review-upload sessions are scheduled for cleanup after 24 hours. Product-search counts are deleted after 365 days, and the short-lived network identifier used to rate-limit them after 2 days. Find a Contractor photos are deleted 6 months after the request. Other support, security and operational records are kept only as long as reasonably needed for their purpose.
8. Your choices and requests
You can decline optional analytics, avoid optional uploads, unsubscribe from marketing and review-request emails, and request access, correction or deletion where applicable. Some order or legal records cannot be deleted immediately. Contact brett@leohardware.ca or use our contact form. You may also request early deletion of a visual-search photo or of a Find a Contractor request and its photos.
9. Security and children
We use access controls, encryption in transit, rate limits and restricted service credentials, but no system can guarantee absolute security. Our services are not directed to children; a parent or guardian can contact us about information submitted by a child.
10. Changes
We may update this policy as our services or providers change. The date above identifies the current version.