Privacy Policy

When you create a Nomikai account we collect your name, email address, password (stored as a salted hash, never in plain text), shipping address, and date of birth. Date of birth is required to verify that you meet the legal drinking age in your province.

To comply with Ontario law and the AGCO's requirements for alcohol sales, we collect a photo of government-issued identification during registration. ID images are stored encrypted at rest, accessed only by authorized staff conducting verification, and are deleted in accordance with our retention schedule below.

When you place an order we collect the items purchased, delivery address, order total, and timestamp. Payment card information is collected and processed by our payment processor (Stripe) — Nomikai never sees or stores your full card number, CVV, or expiry.

If you contact us through the site, by email, or by completing forms (e.g., wholesale inquiry, contact form), we retain the message and any information you provide so we can respond and maintain a record of the conversation.

We use Google Analytics 4 to understand how visitors use the site (pages viewed, session duration, device type, referrer). Google Analytics uses cookies and may collect anonymized IP address and behavioural data. We do not use Google Analytics to identify individuals.

Processing payments, arranging delivery, sending order confirmations and shipping updates, and providing customer support related to your purchases.

Verifying age and identity as required by the AGCO and the Liquor Licence and Control Act, 2019; retaining transaction records as required by the Canada Revenue Agency; responding to lawful requests from regulators or law enforcement.

Authenticating you, detecting suspicious activity, enforcing session timeouts, and protecting against unauthorized access.

Understanding which pages, products, and features are used so we can prioritize improvements. Aggregated analytics only — we do not use this data to make decisions about individual users.

Sending you order confirmations, delivery notifications, account security alerts, and other operational emails directly related to your use of the service.

Payment card information is collected and processed directly by Stripe, a PCI-DSS Level 1 certified processor. Stripe handles authorization, capture, and refunds. Their privacy policy is available at stripe.com/privacy.

Page views and session data are sent to Google Analytics 4. Google may process this data in the United States. You can opt out site-wide using Google's GA Opt-Out browser add-on (tools.google.com/dlpage/gaoptout) or by blocking analytics cookies in your browser settings.

To deliver your order we share the recipient name, delivery address, contact information, age-verification requirement, and parcel details with our delivery partner. Current delivery vendors are available on request — email us at the address below.

We may use third-party services to assist with reviewing and verifying government-issued identification. Current verification vendors are available on request.

We use providers for email delivery, error monitoring, and infrastructure (cloud hosting). These providers process data only on our instructions and only as needed to provide the service to you. Names available on request.

We may disclose personal information when required by law, court order, or regulatory authority — including the AGCO, the LCBO, the CRA, or law enforcement acting under a valid warrant.

Retained for as long as your account is active. If you close your account, we delete account profile data within 30 days, except where retention is required by law (see Order data below).

Retained for 7 years from the date of the transaction to comply with Canada Revenue Agency tax record requirements and AGCO record-keeping obligations for alcohol sales.

ID images are retained only as long as needed to complete verification, plus a limited audit window required by the AGCO. They are then securely deleted from our systems.

Customer support messages and inquiry submissions are retained for 3 years to provide context for follow-up and to meet regulatory record-keeping obligations.

Google Analytics 4 retains event-level data per Google's default retention setting (14 months at the time of writing). Aggregated reports may be retained longer.

You may request a copy of the personal information we hold about you. We will respond within 30 days as required by PIPEDA.

You may request that we correct inaccurate or incomplete personal information.

You may withdraw consent to our use of your personal information at any time, subject to legal and contractual restrictions and reasonable notice. Note that withdrawing consent for required uses (e.g., age verification) means we will no longer be able to provide the service.

You may request deletion of your account and associated personal information. We will delete what we are able, but we are required to retain transaction records for tax and regulatory purposes (see Retention above).

If you believe we have mishandled your personal information you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or with the Information and Privacy Commissioner of Ontario at ipc.on.ca.