1. Who we are
Coral Soft Bake ("we", "our", "us") operates the ordering, inventory, and production management platform at coralsoftbake.com. We are a software-as-a-service (SaaS) provider serving bakery businesses in Canada.
Our principal office is located at 3-775 Lampson St, Victoria, BC V9A 6A9, Canada. Company ID: 15236473.
For privacy inquiries, contact us at info@coralsoftbake.com.
2. Our role under privacy law
For the purposes of PIPEDA (Canada) and BC PIPA (British Columbia):
- Coral Soft Bake is a "data processor" (in PIPEDA terms, an "organization processing on behalf of another organization") for data belonging to the end customers of our bakery Clients.
- Each bakery Client is the "data controller" of its own customers' personal information.
- End customers with privacy questions or requests regarding their data should direct them to the bakery they order from — not to Coral Soft Bake.
3. Data we collect
3.1 About our bakery Clients (B2B relationship)
- Business name, address, contact information.
- Administrator user accounts (names, emails, hashed passwords).
- Billing information (invoicing details, payment records).
- Technical support communications.
3.2 About end customers (processed on behalf of Clients)
We store and process the following data only on the instructions of the bakery Client whose platform the end customer uses:
- Contact information provided to the bakery (name, email, phone, delivery address).
- Order history (products ordered, quantities, dates, prices).
- Account credentials for the bakery's ordering portal.
We do not collect this data directly from end customers — it is entered into the Platform by the bakery Client or by the end customer on the bakery's portal. We act strictly as the hosting infrastructure.
3.3 Technical data (automatic collection)
- IP addresses, browser type, device type, operating system.
- Session cookies required for authenticated access.
- Server logs retained for 90 days for security purposes.
3.4 Data we do NOT collect
- Credit card numbers, CVV, or full payment credentials. All payment processing is handled directly by PCI-DSS Level 1 certified processors (when a bakery chooses to integrate one). Payment data never touches our servers.
- Sensitive personal data (health, religion, ethnicity, etc.) — our Clients' business does not require this information.
4. How we use data
4.1 Bakery Client data
- To provide the Platform service (hosting, authentication, data storage).
- To communicate about service, billing, and technical support.
- To comply with legal obligations (tax, audit).
4.2 End-customer data
We use end-customer data only for the following purposes, on behalf of the bakery Client:
- Storing and serving the data through the Platform as configured by the Client.
- Processing orders as instructed by the Client.
- Generating reports requested by the Client.
- Maintaining backups as part of the hosting service.
We do not use end-customer data for our own purposes, including marketing, analytics, or any secondary use.
5. Data sharing
We do not sell, rent, or trade personal data. We share data only in these limited circumstances:
- With the bakery Client whose platform the data belongs to — this is the primary purpose of the service.
- With infrastructure sub-processors (hosting, backups) under written data-processing agreements. Current sub-processors: GoDaddy (hosting), Cloudflare (CDN/security).
- With law enforcement or courts when legally required. We will notify the affected Client where legally permitted.
6. Data retention
- Client business data: for the duration of the subscription + 90 days after termination (to allow data export).
- End-customer data: retained per the Client's instructions; deleted within 90 days of Client termination unless the Client instructs otherwise.
- Billing records: 7 years (CRA tax requirements).
- Server logs: 90 days.
7. End-customer privacy rights
If you are an end customer of a bakery that uses the Coral Soft Bake Platform, your privacy rights (access, correction, deletion, complaint) should be directed to the bakery itself, which is the data controller of your information.
When a bakery Client submits a valid request on behalf of its end customers, we will comply within the timeframes required by law. We cannot act on end-customer requests directly, as we process data only on the Client's instructions.
If a bakery is unresponsive to your privacy request, you may contact us at info@coralsoftbake.com and we will facilitate communication.
8. Bakery Client privacy rights
Bakery Clients have the right to:
- Access their own business data and configuration.
- Correct inaccurate data.
- Export their data at any time during the subscription.
- Request deletion upon termination (subject to the 90-day export window).
9. Security
We protect data through:
- TLS 1.2+ encryption for all connections (HTTPS).
- Prepared SQL statements to prevent injection attacks.
- CSRF tokens on all forms.
- Bcrypt password hashing.
- Multi-tenant data isolation (each Client's data is strictly segregated).
- Daily off-site encrypted backups.
- Regular security reviews.
10. Cookies
We use only essential session cookies required for authenticated access to the Platform. We do not use tracking cookies, advertising cookies, or third-party analytics cookies on the Platform itself. Our public marketing website may use basic analytics, which can be disabled via browser settings.
11. International transfers
Our Platform is hosted in Canada and the United States. Data may be processed in these jurisdictions, which have been recognized as providing adequate privacy protection under Canadian law.
12. Payment Processing (Optional)
Some bakery clients choose to integrate online payment processing into their ordering portal. This is always the bakery's independent business decision.
Coral Soft Bake:
- Does not promote or recommend specific payment processors.
- Does not process, store, or handle payment card data.
- Acts only as a technical integrator when a bakery requests payment functionality.
- Connects the bakery's portal to their chosen payment processor via secure APIs or hosted checkout.
When payment processing is integrated:
- Customers enter payment information directly on the payment processor's secure platform.
- Payment data never passes through Coral Soft Bake's servers or databases.
- The payment processor is the data controller for payment information.
- The bakery maintains a direct contractual relationship with their payment processor.
- Coral Soft Bake receives only transaction confirmation (success/failure) without card details.
Each bakery is responsible for selecting their payment processor, negotiating terms, and ensuring compliance with payment industry standards (PCI DSS). Coral Soft Bake provides technical integration support only.
13. Children's privacy
Our Platform is designed for business-to-business commerce. We do not knowingly collect data from children under 16. If you believe a child's data has been entered into the Platform, please contact the bakery Client or us, and we will delete it.
14. Changes to this policy
We may update this Privacy Policy occasionally. Material changes will be communicated to bakery Clients with 30 days' notice. The "Last updated" date at the top reflects the most recent revision.
15. Regulatory oversight
You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (oipc.bc.ca).
16. Contact
Privacy inquiries — please direct to the appropriate party:
- Bakery Clients (B2B relationship): info@coralsoftbake.com
- End customers: please contact your bakery directly. Our contact: info@coralsoftbake.com (we will route to your bakery).
- Mail: Coral Soft Bake, 3-775 Lampson St, Victoria, BC V9A 6A9, Canada.
- Response time: within 30 days as required by PIPEDA.