Privacy policy

Last updated: 23 June 2026

This Privacy Policy explains how Roomlift ("we", "us", "our") collects, uses, and protects your personal information when you visit getroomlift.com and make a purchase. We comply with Canada's PIPEDA, the EU/UK GDPR, the California CCPA/CPRA, and the Australian Privacy Principles.

1. Who we are

Roomlift is a registered Ontario sole proprietorship, operated from Ontario, Canada. The owner-operator is the data controller for personal information collected via this website.

Contact: support@getroomlift.com

2. What we collect

Order information: name, shipping and billing address, email, phone, products ordered.
Payment information: processed directly by Shopify Payments, PayPal, Apple Pay, Google Pay, and Shop Pay. We never see or store your full card number.
Account information (if you create an account): email, password (hashed), order history.
Communications: if you email us, we keep your messages so we can respond and review past tickets.
Website analytics: pages visited, device type, approximate location (city/country), referring source. Collected via Shopify Analytics, Microsoft Clarity (heatmaps, anonymized), and our advertising pixels (see Section 5).
Marketing preferences: email and SMS subscription status if you opt in.

3. Why we collect it (lawful basis)

To fulfill orders — contract performance (GDPR Art 6(1)(b)).
To send order updates — contract performance.
To respond to support requests — legitimate interest (Art 6(1)(f)).
To send marketing emails — only with your consent (Art 6(1)(a) and CASL implied or express consent).
To run analytics and improve the site — legitimate interest, with the option to opt out via our cookie banner.
To comply with tax and accounting law — legal obligation (Art 6(1)(c)).

4. Who we share it with

We do not sell or rent personal information. We share only with vendors who need it to perform a service for us:

Shopify Inc. — store hosting, checkout, payment processing
PayPal, Stripe (via Shopify Payments) — payment processing
Zendrop / fulfillment partners — to ship your order
Klaviyo — email marketing (only if you opted in)
Microsoft Clarity — anonymized heatmaps and session recordings
Meta (Facebook/Instagram), TikTok, Google — advertising pixels and conversion tracking (where consent is given)
Cloudflare — DNS, email routing, DDoS protection
Government agencies — only where required by law (e.g. CRA for tax remittance)

5. Cookies and tracking technologies

We use first-party cookies for essential functions (cart, login, language preference) and third-party cookies for analytics and advertising. Our cookie banner lets you accept, reject, or customize categories. You can withdraw consent any time via the banner's "Cookie Settings" link in the footer.

Specific tools that may set cookies:

Shopify Analytics (essential + analytics)
Microsoft Clarity (analytics, anonymized)
Meta Pixel + Conversion API (advertising — opt-in only)
TikTok Pixel + Events API (advertising — opt-in only)
Google Analytics 4 (analytics — opt-in only)
Klaviyo (marketing — opt-in only)

6. Where we store it

Personal data is stored on Shopify's servers (primarily United States and Canada), and on the servers of the vendors listed above. We have data-processing agreements in place where required. For EU/UK transfers, vendors rely on Standard Contractual Clauses or adequacy decisions.

7. How long we keep it

Order records: 7 years (Canadian tax requirement)
Marketing list membership: until you unsubscribe
Support emails: 3 years from last contact
Analytics data: 14 months (Shopify default)

8. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion ("right to be forgotten")
Restrict or object to processing
Data portability (receive your data in a portable format)
Withdraw consent for marketing at any time
Lodge a complaint with your local privacy regulator (in Canada: the Office of the Privacy Commissioner; in the EU: your national DPA; in the UK: the ICO; in California: the CPPA)

To exercise any of these rights, email support@getroomlift.com. We respond within 30 days.

9. California residents (CCPA/CPRA)

You have the right to know what categories of personal information we collect, to delete it, to correct it, to opt out of "sale" or "sharing" of personal information, and to limit use of sensitive personal information. We do not sell personal information for money. We may share advertising identifiers with Meta/TikTok/Google for cross-context behavioral advertising — you can opt out via the cookie banner. Authorized agents may submit requests on your behalf with proper verification.

10. Children

Roomlift products are intended for adult home use. We do not knowingly collect personal data from anyone under 16. If we learn we have, we will delete it.

11. Security

We use industry-standard safeguards including TLS encryption in transit, encryption at rest where vendors offer it, role-based access on our admin systems, and strong unique passwords with 2-factor authentication on owner accounts. No system is perfectly secure — if you believe your account or data has been compromised, contact us immediately.

12. Changes to this policy

We may update this policy as our business or the law evolves. We will note the "Last updated" date at the top. Material changes will be emailed to anyone subscribed to our list.