Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how Duckpawl (“Duckpawl”, “we”, “us”, or “our”) collects, uses, shares, and protects your personal information when you visit duckpawl.com (the “Site”) or place an order with us. We’ve written it to match what our Site actually does — we sell a single product (an interactive treat dispenser for pets) and we try to collect as little about you as possible.

Who we are

Duckpawl is an online store based in Brampton, Ontario, Canada that ships to customers in the United States and Canada. It is operated by MOUR, a registered business name of Muhammad Zen Akhtar, who is the controller of the personal information described here. For any privacy question or request:

Operated by: MOUR, a registered business name of Muhammad Zen Akhtar
Email: info@duckpawl.com
Phone: +1 647-739-5724
Address: 89 Cherrytree Drive, Brampton, ON L6Y 3P1, Canada

Information we collect, and where

  • Orders & checkout. When you buy something, we collect your first and last name, email address, billing address, shipping address, and (optionally) your phone number, along with the details of what you ordered. You check out as a guest — we do not offer customer accounts, so we don’t ask you to create a username or password.
  • Payment information. Card payments are handled by Stripe. Your card number is entered into Stripe’s secure fields and tokenized by Stripe — we never see or store your full card details on our servers. Stripe shares back only what we need to recognize the payment (such as the card brand, last four digits, and authorization result).
  • Comments. If you leave a comment on the Site, we collect the information in the comment form (your name and email, and an optional website), the comment itself, and your IP address and browser user-agent to help detect spam. A one-way hashed version of your email address may be sent to the Gravatar service to display an avatar.
  • Analytics and advertising measurement. Unless you opt out (or, in the EEA, UK and Switzerland, until you accept), we use Google Analytics 4 to understand how visitors use the Site, including pages viewed and shopping actions (viewing the product, adding to cart, starting checkout, and completing a purchase), and advertising tags from Google and Meta to measure and target our ads. See Cookies, analytics & advertising below.
  • Server logs. Like most websites, our hosting keeps standard technical logs (IP address, browser/user-agent, and timestamps) to keep the Site secure and running.

Cookies, analytics & advertising

These tools run on the Site:

  • Google Analytics 4 (GA4), loaded through Google Tag Manager, to understand how the Site is used. It sets cookies named like _ga and _ga_<id> (up to ~13 months).
  • The Google Ads tag, loaded by our Google for WooCommerce integration, to measure purchases that come from our Google ads and to show our ads to people who have visited the Site (remarketing). It sets cookies such as _gcl_au (about 90 days), and at checkout it can send Google a hashed (one-way encoded) copy of your email address to match the purchase to an ad click.
  • The Meta Pixel, loaded by the Facebook for WooCommerce plugin, to do the same for our ads on Facebook and Instagram. It sets cookies such as _fbp and _fbc (about 90 days) and sends Meta hashed contact details with shopping events to help match them.

How consent works. We use Google Consent Mode v2:

  • In the United States, Canada and everywhere outside the EEA, UK and Switzerland, analytics and advertising measurement are on by default, and you can turn them off at any time (see Your choices below).
  • In the EEA, UK and Switzerland, Google Analytics and the Google Ads tag wait until you click Accept; until then Google may receive only an anonymous, cookieless signal that a page was viewed.
  • Choosing Decline turns off GA4, the Google Ads tag’s cookies and the Meta Pixel.

We remember your choice in a first-party cookie called dp_consent (about 12 months), and your Meta setting in wc_facebook_signals_state (about 12 months), so we don’t ask again on every visit.

Your choices. You can change your mind at any time using the Privacy choices button or the Cookie settings link at the bottom of every page (or by visiting /?dp-consent=reset), by clearing cookies in your browser, or by using your browser’s privacy controls. You can also install Google’s Google Analytics Opt-out Browser Add-on. For more on how Google handles data, see Google’s Privacy Policy and how Google uses information from sites that use its services.

How we use your information

  • To process, fulfil, and ship your order, and to send order confirmations and shipping/tracking updates.
  • To provide customer support and to handle returns and refunds (we offer free shipping to the US and Canada and a 21-day returns window).
  • To take payment and help prevent fraudulent transactions (via Stripe).
  • To keep the Site secure, available, and working correctly.
  • To understand how the Site is used and improve it, and to measure and target our advertising on Google and Meta — unless you opt out (in the EEA, UK and Switzerland, only if you accept).
  • To meet our legal, tax, and accounting obligations.

Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

  • Performance of a contract — to process and deliver the order you place.
  • Legal obligation — to keep tax and accounting records.
  • Legitimate interests — to secure the Site, prevent fraud, and operate our business, balanced against your rights.
  • Consent — for analytics and advertising cookies and tags, which you can withdraw at any time.

Who we share your information with

We share personal information only with the service providers needed to run the store, and only as much as they need:

  • Stripe — payment processing. See Stripe’s Privacy Policy.
  • Google — Google Analytics 4 and Google Tag Manager (analytics), the Google Ads tag (ad measurement and remarketing), Google Merchant Center (our product listing), and Google Fonts (font delivery). See Google’s Privacy Policy.
  • Meta Platforms — the Meta Pixel (ad measurement and remarketing on Facebook and Instagram). See Meta’s Privacy Policy.
  • Automattic / Gravatar — a hashed email to show comment avatars, if you comment. See Automattic’s Privacy Policy.
  • Shipping & fulfilment partners — our fulfilment partner in China and the carriers that deliver your order receive your name and shipping address.
  • Hosting & infrastructure providers — the companies that host and operate the Site on our behalf.

We may also disclose information if required by law, or to protect our rights, safety, or property. We do not sell or rent your personal information for money. Our use of the Google Ads tag and the Meta Pixel for ad measurement and remarketing may count as “sharing” for cross-context behavioral advertising under California law; you can opt out of it at any time with Privacy choices.

International data transfers

We are based in Canada, and some of our providers (such as Google and Stripe) operate globally. Your order is also dispatched from China by our fulfilment partner, who receives your name and shipping address in order to deliver it. Where personal information is transferred outside your country, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses or the providers’ own approved transfer frameworks.

How long we keep your information

  • Orders are retained for as long as needed to provide the product and support, and to meet legal, tax, and accounting requirements.
  • Analytics data is retained according to our Google Analytics settings (currently up to 14 months); advertising data is kept by Google and Meta under their own policies.
  • Cookies expire on their own — the dp_consent and wc_facebook_signals_state choice cookies after about 12 months, Google’s _ga cookies after up to ~13 months, and the Google Ads and Meta advertising cookies after about 90 days.
  • Comments and their metadata are kept until you ask us to remove them.

Security

We use reasonable technical and organizational measures to protect your information, our live site is served over HTTPS, and card data is handled by Stripe, a PCI-DSS Level 1 certified provider, rather than stored by us. No method of transmission or storage is ever 100% secure, but we work to protect your information and to limit what we collect.

Children’s privacy

The Site is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

Your rights (EEA/UK — GDPR)

If you are in the EEA or UK, you have the right to:

  • access the personal information we hold about you;
  • have inaccurate information corrected;
  • have your information erased;
  • restrict or object to certain processing (including processing based on legitimate interests);
  • receive your information in a portable format;
  • withdraw consent to analytics at any time; and
  • lodge a complaint with your local data-protection supervisory authority.

Your rights (California — CCPA/CPRA)

If you are a California resident, you have the right to know/access the personal information we collect, to request deletion, to request correction, and to opt out of the “sale” or “sharing” of personal information. We do not sell personal information for money. Our advertising tags (the Google Ads tag and the Meta Pixel) may amount to “sharing” for cross-context behavioral advertising as the CCPA/CPRA defines it; to opt out, use the Privacy choices button at the bottom of any page and choose Decline, or email us. You also have the right not to be discriminated against for exercising your rights. The categories of personal information we collect are: identifiers (such as name and email), commercial information (your orders), internet activity (analytics and advertising events, unless you opt out), and approximate geolocation (the region of your shipping address). We do not sell or share sensitive personal information.

How to exercise your rights

Email us at info@duckpawl.com and tell us what you’d like to do. We may need to verify your identity (for example, by confirming the email address used on an order) before we act, and we’ll respond within the timeframe required by law. You may use an authorized agent where the law allows.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll revise the “Last updated” date at the top, and any material changes will be reflected on this page.

Contact us

Questions about this policy or your information? Contact us — we’re a small business and happy to help:

Operated by: MOUR, a registered business name of Muhammad Zen Akhtar
Email: info@duckpawl.com
Phone: +1 647-739-5724
Address: 89 Cherrytree Drive, Brampton, ON L6Y 3P1, Canada

Scroll to Top