Privacy Policy

1. Information we collect

We collect information you give us and information collected automatically when you use our website.

• Contact and enquiry details you submit through our forms: your name and contact person, company name, email address, phone number, group/team size, preferred date, and any special requirements you choose to share.
• Booking details when you reserve an experience: the experience booked, ticket count, amount paid, and a payment reference.
• Payment information: card payments are collected and processed directly by our payment provider, Stripe. We do not receive or store your full card number.
• Newsletter sign-ups: the email address you provide to receive updates.
• Automatically collected data: we and our analytics providers collect usage and device information — such as pages viewed, approximate location, browser and device type, and interactions — using cookies and similar technologies.

2. How we use your information

• To process bookings and payments and send confirmations and service messages.
• To respond to enquiries and provide customer support.
• To operate, secure, and improve our website and experiences.
• To send marketing emails where you have signed up or otherwise consented — you can unsubscribe at any time.
• To meet legal, tax, accounting, and safety obligations.

3. Our legal basis (consent)

We rely on your consent to collect, use, and disclose your personal information for the purposes described here, and on the other bases permitted by PIPEDA (such as completing a transaction you requested or meeting a legal obligation). You may withdraw consent for non-essential uses at any time, subject to legal or contractual limits.

4. How and with whom we share your information

We do not sell your personal information. We share it only with service providers that help us run our business, and only as needed for them to perform their services under contract:

• Stripe — payment processing.
• Convex — application database and backend hosting.
• Vercel — website hosting, plus Vercel Analytics and Speed Insights.
• PostHog — product and usage analytics.
• Resend — sending transactional and notification emails.
• Eventbrite and Luma — where you choose to book through those ticketing platforms.

We may also disclose information when required by law, to enforce our Terms of Service, or to protect the rights, safety, and property of participants, the public, or ARK. If our business is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

5. Cookies and analytics

We use cookies and similar technologies to keep the site working, remember preferences, and understand how the site is used through our analytics providers. You can control cookies through your browser settings; disabling some cookies may affect how the site functions.

6. How we protect your information

We use technical and organizational safeguards appropriate to the sensitivity of the information, including encryption of data in transit (HTTPS), access controls, and reputable service providers. Card data is handled by Stripe under the PCI-DSS security standard. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Data retention

We keep personal information only as long as needed for the purposes described here or as required for legal, tax, and accounting reasons, after which we securely delete or anonymize it. You can ask us to delete information we are not required to keep.

8. Storage and international transfers

Some of our service providers store or process data outside Canada, including in the United States. Where information is transferred internationally, it may be subject to the laws of those jurisdictions, and we take reasonable steps to ensure it remains protected.

9. Your privacy rights

Under PIPEDA you may:

• Request access to the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw consent to non-essential uses, or unsubscribe from marketing emails.
• Ask us to delete information we are not legally required to retain.

To make a request, email team@funwithark.ca. We may need to verify your identity before acting. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

10. Children's privacy

Our website and bookings are intended for adults. We do not knowingly collect personal information directly from children under 13 without parental consent. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the current version here with a new “last updated” date, and material changes take effect when posted.

12. Contact us

For privacy questions or requests, contact Create Club at team@funwithark.ca, +1 (647) 839-8849, or 28 Eastern Avenue, Unit 534, Toronto, ON M5A 0Y2, Canada. See our Support page for more ways to reach us.