Privacy

Last updated October 18, 2026

Who we are

FN Keys Ltd. is based in Saskatchewan, Canada. Chevez Ezaneh, the owner, is responsible for your personal information. Questions, requests or concerns: [email protected].

What we collect

• Orders and quotes: your name, email, phone, school or organization, shipping and billing address, what you ordered, how you paid, and any notes you add.
• Purchase orders: the PO file if you upload one.
• First Nations tax exemption: your First Nation, reserve, and status card details or your band's exemption letter. We keep what the Canada Revenue Agency requires as proof of an exempt sale. A photo of a status card is deleted once we have checked it.
• Accounts: your email, name, saved addresses and order history. Passwords are never stored, only a scrambled version that cannot be turned back into your password. If you use a passkey, we store only its public key. If you sign in with Google, we receive your name, email and a Google account ID.
• Requests: messages you send us about an order, such as a return or a problem report.
• Card payments: handled by Square. We never see or store your card number. We keep Square's payment ID and receipt link with your order.
• Security: your IP address is used briefly to block spam and repeated sign-in attempts.
• Visits: anonymous page views and steps such as "added to cart", with a random ID that lasts only for that browser tab, plus the reason you choose if you answer "Not ordering today?". We do not use advertising or tracking cookies, and this is never linked to your name.

How we use it

To process and ship orders, send invoices, receipts, quotes and shipping updates, answer your requests, apply tax correctly, keep the site secure, and understand whether the site is working for visitors. We do not send marketing email, and we do not sell, rent or trade your information.

Who helps us run the store

We share only what each service needs to do its job:

• Cloudflare hosts the website, stores order and account data and uploaded files, and checks that visitors are not bots.
• Square processes card payments.
• Resend delivers our emails.
• ShipEngine and the shipping carrier receive your address to calculate rates and deliver your order.
• Google handles sign-in, only if you choose Continue with Google.

Some of these companies store or process information outside Canada, including in the United States, where it may be subject to local laws. We may also share information when the law requires it.

Cookies and browser storage

A cookie keeps you signed in to your account. Your browser also remembers your cart and, for a single tab, a random visit ID. The bot check may set its own cookie. None of these are used for advertising.

How long we keep it

• Orders, invoices and tax exemption records: 6 years, as Canadian tax law requires.
• Files uploaded at checkout but never attached to an order: deleted after 3 days.
• Records of sign-in attempts: deleted after 2 days.
• Accounts: until you ask us to delete yours. Order records we must keep for tax purposes stay after an account is deleted.

Your choices and rights

You can order without an account. You can see and update your details in your account, or email [email protected] to get a copy of your information, correct it, or delete your account. We reply within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Security

The site uses encrypted connections, the admin area is protected by sign-in, and only the owner can see orders and uploaded documents. No system is perfect, but if a breach puts you at real risk, we will tell you and report it as the law requires.

Changes

If this policy changes, we will update it here and change the date at the top.