Privacy policy
Routes & Burrows sells printable materials for school bus drivers. This policy explains what personal information the store collects, why, who it is shared with, and what you can ask us to do with it. It covers routesandburrows.ca and every page under it.
1. The short version
- There are no accounts, no passwords, and no customer database.
- We ask for an email address so we can send your download links, plus a name and — only if you are buying on a purchase order — an organization and PO number.
- Card details go straight to Stripe. They never touch our servers.
- We do not use advertising trackers, and we never sell or rent personal information.
- We never receive the pages you fill in. Student names stay with you.
2. What we collect
Order information. At checkout we collect your email address and name. If you tick the purchase-order option, we also collect your organization name and PO number so Stripe can raise an invoice you can file.
Payment information. Payments are handled by Stripe on Stripe's own hosted checkout page. We do not see, receive, or store your card number, CVC, or expiry date. Stripe returns a payment status, an order reference, and the email address associated with the payment.
Technical information. Our hosting provider records ordinary web-server data for each request — IP address, browser user agent, page requested, timestamp, and response status — in short-lived application logs used for debugging and abuse prevention.
Cookies. The store sets one strictly necessary cookie, .RoutesAndBurrows.Session, which holds your shopping cart while you browse. It is HTTP-only, expires with your session, and carries no advertising or analytics identifier. Stripe sets its own cookies on Stripe's checkout page under Stripe's privacy policy. We do not run Google Analytics, advertising pixels, or third-party tracking scripts.
Fonts. Page typefaces are served by Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com. Google receives your IP address and user agent as part of that request.
3. What we do not collect
- No account profiles, passwords, or purchase histories tied to a login — there are no logins.
- No card, bank, or government identification numbers.
- No location tracking, device fingerprinting, or cross-site advertising identifiers.
- No content from completed pages. Seating charts, route sheets, and logs are printed and filled in by you, offline. Nothing you write on them is transmitted to us.
4. Why we use it
- To fulfil your order — take payment, generate your download links, and deliver the files.
- To support you — answer questions about an order, resend a link, or resolve a payment problem.
- To meet legal and tax obligations — sales and tax records kept by our payment processor.
- To keep the store working — diagnose errors, and detect fraud or abuse of download links.
Where consent is the basis for processing — for example, joining the Burrows mailing list — you may withdraw it at any time, and every message we send includes an unsubscribe link.
5. Who we share it with
We share personal information only with the service providers needed to run the store, and only for that purpose. We do not sell, rent, or trade personal information, and we do not disclose it for cross-context behavioural advertising.
- Stripe, Inc. — payment processing, invoicing, and fraud prevention. Stripe is the controller of the payment data it collects. See the Stripe privacy policy.
- Postmark (ActiveCampaign, LLC) — transactional email delivery for order confirmations and download links.
- Heroku (Salesforce, Inc.) — application hosting and server logging.
- Google LLC — web font delivery, as described above.
We may also disclose information where required by law, to respond to a valid legal process, or to establish or defend a legal claim. If the business is ever sold or transferred, customer information may pass to the acquirer as part of that transaction, subject to this policy.
6. Where your information is processed
Routes & Burrows operates from Ontario, Canada. Our hosting, payment, and email providers process and store data on servers in the United States and in other countries where they or their subprocessors operate. Information stored in another country is subject to the laws of that country and may be accessible to its courts, law enforcement, and national security authorities. By purchasing from this store you acknowledge that transfer.
7. How long we keep it
- Cart — held in your browser session and discarded when the session ends or the order completes.
- Order record — we do not maintain an orders database. Your download link is a cryptographically signed token that encodes the items you bought; the record of your purchase lives in your link and in Stripe's records.
- Payment records — retained by Stripe under Stripe's own retention schedule and applicable tax law, typically seven years.
- Email delivery records — retained by Postmark, typically 45 days.
- Server logs — short-lived, typically retained by the hosting platform for one to two weeks.
- Support correspondence — kept as long as needed to resolve the matter and for a reasonable period afterwards for reference.
8. Student information
Our products are blank printable forms. Once you print or download them, anything you record on them — student names, stops, seating positions, contact details, medical or behavioural notes — stays entirely under your control. We never see it, receive it, or store it.
You remain responsible for handling completed pages in line with your district's data-privacy policies and applicable law, including FERPA in the United States, provincial student-records legislation in Canada, or the equivalent where you operate. Store completed pages securely and dispose of them under your district's records policy.
9. Children
This store is intended for adults — drivers, schools, and transportation departments. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
10. Your rights
Subject to the law that applies to you, you may ask us to:
- confirm whether we hold personal information about you, and give you access to it;
- correct information that is inaccurate or incomplete;
- delete information we no longer need to keep;
- provide a copy in a portable format, or restrict or object to certain processing;
- withdraw consent where processing relies on it.
Because we keep no customer database, most access and deletion requests concern data held by Stripe or Postmark; we will pass your request on and help you follow it up. Email us at support@routesandburrows.ca and we will respond within 30 days.
If you are in Canada and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada. If you are in the EEA or the UK, you may complain to your local supervisory authority. If you are a California resident, we do not sell or share your personal information as those terms are defined in the CCPA, and we will not discriminate against you for exercising your rights.
11. Security
The store is served over HTTPS. Download links are protected by an HMAC-SHA256 signature, so a link cannot be altered to reach files that were not purchased, and a link for one pack cannot fetch another. Payment data is handled entirely within Stripe's PCI-compliant environment. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we take reasonable measures appropriate to the sensitivity of the information involved.
12. Changes to this policy
We may update this policy as the store changes. The date at the top always reflects the current version. Material changes will be noted on this page; continuing to use the store after a change means you accept the updated policy.
13. Contact
Questions about this policy, or about personal information we may hold, go to support@routesandburrows.ca. Routes & Burrows is based in Ontario, Canada.
See also our terms of service and product license.