Privacy Policy

Zalchos Inc. (“Zalchos”, “we”, “us”, “our”) collects personal information to operate the Zalchos alcohol delivery marketplace platform in compliance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

We collect the following categories of personal information:

• Full legal name and date of birth (required for age verification)
• Email address and phone number (for account creation and order communications)
• Delivery address and location data (to facilitate order delivery)
• Account credentials (email and hashed password)
• Order history and transaction records
• Device information, IP address, and browser type (for security and fraud prevention)
• Communications with Zalchos customer support

We collect personal information directly from you when you register an account, place an order, apply as a vendor or driver, or contact us. We use this information solely for the purposes described in this Privacy Policy and do not sell your personal information to third parties.

All payment processing on the Zalchos platform is handled by Stripe, a PCI-DSS compliant payment processor. Zalchos does not store, process, or have access to your full credit card number, CVV, or other sensitive payment credentials.

When you make a purchase, your payment details are transmitted directly to Stripe using encrypted connections. Stripe stores and processes your payment information in accordance with their own Privacy Policy and PCI-DSS security standards.

Zalchos retains only the following payment-related information for order records and regulatory compliance:

• Transaction ID and order reference number
• Payment status (completed, refunded, failed)
• Last four digits of the card used (provided by Stripe for display purposes)
• Transaction amount and date

For vendors using Stripe Connect for payouts, Stripe collects and stores additional financial information including bank account details. This information is held by Stripe and governed by their terms and privacy policy.

Canadian law requires that alcohol be sold and delivered only to individuals of legal drinking age. To comply with these requirements, Zalchos and its authorized delivery partners collect and verify government-issued photo identification at the point of delivery.

At the time of delivery, our drivers are required to visually inspect a valid government-issued photo ID (such as a driver’s licence, passport, or provincial ID card) to confirm the recipient is of legal drinking age. Drivers do not scan, photograph, or retain copies of your ID.

For vendor and driver onboarding, Zalchos may collect copies of government-issued identification documents as part of the identity verification and background screening process. These documents are:

• Stored securely using encrypted storage
• Accessed only by authorized Zalchos personnel for verification purposes
• Retained only for the duration required by applicable law and our data retention policy
• Never shared with third parties except as required by law or regulatory authorities

Individuals who apply to become authorized delivery drivers on the Zalchos platform provide additional personal information as part of the onboarding and compliance process. This includes:

• Full legal name, date of birth, and contact information
• Government-issued photo identification
• Driver's licence number and province of issue
• Vehicle information (make, model, year, licence plate)
• Proof of valid vehicle insurance
• Completion records for mandatory responsible alcohol service training
• Background check consent and results (where applicable)
• Banking information for payment processing via Stripe Connect

Driver location data is collected during active delivery sessions to facilitate order dispatch and real-time tracking. Location data is not collected when drivers are not actively on a delivery. Location data is not sold or shared with third parties outside of the delivery coordination function.

Driver information is retained for the duration of the driver’s active status on the platform and for the period required by applicable law following deactivation.

Licensed liquor retailers (“Vendors”) who apply to join the Zalchos marketplace provide business and personal information as part of the onboarding process. This includes:

• Business legal name, registered address, and contact information
• Liquor retail licence number and issuing authority (e.g., AGLC)
• Business owner or authorized representative name and contact details
• Government-issued identification for authorized representatives
• Business banking information for Stripe Connect payouts
• Store logo, product images, and marketing materials
• Product listings, pricing, and inventory data
• Transaction and order fulfilment records

Vendor information is used to verify regulatory compliance, facilitate payments, display store information to customers, and maintain accurate transaction records. Vendor store names, logos, and product images may be used by Zalchos for platform display and marketing purposes as described in the Vendor Agreement.

Vendor data is retained for the duration of the vendor’s active status on the platform and for the period required by applicable law and regulatory record-keeping obligations following deactivation.

Zalchos uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device when you visit our website.

We use the following types of cookies:

• Essential cookies — Required for the platform to function, including authentication sessions and shopping cart state. These cannot be disabled.
• Analytics cookies — Used to understand how users interact with the platform (e.g., pages visited, time on site). This data is aggregated and anonymized.
• Preference cookies — Used to remember your settings and preferences (e.g., language, location).
• Security cookies — Used to detect and prevent fraudulent activity and unauthorized access.

We do not use advertising cookies or sell cookie data to third-party advertisers. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the platform.

Zalchos may send you marketing and promotional emails if you have opted in to receive them. These may include:

• Seasonal promotions and special offers from Zalchos
• New vendor and product announcements
• Platform updates and new feature announcements
• Community stories and editorial content from Inside Zalchos
• City launch announcements

All marketing emails include a clear and functional unsubscribe link. You can opt out of marketing emails at any time by clicking the unsubscribe link in any email or by contacting us at hello@zalchos.com.

Transactional emails (order confirmations, delivery updates, account notifications) are not marketing emails and will continue to be sent regardless of your marketing email preferences, as they are necessary for the operation of the service.

We use SendGrid to deliver emails. Your email address is shared with SendGrid solely for the purpose of email delivery and is governed by SendGrid’s privacy policy.

Zalchos retains personal information for as long as necessary to fulfil the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements.

Our general data retention periods are as follows:

• Active customer accounts — Retained for the duration of the account and for 7 years following account closure, as required by Canadian tax and financial record-keeping laws.
• Order and transaction records — Retained for 7 years following the transaction date for regulatory and audit purposes.
• Driver and vendor records — Retained for the duration of active status and for 7 years following deactivation.
• Government ID documents (vendor/driver onboarding) — Retained for the duration of the onboarding review and deleted within 90 days of a completed or rejected application, unless longer retention is required by law.
• Marketing email consent records — Retained for 3 years following the last interaction or unsubscribe event.
• Support communications — Retained for 3 years following the resolution of the inquiry.

When personal information is no longer required, it is securely deleted or anonymized in accordance with our data destruction procedures.

You have the right to request the deletion of your personal information held by Zalchos. To submit a deletion request, contact us at privacy@zalchos.com with the subject line “Data Deletion Request” and include the email address associated with your account.

Upon receiving a verified deletion request, Zalchos will:

• Verify your identity before processing the request
• Delete or anonymize your personal information within 30 days of verification
• Confirm completion of the deletion in writing

Please note that certain information may be retained beyond your deletion request where required by applicable law, including transaction records required for tax and regulatory compliance, and information necessary to resolve outstanding disputes or enforce our agreements.

Deleting your account will permanently remove your access to the Zalchos platform. Order history and transaction records required for regulatory compliance will be retained in anonymized or aggregated form.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us:

We will respond to all privacy-related inquiries within 30 days. If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.