Privacy Policy
How we use cookies and similar technologies on this site.
What personal information we collect
When you place an order we collect your first name, last name, phone number, email address and, if you add one, a note to your order.
If you choose delivery, we also collect your street address, city, province and postal code. If you use the fitment check, we collect the year, make, model and VIN of your vehicle.
If you subscribe to our newsletter, we collect your email address and nothing else.
We never receive or store your card number. Card details are entered directly into a payment form hosted by Stripe; we only store the identifier of the resulting Stripe payment and its status.
Why we collect it
Contact and delivery details are used to process, ship and support your order, and to reach you about it. Vehicle details are used to confirm that a part fits your car. Payment identifiers are used to confirm payment and to handle refunds and disputes. Your newsletter email is used only to send you our newsletter, and you can unsubscribe at any time.
We do not use this information for any other purpose without asking you first.
Consent
For non-essential cookies we ask for your consent before anything is loaded, and you can withdraw it at any time (see the cookies section below).
For an order, providing your contact and delivery details is necessary for us to fulfil the purchase you asked for. For the newsletter, your consent is the subscription itself, and unsubscribing withdraws it.
Cookies we use
A cookie is a small file stored in your browser. Below is every cookie this site sets, what it is for and how long it is kept. We do not sell this data.
Strictly necessary cookies
These are required for the site to work — your cart, the checkout flow, your language and your cookie choice. They cannot be switched off and do not require your consent, but we list them here so you know what is stored.
| Cookie | Purpose | Retention |
|---|---|---|
| cookieConsent | Stores your cookie choice so we do not ask again. | 1 year |
| cartSessionId | Links your cart to this browser. | 30 days |
| checkoutDetails | Keeps the contact and delivery details you entered so the checkout survives a page refresh. | 1 hour |
| checkoutPaymentMethod | Remembers the payment method you selected during checkout. | 1 hour |
| checkoutOrderId | Links the confirmation page to the order that was just placed. | 1 hour |
| NEXT_LOCALE | Remembers your interface language (English or French). | 1 year |
Third-party cookies (Stripe)
Card payments are processed by Stripe. Stripe sets these cookies on the payment step only, to detect fraud. They are strictly necessary for the payment to go through.
| Cookie | Purpose | Retention |
|---|---|---|
| __stripe_mid | Stripe: fraud prevention, identifies the device across sessions. | 1 year |
| __stripe_sid | Stripe: fraud prevention within a single session. | 30 minutes |
Analytics and marketing cookies
These cookies are off by default and load only if you turn them on. Analytics loads Google Analytics 4, which measures how visitors use the site. Marketing loads the Meta Pixel (Facebook, Instagram) and Google Ads, which measure our advertising and let us show you relevant offers. Both send data to those companies in the United States. Turn a switch off and the matching scripts stop loading; you can change your choice at any time below.
| Cookie | Purpose | Retention |
|---|---|---|
| _ga | Google Analytics: distinguishes one visitor from another. | 2 years |
| _ga_* | Google Analytics: keeps the session state for this site. | 2 years |
| _gcl_au | Google Ads: attributes a purchase to the ad you came from. | 90 days |
| _fbp | Meta Pixel: identifies the browser to measure our Facebook and Instagram ads. | 3 months |
Managing your choices
You can change or withdraw your consent at any time — it is as easy as giving it. Your choice is recorded with a timestamp.
You can also delete cookies or block them entirely in your browser settings. Blocking strictly necessary cookies will break the cart and checkout.
How we protect it
Access to the administration area, where orders and customer details are managed, requires a login. Administrator passwords are never stored as readable text — only as a bcrypt hash — and the list of orders and the customer data in it can only be reached with a valid administrator session.
The session cookie used for that login cannot be read by scripts running in your browser, and our API limits how many requests a single client can make, which reduces automated abuse.
Your card details never reach our servers. They are entered into a payment field hosted by Stripe and are sent directly to Stripe; we receive only an identifier for the payment and its status.
Your rights
Under Canadian federal law (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (Law 25), you may ask us to give you access to the personal information we hold about you, correct it if it is inaccurate or incomplete, delete it where we no longer have grounds to keep it, and provide it to you in a structured, commonly used technological format so you can move it elsewhere.
You may also withdraw a consent you previously gave, and ask us to stop disseminating information about you or to de-index it where the law allows.
To exercise any of these rights, use the contact details in this policy. We will answer within 30 days. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada or, for Quebec residents, to the Commission d'accès à l'information du Québec.
Automated decisions and profiling
We do not use your personal information to make decisions about you automatically, and we do not profile you. Orders, fitment checks and support are handled by people.
Children
This site is intended for adults buying auto parts and is not directed at children. We do not knowingly collect personal information from a child under 14 without the consent of a parent or guardian. If you believe we have, contact us and we will delete it.
Contact us
Requests about your personal information — access, correction, deletion, portability, or withdrawing a consent — can be sent to Hub Body Parts by email at partsautomall@gmail.com, or by mail to 2885 Sherwood Heights Dr, Oakville, Ontario, Canada. Please tell us what you are asking for so we can identify the right records.
We answer within 30 days. If our answer does not satisfy you, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or, if you are a Quebec resident, to the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.