Privacy Policy

Cost Plus Vision Group · Canada

Updated October 11, 2026.

This policy explains how Cost Plus Vision Group (“Cost Plus”, “we”, “our”) handles personal information on the Canadian Cost Plus website, where prices are shown in Canadian dollars (CAD). We sell contact lenses, glasses and sunglasses and work with independent, licensed Canadian eye-care professionals. We do not sell personal information.

Who this covers

People who browse the Canadian site, chat with our shopping guide, use our measuring tools, create an account, or place or request an order. It also covers eye-care professionals who apply to our provider network and organizations that ask about Group Plans.

What we collect

• Account details: your name and email when you create an account or sign in.
• Order details: products, box counts, shipping address, shipping choice, notes you add and order status. For glasses, the prescription values and measurements (such as PD and segment height) you enter so your lenses can be made.
• Payment: card payments are handled by our payment processor, Stripe. We receive the payment status and the name, email and address you give at checkout. We never see or store your full card number.
• Provider network applications: practice name, licence details, city, province, contact details and the notes you put on the form.
• Group Plans briefing requests: organization, contact name, work email and your message.
• Technical information: IP address, device and browser type, pages viewed and anonymous usage events tagged with the Canadian market. These events never contain your name, email or prescription.

Photos, chat and AI

Chat messages are sent to a third-party AI provider to write replies. When you choose to scan Contacts packaging, a frame or a glasses prescription, the photo is sent to our server and that AI provider to read product names or prescription numbers. We ask the provider not to store the results, but its own retention policies may still apply, so cover names, addresses, dates of birth, health-card numbers and prescriber details before you scan.

We do not save scan photos. Scan results are only a starting point: check every value against your prescription. The PD and segment-height tools measure your photo inside your browser, and that photo is not uploaded. Style Studio uses preferences you choose, not face analysis.

Annual administrative fee profiles

If you join annual administrative fee, we keep a member profile linked to your verified sign-in: your annual administrative fee market, paid-through date, renewal and cancellation status, payment method type and any group code you used. Stripe processes annual administrative fee payments; we never see your full card or bank number.

While your annual administrative fee year is paid, you may save one glasses and one Contacts prescription to your own profile. Saved prescriptions are encrypted on our server, shown only to you after you sign in, reused only for your own orders during a paid year, and never shared with other customers of a group. Expired prescriptions are not reused, and licensed staff still review every order. Saved prescriptions are not stored in your browser.

What we do not collect on purpose

• We do not read your other health apps.
• We do not buy marketing lists.
• We do not ask for more health information than your order needs.

Why we use it

• To show products and prices.
• To process, fulfil and support your orders and order requests.
• To let a licensed professional confirm prescription requirements and product suitability.
• To review provider applications and Group Plans requests.
• To keep the site secure, prevent fraud and meet our legal obligations.
• To understand which pages and features are used, without identifying you.

Who sees your information

Authorized Cost Plus staff; the independent, licensed eye-care professional or lab responsible for your order; shipping carriers; and service providers that host the site, handle sign-in, process payments, send email and run AI features. Service providers may use your information only to provide their service to us. We may also disclose information when the law requires it. We do not sell or rent personal information.

Storage outside Canada

Some of our service providers, including hosting, sign-in, payment and AI providers, store or process information in the United States and other countries. There, it may be accessed by courts, law enforcement and national security authorities under local law. We use contractual and technical safeguards to protect it.

How long we keep it

Order and prescription records are kept for as long as provincial law and professional college rules require, often several years. Provider application records are kept while the application or annual administrative fee is active and for a reasonable period after. Technical logs are kept for a shorter time unless we need them for security or a dispute. When we no longer need information, we delete or anonymize it.

Your rights

Under PIPEDA and provincial privacy laws, including Quebec’s Law 25, you can ask to see the personal information we hold about you, ask us to correct it and withdraw your consent, subject to legal and contractual limits. Some records, such as prescription and order records, may have to be kept by law. In Quebec, you can also ask how your information is used and, where the law provides, receive it in a portable format.

To make a request, use our contact form. We reply within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or your provincial commissioner, such as the Commission d’accès à l’information du Québec.

Cookies and browser storage

We use browser storage for your language, your market and the products in your cart (catalog details only), and cookies needed for sign-in and checkout. We do not use advertising cookies. Clearing browser storage does not cancel an order.

Children

A parent or guardian should provide any information needed for a child’s order. We do not build profiles of children or use their information for marketing.

Text messages and email

We do not currently send text messages. If we offer order alerts by text in the future, we will ask for separate, optional consent first, and we will not sell or share text-message opt-in data with third parties. We do not send promotional email or text messages.

Security

We use encrypted connections, access controls and protected sign-in. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the regulator as the law requires.

Privacy Officer and contact

Our Privacy Officer is responsible for this policy and for how we protect personal information. Use our contact form.

This page describes our practices and is not legal advice. If we change it, we will post the update here with a new date.

Temporary Contacts cart drafts

When you confirm or edit a Contacts cart prescription, we save it in an encrypted private server draft so you can return to your cart from Stripe or after reloading. A private browser-owner cookie limits recovery to the same browser session on this site, without sign-in. Prescription values are never put in browser storage, URLs, analytics or Stripe. The draft is inaccessible 24 hours after your last confirmed prescription or cart-line edit; reading it or returning from payment does not extend that time. Removing a line or clearing the cart deletes its draft data; confirmed payment clears purchased draft lines.

Automated cleanup removes expired drafts from the active database. Deletion is not an assurance of immediate physical erasure from backups or infrastructure copies, which follow separate operational retention schedules. Submitted orders, including potentially payable orders, are separate from these drafts.

Completed-order prescription and fulfillment records are retained separately under applicable Canadian provincial law and professional college requirements, not the 24-hour draft limit.

Website diagnostics (proposed — pending legal review)

Proposed addition for legal review; not yet approved. With your permission — or, where the law allows, unless you opt out under "Privacy choices" in the footer — we would use PostHog, a diagnostics service, to collect sanitized error reports and fully masked recordings of public pages so we can find and fix website bugs. Recordings hide all text and everything you type, and are never made on checkout, payment, prescription, account, sign-in or portal pages.

These diagnostics would never include your name, email, address, prescription values or card numbers, and your browser’s Do Not Track or Global Privacy Control setting would always be honored. You could withdraw at any time under "Privacy choices" in the footer, which stops collection and clears the diagnostics identifiers stored in your browser.