Privacy Policy

Website: https://novelspell.com

Company: Frostwave Labs Inc.

Contact: [email protected]

Address: 2967 Dundas St. W. #992, Toronto, ON M6P 1Z2

Jurisdiction: Ontario, Canada

Effective date: 2026-08-04

We are based in Ontario, Canada.

Privacy contact and data controller

For purposes of applicable data protection laws, the data controller is:

Frostwave Labs Inc.

Email: [email protected]

Address: 2967 Dundas St. W. #992, Toronto, ON M6P 1Z2

Ontario, Canada

Use the contact details above for privacy enquiries, rights requests, or complaints. We will review and respond in accordance with applicable law.

This Privacy Policy explains how Frostwave Labs Inc. ("we", "us", or "our") collects, uses, discloses, and protects information when you visit or use https://novelspell.com (the "Website").

This policy is intended to describe our practices in a clear manner. It does not limit any rights or remedies available under applicable law.

1) Definitions

For purposes of this Privacy Policy:

• "Personal information" / "personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with you or your device.
• "Processing" means any operation performed on personal information, including collection, use, storage, disclosure, or deletion.
• "Service providers" means vendors that process information on our behalf to provide enabled features such as hosting, security, payment processing, fulfilment, analytics, communications, and support.
• "Controller" or "business", where applicable, means the entity that determines the purposes and means of processing personal information.

2) What we collect

Information you provide

• Contact, order, and support information: If you contact us, request information, submit a form, place an order, or ask for support, we collect the details you choose to provide and may keep records needed to respond, fulfil the request, and maintain the resulting transaction or correspondence.

Information collected automatically

• Device and usage data: IP address, browser type, device identifiers, pages viewed, time spent, referral URLs, and similar diagnostics.
• Cookies and similar technologies: We may use cookies, pixels, tags, local storage, or similar technologies to operate the Website, remember preferences, measure performance, protect against abuse, and support the features enabled for this Website.
• Log and security data: We and our service providers may collect logs and related information to maintain the security and integrity of the Website, including detecting suspicious activity, preventing abuse, and troubleshooting.

3) How we use information

We may use information to:

• Provide, operate, secure, and maintain the Website
• Respond to enquiries and provide customer support
• Process enabled transactions, fulfil orders, and administer requests you submit
• Understand Website usage and improve content, performance, and reliability
• Prevent fraud, abuse, security incidents, and unlawful activity
• Enforce our Terms of Service and other agreements
• Comply with legal obligations and respond to lawful requests
• Protect the rights, safety, and property of us, our users, and others

4) Commerce, payments and fulfilment

When you buy from NovelSpell, Shopify handles checkout and payment, retains the order record and sends order communications. Shopify and its payment partners process the contact, billing, payment, authentication, fraud-prevention, tax and order information required to complete the purchase. If your order includes a paperback, Lulu receives the contact and delivery information it requires to print and ship the book. The NovelSpell storefront does not receive your card or payment-method details.

5) Sharing and disclosures

We may share information:

• With service providers who help operate the Website and provide enabled features
• To comply with legal obligations or lawful requests
• To protect our rights, safety, and property, and that of users and others
• In connection with a merger, acquisition, financing, restructuring, or sale of assets, where permitted by law

We do not authorise service providers to use personal information we share with them except as necessary to provide services to us or to comply with applicable law.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

6) Data retention

We retain personal information only as long as needed for the purposes described in this policy, unless a longer retention period is required or permitted by law.

Examples include retaining correspondence for support records, technical logs for security and operational purposes, billing records for accounting and tax obligations where applicable, and unsubscribe records to respect communication preferences.

7) Security and your rights

We use reasonable technical and organisational measures to protect information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

You may have rights depending on your location, including:

• Access, correction, or deletion of personal information
• Objection or restriction of processing
• Data portability
• Withdrawal of consent where processing is based on consent

To exercise rights, contact: [email protected]

8) GDPR notes

If you are in the EEA or UK, we rely on a legal basis for processing such as:

• Consent, for example where required for optional cookies or requested email communications
• Legitimate interests, for example site security, fraud prevention, support, and basic operational analytics where permitted by law
• Contract, where processing is needed to take steps at your request or perform an agreement
• Legal obligation, where processing is required by applicable law

Where we rely on legitimate interests, we consider and balance any potential impact on your rights and may limit processing where required. You also have the right to lodge a complaint with your local data protection authority.

9) California privacy notes

We may collect identifiers, internet or electronic network activity information, commercial information where applicable, and other information you provide or that is generated through your use of the Website.

We do not sell personal information in the traditional sense. If this Website later enables advertising or ad-tech features that are considered sharing under California privacy law, we will provide required notices or controls.

If you submit a request to exercise your rights, we may need to verify your identity, which may require additional information. We will use verification information only for that purpose.

10) Do Not Track signals

Some browsers transmit Do Not Track or other browser-based privacy signals. We honour such signals where applicable law requires it. Otherwise, because there is no consistent standard for interpreting every signal, users can manage cookie preferences through browser settings and any consent tools we provide.

11) International visitors

If you access the Website from outside Ontario, Canada, your information may be processed in countries where our service providers operate, which may have different data protection laws.

Where required by applicable law, cross-border transfers are subject to recognised safeguards, such as Standard Contractual Clauses or other lawful transfer mechanisms.

12) Links to other websites

The Website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites or services.

13) Children's privacy

The Website is not intended for children under 13, or the minimum age required by your jurisdiction if higher. We do not knowingly collect personal information from children. If you believe a child provided us data, contact [email protected].

14) Sensitive personal information

We ask that you do not send us, and do not disclose, any sensitive personal information on or through the Website or otherwise to us unless we specifically request it for a lawful purpose.

15) Changes to this policy

We may update this policy from time to time. The updated version will be posted on this page with a revised effective date.

16) Contact

Questions about this Privacy Policy: [email protected]

Postal address: 2967 Dundas St. W. #992, Toronto, ON M6P 1Z2