Privacy Policy

Effective August 21, 2026

This policy explains what personal information we collect through our website, why we collect it, who we share it with, and the choices you have. We sell site furnishings to businesses and public agencies — we do not sell personal information to anyone.

Who we are

Wishbone Site Furnishings Ltd. (“Wishbone”, “we”, “us”) is a Canadian manufacturer of site furnishings, based at #210 – 27090 Gloucester Way, Langley, BC, Canada V4W 3Y5. We are the organization responsible for the personal information described in this policy.

This policy covers our public website and the signed-in project tools (Wishbone Studio, quotes and favourites) available through it.

What we collect

Information you give us

Contact and newsletter forms — your name, email address, and optionally your phone number, company and the message you write.
Accounts — email address, name, and optionally company, phone and address. If you sign in with Google, we receive your name, email and profile photo from Google.
Quote requests — the products and configurations you selected, quantity, requested delivery date, a shipping address, your contact email, and any addresses you add as CC recipients.
Project content — projects, boards, notes, and files you upload (photographs, images, and CAD site plans). Site plans may contain information about your project site; we treat uploaded files as confidential to your account.
Shared favourites — if you email a set of favourites to someone, we collect the recipient's email address and your message in order to send it.
Feedback and bug reports — what you write, plus any screenshots you attach and basic technical details about the page you were on.

Information collected automatically

Usage and engagement — pages and content you view, what you click, and searches you run. We use this to order the content you see (for example, showing more of the product types you have shown interest in).
Device and connection — IP address, browser and device type, and referring page.
Approximate location — we may convert your IP address into an approximate city/region in order to surface nearby installations. This is not precise location data and we do not use your device's GPS.
Identifiers — a randomly generated visitor ID stored in your browser. See our Cookie Policy.

Analytics and approximate-location collection only take place if you accept them; see Your choices.

How we use it

To respond to enquiries, prepare quotes, and fulfil orders.
To provide accounts, projects, saved favourites and pricing.
To operate, secure and troubleshoot the site, and to prevent abuse.
To personalize what you see — ordering products and stories by what you have engaged with.
To measure how the site is used, so we can improve it (only with your consent to analytics).
To send you marketing email, where you asked us to — you can unsubscribe at any time.
To meet legal, tax and record-keeping obligations.

Where the GDPR applies, we rely on: your consent (analytics, approximate location, marketing email); performance of a contract (accounts, quotes, orders); our legitimate interests in running and securing the business (responding to enquiries, preventing abuse); and legal obligation where a law requires it.

Pricing and sign-in

Prices are only shown to signed-in users. When you request pricing we record the configuration you priced so we can quote it and so you can return to it. Prices shown on the site are estimates — see our Terms of Use.

Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it with service providers who process it on our behalf, under contract, for the purposes below.

Provider	What it does	Data involved
Google / Firebase	Hosting, database, sign-in, file storage, server functions	Effectively all data described above
Google Analytics	Website analytics (only with your consent)	Usage events, device data, approximate location
Google Cloud AI (Vertex AI, Gemini, Veo)	Automatic tagging and description of our own catalogue media; image and video generation	Our catalogue images and video; images you upload to AI tools in the site
ipapi.co	Converts an IP address into an approximate city/region (only with your consent)	IP address
Autodesk Platform Services	Converts CAD files you upload into 3D models	Uploaded CAD files
remove.bg	Removes backgrounds from product photography	Product images
Ragic	Our internal ERP — product catalogue, orders and installations	Order and project records
Email delivery (Firebase Extensions)	Sends transactional and marketing email	Recipient email address and message content

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a corporate transaction such as a sale of the business.

Where it is processed

We are based in Canada, and our service providers are primarily in Canada and the United States. That means your information may be stored or processed outside your province or country, and may be accessible to courts and law enforcement in those jurisdictions under their laws. Where the GDPR applies, transfers out of the EEA rely on the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

Account, project and quote records — for as long as your account is active, and afterwards where we need them for legal, tax or warranty purposes.
Enquiries and quote correspondence — kept as business records.
Engagement history used for personalization — a rolling 90 days.
Marketing subscriptions — until you unsubscribe.
Browser storage — until it expires or you clear it; see the Cookie Policy.

Your choices

Cookies and analytics — choose what you accept when you first visit, and change it any time from “Cookie settings” in the footer. Declining turns off analytics and approximate-location lookups.
Marketing email — every marketing email has an unsubscribe link, and it works without signing in.
Personalization — clearing your browser storage resets the engagement history used to order content.

Your rights

Subject to the limits in applicable law, you can ask us to: give you access to the personal information we hold about you; correct it if it is wrong; delete it; provide a copy in a portable format; or stop or restrict certain uses. Where we rely on consent, you can withdraw it at any time.

Signed-in users can export or delete their data from their account page. You can also email us at privacy@wishboneltd.com and we will respond within the time required by law (30 days under PIPEDA, one month under the GDPR). We may need to verify your identity before acting on a request.

We will not discriminate against you for exercising these rights.

How we protect it

Data is encrypted in transit, access to production systems is restricted to staff who need it, and our database enforces per-user access rules so one customer cannot read another's projects or quotes. No system is perfectly secure, but if a breach creates a real risk of significant harm we will notify you and the appropriate regulator as required by law.