← Back to Vitrine Studio Legal

Privacy Policy

Last updated: 4 August 2026 · Applies to vitrinestudio.ca and to our client services

This policy explains what personal information Vitrine Studio collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. It is written to meet Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who we are

Vitrine Studio is the trade name of Alexandru Abagiu, a sole proprietor based in Montréal, Quebec, Canada. Where this policy says "we", "us" or "Vitrine Studio", it means that business.

We operate from Montréal, Quebec. The fastest way to reach us about anything in this policy is by email, at info@vitrinestudio.ca.

This policy covers two groups of people: visitors to this website, and clients who hire us to build and host a website. Section 9 covers a third group, the customers of our clients, where our role is different.

2. Person in charge of protecting your information

Quebec law requires every business to name someone responsible for the protection of personal information and to publish their contact details. For Vitrine Studio, that person is:

Send any question, access request, correction request or complaint about personal information to that address. We answer within 30 days, which is the deadline the law sets.

3. What we collect

If you fill in our contact form

Your name, email address, phone number if you provide one, and whatever you write in the message field. Nothing on the form is required beyond what is marked as such, and we ask for the minimum we need to reply to you and prepare a quote.

If you become a client

• Business details: business name, address, opening hours, service area, and anything else that needs to appear on your site
• Content you send us: text, photos, logos, menus, price lists, documents
• Account credentials we need to do the work, such as access to an existing domain, an existing site, or a Google Business Profile
• Billing information: name, billing address, and the payment records our payment processor returns to us. We never see or store your full card number — that stays with the processor.
• Correspondence: emails, messages and call notes relating to your project

Automatically, when you visit this site

Our web host records standard server logs, which include IP addresses, browser type, pages requested and timestamps. These are generated by the hosting infrastructure for security and troubleshooting, not by us for marketing.

We use Cloudflare Web Analytics to count how many people visit the site and which pages they read. It sets no cookies, uses no local storage, and does not fingerprint your device or follow you to other websites. It cannot tell us who you are, and it produces no profile of you. We see totals, not people.

We do not run Google Analytics, advertising pixels, or any profiling or cross-site tracking on this website. If that changes, we will update this policy and ask for your consent through a banner before any such technology activates, as Law 25 requires.

4. Why we collect it

We use each piece of information for a specific purpose, and not for others:

• To answer you and quote your project — contact form submissions and follow-up correspondence
• To deliver what you bought — design and build your site, register your domain, configure your email, and provide ongoing hosting and support under your monthly plan
• To bill you — process the one-time fee and the recurring monthly fee, and keep the accounting records Canadian tax law requires us to keep
• To keep the service running and secure — server logs, backups, uptime monitoring
• To meet legal obligations — tax, accounting and any lawful request we are obliged to answer

We do not sell, rent or trade personal information. We do not share it with third parties for their own marketing. We do not use your information to build a profile of you, and we do not make automated decisions about you.

If we ever want to use your information for a purpose not listed above, we will ask you first.

5. Consent and how to withdraw it

You give us your information voluntarily: by submitting the contact form, by signing a project agreement, or by sending us material for your site. That is your consent for the purposes listed in section 4.

You can withdraw consent at any time by emailing us. Two practical notes. First, withdrawing consent is not retroactive: it does not undo processing we already carried out lawfully. Second, some information we are legally required to keep, such as invoices, cannot be deleted on request — see section 10.

If you are a client, withdrawing consent for the information we need to run your site means we can no longer host it. In that case section 12 of our Terms of Service applies.

6. Cookies and tracking technology

This website uses only cookies and local storage that are strictly necessary for it to work — for example, remembering your language choice between the English and French versions. These are exempt from the consent requirement because the site cannot function without them.

We use no analytics cookies, no advertising cookies, and no cross-site tracking. Nothing on this site profiles you, tracks you across other websites, or identifies your location beyond what your browser sends with every ordinary web request.

Our visitor counter, described in section 3, is the reason this is not a contradiction: Cloudflare Web Analytics measures pages without storing anything on your device at all. That is precisely why we chose it, and why this site has no cookie banner to click through.

You can block or delete cookies in your browser settings at any time. Because we use only essential cookies, blocking them may stop parts of the site from working properly, but it will not reduce any advertising you see, because there is none.

If we later add analytics or any technology that collects information about you automatically, we will tell you what it is, what it collects, and ask for your consent before it runs. Refusing will be as easy as accepting.

7. Who we share information with

We share personal information only with the service providers we need to run the business, and only the minimum each one needs. Every one of them is bound by contract to use the information solely to provide the service to us.

• Web3Forms — delivers our contact form submissions to our inbox. Your message passes through their servers and is not used for anything else. See their privacy policy.
• Our web host, Netlify — stores this website and our clients' websites, and generates the server logs described in section 3.
• Our domain registrar, Cloudflare Registrar — registers and renews domain names. Registrant details are supplied to the registry as domain registration rules require.
• Cloudflare Web Analytics — counts visits to this site, as described in section 3. It receives no personal information about you, because it collects none. See their privacy policy.
• Our email provider, Zoho Mail — operates the professional mailboxes included in our packages.
• Our payment processor, Stripe — handles the one-time and recurring payments. They receive your card details directly; we receive only a confirmation and the last four digits.
• Our accountant, where required to prepare our books and tax filings.

We will also disclose information where the law compels us to — a court order, a warrant, or a lawful demand from a regulator. We will tell you if that happens, unless we are legally barred from doing so.

If Vitrine Studio is ever sold or merged, client information may transfer to the buyer as part of that transaction. You would be notified before it took effect, and the buyer would be bound by this policy until it told you otherwise.

8. Information sent outside Quebec

Some of the providers listed in section 7 store or process data on servers outside Quebec, including in the United States and elsewhere. Quebec law requires us to tell you this and to assess whether the information receives adequate protection there.

Before using any provider that stores data outside Quebec, we assess the sensitivity of the information involved, the purpose it is used for, the protections the provider commits to contractually, and the legal framework of the destination country. We only use providers whose contractual commitments give the information protection equivalent to what Quebec law requires.

The practical position: the information we send outside Quebec is business contact information and website content, not sensitive personal information. We do not hold health data, government identifiers, or financial account numbers.

You can ask us for the current list of providers and where each one stores data. Write to the address in section 2.

9. Data on your customers, when we host your site

This section matters if you are a Vitrine Studio client on the Pro plan, or on any plan where your website collects information from your own customers — a contact form, a booking system, a payment page, or the CRM.

That information belongs to you, not to us. Your customers' names, emails, appointments and orders are yours. We hold them on your behalf as your service provider, we act only on your instructions, and we do not use them for any purpose of our own. We do not market to your customers and we do not analyse their data.

Two consequences follow, and they are yours to handle:

• You are the business responsible for that information under Quebec law. You need your own privacy policy on your site, and if your business collects personal information by technological means, you need to name your own person in charge of protecting it. We build the page; the content and the compliance are yours.
• If one of your customers asks you for access to their data, or asks you to delete it, you handle the request. We will give you whatever technical help you need to find, export or delete the records.

When your plan ends, section 12 of the Terms of Service governs what happens to that data, including your right to export it before it is deleted.

10. How long we keep information

• Contact form submissions that do not become projects — up to 12 months, then deleted.
• Client project files and correspondence — for the life of the engagement, then 24 months after it ends, so we can help if you come back or if a question arises about the work.
• Data your site collects about your customers — for as long as your plan is active, then 30 days after it ends, during which you can export it. See section 12 of the Terms of Service.
• Invoices and accounting records — six years from the end of the tax year they relate to, because Canadian tax law requires it. This period overrides a deletion request.
• Server logs — as set by our host, typically under 90 days.

Once a retention period ends, we delete the information or anonymise it so it can no longer identify anyone.

11. How we protect it

The measures we take are proportionate to a small studio holding business contact information and website content:

• All connections to this site and to sites we host are encrypted with HTTPS
• Access to client accounts, hosting panels and email is protected by unique passwords in a password manager and by two-factor authentication wherever the provider supports it
• Only the owner has access to client information; we have no other staff
• Client sites are backed up on a regular schedule and backups are stored encrypted
• We share credentials with clients through a secure method, never in plain text over email

No system is perfectly secure, and we will not pretend otherwise. What we can commit to is that we take reasonable measures and that we tell you promptly if they fail — see section 13.

12. Your rights

Under Quebec and Canadian law you can ask us to do all of the following, free of charge, by writing to the person named in section 2:

• Access — get a copy of the personal information we hold about you, and be told how we use it and who we have shared it with
• Correct — have information that is inaccurate, incomplete or out of date fixed
• Delete — have information deleted where we no longer have a legitimate reason to keep it
• Withdraw consent — stop us using your information for a purpose you previously agreed to
• Portability — receive the computerised personal information you gave us in a structured, commonly used technological format, or have it sent directly to another organisation
• De-indexing — ask us to stop disseminating your information, or to de-index a link to it, where dissemination causes you serious injury to reputation or privacy that outweighs the public interest
• An explanation — if we ever use your information to make a decision about you based exclusively on automated processing, you can ask what information was used, what factors led to the decision, and have it reviewed by a person. We do not currently do this.

We reply within 30 days. If we refuse a request, we will tell you why in writing, and tell you how to challenge it.

If you are not satisfied with our answer, you can complain to either regulator:

13. If something goes wrong

If personal information we hold is lost, accessed without authorisation, or disclosed by mistake, we keep a register of the incident as the law requires. Where the incident presents a risk of serious injury, we notify you and the Commission d'accès à l'information promptly, and we tell you what happened, what information was involved, and what you can do about it.

14. Children

Our services are sold to businesses. This website is not directed at children and we do not knowingly collect personal information from anyone under 14. If you believe a child has sent us information, write to us and we will delete it.

15. Changes to this policy

We update this policy when our practices change. The date at the top always reflects the current version. If a change materially affects how we handle information we already hold about you, we will tell you directly rather than relying on you to notice the new date.

16. How to reach us

Questions about this policy, or about anything in it, go to info@vitrinestudio.ca, attention Alexandru Abagiu, Privacy Officer.

A French version of this policy is available at politique de confidentialité.