Privacy policy

1. Person in charge of personal information

Simon Lacroix, doing business as “Bonjour la toile” (NEQ [[NEQ]]), is responsible for the personal information collected on the websites he publishes.

In accordance with Quebec's Act respecting the protection of personal information in the private sector, the person in charge of the protection of personal information is:

Simon Lacroix
[[ADDRESS]], [[CITY]], Quebec [[POSTAL_CODE]], Canada
Email: info@bonjourlatoile.net

2. Scope

This policy applies to all websites we publish, listed in the site directory, and to your exchanges with us by email. It does not apply to third-party sites we link to, nor to our clients' sites on which one of our modules is embedded, except as stated in section 9.

3. Information we collect

Information you give us

• Purchase: email address, product purchased, amount, date. Card details are entered directly with the payment provider; we only receive the transaction confirmation.
• Account, on the sites that offer one: email address, password (stored as a hash, never in clear text), display name, declared sites and settings.
• Newsletter or waiting list: email address, date and origin of the consent and, for a waiting list, the referral link you arrived through.
• Notifications: your browser's subscription, if you agree to receive notifications from a site.
• Correspondence: the content of your messages, contact forms and attachments.
• Entrusted content: answers to a form, quiz results or reactions, when you use one of our modules on a site.

Information collected automatically

• IP address, used for security and rate limiting, then truncated or turned into a non-reversible fingerprint for audience measurement.
• Browser type, operating system, language, screen size.
• Pages viewed, date and time, referring page, searches made on the site, outbound links clicked.
• Technical logs of our servers and of our content delivery network.

We do not collect sensitive information (origin, political opinions, religious beliefs, sexual orientation, health or biometric data), and we do not seek to identify the visitors of our sites by name.

4. Purposes

• Deliver the digital products purchased and provide the services subscribed to.
• Provide customer service and answer your requests.
• Manage your account, your declared sites and your preferences.
• Send you the emails you asked for: confirmations, newsletter, waiting-list rewards, notifications.
• Measure the audience of our sites and improve their content and operation.
• Serve advertisements and be paid for our affiliate partnerships.
• Keep our sites secure and prevent fraud, spam and abuse.
• Meet our legal, accounting and tax obligations.

We do not use your information for any other purpose without informing you and, where the law requires it, obtaining your consent.

5. Basis of processing and consent

We collect your information either because it is necessary to perform a contract you enter into with us, because the law requires it, or because you have given your free and informed consent.

Where processing relies on your consent (newsletter, notifications, advertising cookies), it is requested separately, for each purpose, and you may withdraw it at any time without affecting the lawfulness of the processing carried out beforehand. A newsletter or waiting-list sign-up only counts once confirmed by email.

6. Audience measurement

We measure the audience of our sites with our own tool, Bonjour visiteurs, and not with a third-party analytics service. Each site records, on the server side, facts about visits (page view, internal search, outbound click, page not found) and sends them to this tool, which keeps them in our own database.

This measurement sets no tracking cookie and builds no individual profile. The IP address is reduced to its network and turned into a daily non-reversible fingerprint before being kept; the country is derived from the truncated address, then the address is discarded. A small script served by the site itself completes the server record; it contacts no third-party domain.

7. Cookies

A cookie is a small file placed on your device when you visit a site. Our sites use:

• necessary cookies, only where a feature requires them: the session of an account or a customer area, the protection of a form, the memory of a choice such as the language;
• advertising cookies, set by the advertising network on the sites that display ads only, and only after your consent.

Our sites set no audience-measurement cookie. Sites that display ads show a consent banner on the first visit; you can return to it at any time through the preferences link in the footer. Your browser also lets you block or delete cookies; blocking necessary cookies may prevent you from opening an account.

8. Advertising and affiliate links

Some of our sites display advertisements served by Google AdSense. This network may set its own cookies and collect browsing data to measure the performance of ads and, where you have consented, to personalize the ads shown to you. It then acts on its own behalf, under its own privacy policy, which we invite you to read. Without your consent, ads are shown without personalization.

Our directories and tools contain affiliate links to hosting providers, domain registrars, online bookstores and merchants. When you click such a link, the site records the click (page of origin, destination, date) and the merchant receives an affiliate identifier that lets it attribute the commission to us. The merchant then handles your visit under its own policy.

We do not sell or trade your personal information.

9. Modules embedded on third-party sites

Bonjour la toile provides modules (form, quiz, reactions) that other sites embed in their pages. When you fill in such a module on a third party's site, your answers pass through our servers and are stored there on behalf of that site, which is responsible for them. We use these answers only to return them to that site, protect them against spam and make the service work. To exercise a right over these answers, contact the site on which you gave them; we assist it in its response.

10. Disclosure to third parties

We disclose personal information only to the following categories of recipients, and strictly to the extent necessary:

• our hosting and infrastructure providers: Railway (applications and databases) and bunny.net (content delivery network, media storage, DNS);
• our payment providers, Stripe and Ko-fi;
• our email sending and receiving services: ZeptoMail, Mailgun and Forward Email;
• the Google AdSense advertising network, on the sites that display ads;
• the merchants of our affiliate programs, which receive only an affiliate identifier;
• our language-model providers, for assisted content writing, which never receive your personal information;
• our professional advisers (accountant, lawyer), bound by confidentiality;
• a public authority, where the law requires it.

Each of these providers is bound by terms that limit the use of the information to the sole purposes for which it is entrusted.

11. Transfers outside Quebec

Our application servers and databases are operated by Railway in the United States. Our content delivery network and media storage are operated by bunny.net, a company based in Slovenia whose points of presence are spread around the world. Our payment and email providers are based in the United States or the European Union. Your information may therefore be hosted or processed there.

Before any transfer outside Quebec, we carry out the privacy impact assessment required by law, to make sure the information receives adequate protection, and we frame the transfer with the provider's contractual terms.

12. Retention periods

• Purchase and billing records: seven (7) years, in accordance with Canadian tax obligations.
• Account: until it is closed, then twelve (12) months.
• Newsletter, waiting list, notifications: until you withdraw your consent.
• Correspondence: twenty-four (24) months after the last exchange.
• Content entrusted through one of our modules: as long as the site that collected it remains a client, then twelve (12) months.
• Audience measurement: kept in aggregated, non-identifying form, without time limit.
• Technical logs and outbound clicks: at most six (6) months.

At the end of these periods, the information is destroyed or irreversibly anonymized.

13. Security

We apply reasonable measures to protect your information: encrypted communications (HTTPS), passwords stored as hashes, access restricted to the operator, two-factor authentication on our administration consoles, regular encrypted backups and security updates.

Since no system is infallible, we cannot guarantee absolute security; we do however undertake to respond promptly to any incident.

14. Automated decisions

We make no decision producing legal effects on you based solely on automated processing. Our spam protection systems may automatically set aside a sign-up or an answer deemed abusive, and our payment providers apply their own fraud detection mechanisms. You may write to us to contest such a refusal and obtain a human review.

15. Your rights

Subject to the conditions provided by law, you have the right:

• of access: to obtain confirmation that we hold information about you and to receive a copy;
• of rectification: to have inaccurate, incomplete or ambiguous information corrected;
• to withdraw consent: at any time, for processing that depends on it, including through the unsubscribe link in every email;
• to deletion or de-indexing: to have the dissemination of information stopped, or a hyperlink removed, where the dissemination causes you serious harm;
• to portability: to receive, in a structured and commonly used technological format, the computerized information you provided to us;
• to complain: to the Commission d'accès à l'information du Québec.

To exercise a right, write to info@bonjourlatoile.net stating the site concerned. We may ask you to prove your identity. A written, reasoned reply will be sent to you within thirty (30) days of receiving your request. This service is free of charge.

16. Information about minors

Our sites are not intended for children under 14 and we do not knowingly collect their information. If you find that a child has sent us information without the consent of the holder of parental authority, write to us: we will delete it without delay.

17. Confidentiality incidents

In the event of a confidentiality incident presenting a risk of serious harm, we will notify the Commission d'accès à l'information and the persons concerned without delay, and we will keep the incident register required by law.

18. Changes to this policy

We may change this policy to reflect changes in our practices or in the legal framework. The effective date appears at the top of the document. In the event of a significant change, we will inform you by a visible notice on our sites or by email.

19. Questions and complaints

First address any question or complaint to our person in charge of the protection of personal information, at info@bonjourlatoile.net.

If our reply does not satisfy you, you may apply to:

• the Commission d'accès à l'information du Québec;
• the Office of the Privacy Commissioner of Canada, for processing covered by PIPEDA.