Privacy Policy

1. Person in charge of the protection of personal information

Simon Lacroix, doing business as “Bonjour la toile” (NEQ 2274467762), is responsible for the personal information collected on the simonlacroix.net website.

In accordance with the Act respecting the protection of personal information in the private sector (Quebec Law 25), the person in charge of the protection of personal information is:

Simon Lacroix
105-3700, rue Évariste-Leblanc, Laval (Québec)
H7V 0C4, Canada

For any question or to exercise your rights: use the contact form, or write to us by mail at the address above.

2. Scope

This policy applies to the simonlacroix.net website and its demos, as well as to the exchanges you have with us by email. It does not apply to the third-party sites we link to.

3. Information we collect

Information you provide to us

• Correspondence: your name, your email address, and the subject and content of your messages, sent through the contact form or by email.
• Requests for copies of story collections: name, email address, telephone number (optional), collections and quantities requested, delivery method and, for shipping by mail, the postal address and the name to write in the autograph (optional); for a pickup, the time chosen to come and get the books. We do not receive any card or bank account number.
• Blog comments: display name, email address (optional, never published) and comment text, as well as the IP address and browser type from which the comment was sent, for moderation.

Information collected automatically

• IP address and browser type, used for security and rate limiting, and recorded in the technical logs of our servers and of our content delivery network.
• For a “like” on a comment: a fingerprint calculated from the IP address and browser type, so that only one vote per visitor is counted.
• For audience measurement: the page viewed, the domain of the referring page, the source of the visit indicated in the address and the device type (mobile or computer), as described in section 6.

We do not collect sensitive information (origin, political opinions, religious beliefs, sexual orientation, health or biometric data), and we do not seek to identify the site's visitors by name.

4. Purposes for which we use it

• Responding to your messages and requests.
• Processing your requests for copies of story collections: payment instructions, shipping by mail or pickup, follow-up of the request.
• Publishing your comments after moderation.
• Measuring the site's audience and improving its content and operation.
• Ensuring the security of the site and preventing spam and abuse.
• Meeting our legal, accounting and tax obligations.

We do not use your information for any other purpose without informing you and, where the law requires it, without obtaining your consent.

5. Basis for processing and consent

We collect your information either because it is necessary for the performance of a contract you enter into with us (a request for copies of story collections, for example), because the law requires us to, or because you have given your free and informed consent.

Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

6. Audience measurement

We measure the site's audience with our own tool, not with a third-party analytics service. Once the page is displayed on screen, a small script served by the site itself sends the server the page viewed, the domain of the referring page, the source of the visit and the device type (mobile or computer). The server then adds one view to the day's count; it keeps nothing else.

This measurement sets no cookie, keeps neither IP address nor identifier, and builds no individual profile. The script does not contact any third-party domain.

7. Cookies

A cookie is a small file placed on your device when you visit a website. simonlacroix.net places none on its visitors' devices: no audience measurement cookie and no advertising cookie. The site's only cookie is the administration session cookie, reserved for the operator.

When you like a comment, your browser remembers that vote in its local storage, on your device only, so that it is not offered to you again. You can erase it at any time from your browser settings.

8. Disclosure to third parties

We disclose personal information only to the following categories of recipients, and strictly to the extent necessary:

• our hosting and infrastructure providers: Railway (applications and databases) and bunny.net (content delivery network, media storage, DNS);
• our email sending and receiving services: ZeptoMail and Forward Email;
• Google, which provides the site's fonts: your browser downloads them from Google's servers, which then receive your IP address;
• our language model provider, OpenRouter, for assisted content writing; it never receives your personal information;
• the postal service, for shipping the collections requested by mail (name and address written on the package);
• our professional advisers (accountant, lawyer), who are bound by confidentiality;
• a public authority, where the law requires us to.

Each of these providers is bound by terms that limit the use of the information to the sole purposes for which it is entrusted to them. We do not sell or trade your personal information.

9. Disclosure outside Quebec

Our application servers and databases are operated by Railway in the United States. Our content delivery network and media storage are operated by bunny.net, a company based in Slovenia whose points of presence are spread around the world. Our email providers are based in the United States or the European Union; Google and OpenRouter are based in the United States. Your information may therefore be hosted or processed there.

Before any disclosure outside Quebec, we carry out the privacy impact assessment required by law, to make sure that the information will receive adequate protection, and we govern the disclosure through the provider's contractual terms.

10. Retention period

We keep personal information for as long as the purpose for which we collected it has not been fulfilled, and then we destroy it. An automated task on the site applies these periods every day:

• Correspondence (contact form and emails): the conversation is deleted twelve (12) months after its last message, giving us time to reply to you and follow up; a conversation classified as spam is deleted thirty (30) days after its last message.
• Blog comments: the published text and display name remain as long as the comment is online; your email address, your IP address and the browser type, which serve only for moderation, are erased thirty (30) days after moderation; a rejected or spam comment is deleted thirty (30) days after moderation.
• “Likes” on a comment: the vote fingerprint is kept as long as the comment exists, and deleted with it.
• Requests for copies of story collections: deleted twelve (12) months after their last update, giving us time to deliver the books and to answer any question about the request; the accounting records of a sale are kept outside the site.
• Technical copy of a received email, kept long enough to file it in its conversation: deleted thirty (30) days after it is processed.
• Audience measurement: aggregated, non-identifying counts, kept indefinitely.
• Technical logs: according to the log retention period of our hosting providers (Railway, bunny.net).
• Database backups: deleted information may remain in them until the backup is replaced, according to the hosting provider's backup retention period.

You may ask us to delete information sooner: see the “Your rights” section.

11. Security

We apply reasonable measures to protect your information: encryption of communications (HTTPS), access restricted to the operator, administration password stored as a hash, regular encrypted backups and security updates.

Since no system is infallible, we cannot guarantee absolute security; we are, however, committed to responding promptly to any incident.

12. Automated decisions

We make no decision producing a legal effect concerning you based solely on automated processing. Our spam protection systems may automatically reject a message or a comment deemed abusive. You may write to us to contest such a rejection and obtain a human review.

13. Your rights

Subject to the conditions provided by law, you have the right:

• of access: to obtain confirmation that we hold information about you and to receive a copy of it;
• to rectification: to have inaccurate, incomplete or ambiguous information corrected;
• to withdraw your consent: at any time, for the processing that depends on it;
• to deletion or de-indexing: to have the dissemination of information stopped, or a hyperlink to it removed, when its dissemination causes you serious harm;
• to portability: to receive, in a structured and commonly used technological format, the computerized information you provided to us;
• to file a complaint: with the Commission d'accès à l'information du Québec.

To exercise a right: use the contact form, or write to us by mail at the address in section 1. We may ask you to prove your identity. A written, reasoned response will be sent to you within thirty (30) days of receipt of your request. This service is free of charge.

14. Information concerning minors

The site is not intended for children under 14, and we do not knowingly collect their information. If you find that a child has sent us information without the consent of the person having parental authority, write to us: we will delete it without delay.

15. Confidentiality incident

In the event of a confidentiality incident presenting a risk of serious harm, we will promptly notify the Commission d'accès à l'information and the persons concerned, and we will keep the register of incidents required by law.

16. Changes to this policy

We may amend this policy to reflect changes in our practices or in the legal framework. The effective date appears at the top of the document. In the event of a significant change, we will inform you through a visible notice on the site or by email.

17. Questions and complaints

Please first address any question or complaint to our person in charge of the protection of personal information: use the contact form, or write to us by mail at the address in section 1.

If you are not satisfied with our response, you may refer the matter to:

• the Commission d'accès à l'information du Québec;
• the Office of the Privacy Commissioner of Canada, for processing covered by the Personal Information Protection and Electronic Documents Act (PIPEDA).