Privacy Policy

This policy applies to:

• Buyers — anyone who purchases or browses products on the Platform
• Vendors — artists and sellers who list and sell products through the Platform
• Visitors — anyone who visits boutique-des-arts.com or any embedded store powered by the Platform

Governing law and consent

This policy is governed by Quebec's Loi modernisant des dispositions législatives en matière de protection des renseignements personnels (Law 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable Canadian privacy laws.

By using our Services, you consent to the practices described in this policy.

a. Information you provide directly

• Account registration: name, email address, password
• Vendor onboarding: legal name, business name, address, bank account details (via Stripe), government-issued ID (via Stripe KYC)
• Buyer checkout: name, shipping address, email address, payment information (processed by Stripe — we do not store card numbers)
• Communications: messages sent through the Platform between buyers and vendors, support requests sent to [email protected]
• Custom commissions: any additional personal information you provide to facilitate a custom order

b. Information collected automatically

• Usage data: pages visited, products viewed, time spent on pages, referring URLs
• Device information: browser type, operating system, screen resolution, language preference
• Analytics: aggregated traffic data collected via Umami Analytics (self-hosted, cookie-free, no personal data shared with third parties)
• Transaction data: order details, amounts, timestamps, fulfillment status

c. Information from third parties

• Stripe: payment processing status, identity verification results, payout information. Stripe's privacy policy governs data processed directly by Stripe.
• Embedded widget: if you access a vendor's store via an embedded widget on a third-party website, we collect the same usage data as above. The third-party website's own privacy policy also applies.

To provide and operate the Services

• Processing orders and payments
• Facilitating communication between buyers and vendors
• Managing vendor accounts and storefronts
• Sending transactional emails (order confirmation, shipping notification, password reset)

To protect the Platform and its users

• Fraud detection and chargeback dispute resolution
• Identity verification for vendors via Stripe
• Enforcing our Terms of Service

To improve the Services

• Analysing aggregated, anonymised usage data to understand how the Platform is used
• Identifying and fixing technical issues

To comply with legal obligations

• Collecting and remitting GST/QST as marketplace facilitator under Quebec and Canadian tax law
• Responding to lawful requests from government authorities
• Maintaining records required by Canadian tax law (typically 7 years)

We do not use your information for:

• Selling your data to third parties
• Targeted advertising or behavioural profiling
• Any purpose not described in this policy without your consent

With vendors (for order fulfillment)

When you make a purchase, we share your name, shipping address, and order details with the relevant vendor solely for the purpose of fulfilling your order. Vendors may not use this information for any other purpose, including marketing, under our Vendor Terms of Service.

With service providers

We share information with trusted third-party service providers who help us operate the Platform:

All service providers are contractually required to protect your data and use it only for the specified purpose.

For legal compliance

We may disclose your information if required by law, court order, or government authority. We comply with Canada's Notice and Notice regime under the Copyright Act for intellectual property matters.

In the event of a business transfer

If the Platform is sold, merged, or transferred, your information may be transferred as part of that transaction. We will notify you via email before any such transfer occurs.

We do not sell your personal information. Ever.

Storage

Your data is stored on servers located in the United States and Canada. We take reasonable steps to ensure that data stored outside Quebec complies with Law 25 cross-border transfer requirements, including maintaining written agreements with service providers that provide equivalent protection.

Security measures

• All data transmitted between your browser and our servers is encrypted via TLS/HTTPS
• Passwords are hashed and never stored in plain text
• Access to personal data is restricted to authorized personnel only
• Payment data is processed entirely by Stripe and never stored on our servers

Breach notification

In the event of a privacy breach that presents a risk of serious harm, we will notify the Commission d'accès à l'information (CAI) and affected individuals as required by Law 25, within the timeframes prescribed by law.

Account deletion

Upon account deletion, we anonymise or delete personal data that is no longer required for legal or operational purposes.

Right to access

You may request a copy of the personal information we hold about you. We will respond within 30 days.

Right to correction

You may request that we correct inaccurate or incomplete personal information.

Right to deletion

You may request deletion of your personal information, subject to our legal retention obligations (e.g., tax records).

Right to data portability

You may request your personal information in a structured, commonly used, machine-readable format.

Right to withdraw consent

Where we rely on consent to process your information, you may withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

Right to complain

If you believe we have handled your personal information improperly, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) at www.cai.gouv.qc.ca.

How to exercise these rights

To exercise any of these rights, contact us at:

[email protected]

Subject line: "Privacy Request — [Your Name]"

We will respond within 30 days. We may ask you to verify your identity before processing your request.

No consent banner required

Because we do not use cookies that require consent under Law 25 or Quebec's equivalent of the EU cookie directive, we do not display a cookie consent banner. If our tracking practices change, this policy will be updated and a consent mechanism will be added.

Notice period under Quebec law

Where changes affect your rights under Quebec law, we will provide 30 days notice before the changes take effect. Continued use of the Platform after notice constitutes acceptance of the updated policy.

Filing a complaint with Quebec's privacy authority

To file a complaint with Quebec's privacy authority:

• Commission d'accès à l'information (CAI)
• www.cai.gouv.qc.ca
• 1 888 528-7741

Governing law

Province of Quebec, Canada