Version 1.0 — effective July 19, 2026
Boutique des Arts Numériques Inc. ("the Platform," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use our website, marketplace, or embedded storefront widget (collectively, the "Services").
This policy is governed by Quebec's Loi modernisant des dispositions législatives en matière de protection des renseignements personnels (Law 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable Canadian privacy laws.
By using our Services, you consent to the practices described in this policy.
We collect only the information necessary to operate the Platform and provide our Services.
We use your information for the following purposes:
We share your information only as necessary to operate the Platform.
When you make a purchase, we share your name, shipping address, and order details with the relevant vendor solely for the purpose of fulfilling your order. Vendors may not use this information for any other purpose, including marketing, under our Vendor Terms of Service.
We share information with trusted third-party service providers who help us operate the Platform:
All service providers are contractually required to protect your data and use it only for the specified purpose.
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing, identity verification, payouts | Payment data, vendor identity |
| Supabase | Database and authentication | Account data, order data |
| Resend | Transactional email delivery | Name, email address |
| Netlify | Website hosting | Usage logs |
| Porkbun / Cloudflare | Domain registration and DNS | Domain registration details |
We may disclose your information if required by law, court order, or government authority. We comply with Canada's Notice and Notice regime under the Copyright Act for intellectual property matters.
If the Platform is sold, merged, or transferred, your information may be transferred as part of that transaction. We will notify you via email before any such transfer occurs.
Your data is stored on servers located in the United States and Canada. We take reasonable steps to ensure that data stored outside Quebec complies with Law 25 cross-border transfer requirements, including maintaining written agreements with service providers that provide equivalent protection.
In the event of a privacy breach that presents a risk of serious harm, we will notify the Commission d'accès à l'information (CAI) and affected individuals as required by Law 25, within the timeframes prescribed by law.
We retain your information only as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 1 year after deletion |
| Order and transaction records | 7 years (Canadian tax law requirement) |
| Payment information | Managed by Stripe per their retention policy |
| ToS acceptance records | 3 years minimum (Law 25 requirement) |
| Communications (buyer-vendor messages) | 2 years after last transaction |
| Analytics data | Aggregated and anonymised — indefinite |
| Identity verification (Stripe KYC) | Managed by Stripe |
Upon account deletion, we anonymise or delete personal data that is no longer required for legal or operational purposes.
Under Quebec's Law 25, you have the following rights regarding your personal information:
You may request a copy of the personal information we hold about you. We will respond within 30 days.
You may request that we correct inaccurate or incomplete personal information.
You may request deletion of your personal information, subject to our legal retention obligations (e.g., tax records).
You may request your personal information in a structured, commonly used, machine-readable format.
Where we rely on consent to process your information, you may withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.
If you believe we have handled your personal information improperly, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) at www.cai.gouv.qc.ca.
To exercise any of these rights, contact us at:
tom@boutique-des-arts.com
Subject line: "Privacy Request — [Your Name]"
We will respond within 30 days. We may ask you to verify your identity before processing your request.
We use Umami Analytics, a self-hosted, cookie-free analytics tool. Umami does not use cookies, does not track individuals across websites, and does not share any data with third parties. It collects only aggregated, anonymised usage statistics.
We do not use:
Because we do not use cookies that require consent under Law 25 or Quebec's equivalent of the EU cookie directive, we do not display a cookie consent banner. If our tracking practices change, this policy will be updated and a consent mechanism will be added.
Our Services are not directed at individuals under the age of 14. We do not knowingly collect personal information from children under 14. Under Law 25, we apply heightened protections to information about minors under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at tom@boutique-des-arts.com and we will delete it promptly.
Our embedded storefront widget ("embed") appears on third-party websites operated by our vendor artists. When you interact with an embedded store:
The Platform is operated from Canada. If you access our Services from outside Canada, your information will be transferred to and processed in Canada (and potentially other countries where our service providers operate). By using our Services, you consent to this transfer.
For vendors and buyers in the European Union or United Kingdom, we process your data on the legal basis of contract performance (to fulfill orders) and legitimate interests (to operate the marketplace). You retain all rights under the GDPR or UK GDPR as applicable, in addition to the rights described in Section 6.
Our Platform may contain links to third-party websites (such as artist social media profiles or shipping carrier websites). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.
As required by Law 25, the person responsible for the protection of personal information at Boutique des Arts Numériques Inc. is:
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Where changes affect your rights under Quebec law, we will provide 30 days notice before the changes take effect. Continued use of the Platform after notice constitutes acceptance of the updated policy.
For any questions, concerns, or privacy requests:
To file a complaint with Quebec's privacy authority:
Province of Quebec, Canada