Legal
Privacy Policy
Last updated: July 25, 2026
1. Who We Are
Studio Signal is a web design and marketing agency based in Quebec, Canada, serving clients primarily in Quebec and Ontario.
Privacy Officer / Person Responsible for Personal Information: Seb Molgat, [email protected]
For the purposes of Quebec's Act respecting the protection of personal information in the private sector (Law 25), Seb Molgat is the designated person responsible for personal information.
2. What This Policy Covers
This policy describes how we collect, use, and protect personal information on studiosignal.ca, our agency website. It also explains your rights under applicable law.
If you are a client whose website we host or maintain, see Section 9 for how we handle personal information in that context.
3. Information We Collect
3.1 Contact Form
When you submit our contact form (site diagnostic request, general inquiry, or call request), we collect: full name, email address, website URL (if provided), and your message.
How it's handled: your submission is sent directly to us by email via Resend (see 3.5). We do not store contact form submissions in a database; the only retained copy is the email itself, subject to our normal mailbox retention.
3.2 Appointment Booking (Cal.diy)
When you book a call through our website, we collect: full name, email address, selected date and time, and any notes you provide.
Stored in: Cal.diy, our self-hosted scheduling application, running on our own server infrastructure hosted by Oracle Cloud in Montreal, Quebec, Canada. No booking data is sent to third-party scheduling platforms.
3.3 Website Analytics (Umami)
We use Umami, a privacy-focused analytics tool, self-hosted on our own server in Montreal, Quebec, Canada. Umami collects: page views and navigation paths, referral source, browser type and operating system (aggregated), and approximate country (derived from anonymized IP; the full IP is not stored).
Umami does not use cookies and does not share data with any third party.
3.4 Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| theme | Remembers your light/dark mode preference | 1 year |
We do not use advertising cookies, cross-site tracking cookies, or analytics cookies.
3.5 Transactional Email
When you submit our contact form, your message is delivered to us via Resend (Resend Inc., United States), a transactional email relay. Resend processes your name, email address, and message content in transit. Resend does not retain email content beyond delivery. Resend maintains a Data Processing Agreement and is GDPR-compliant. Their privacy policy is available at resend.com/legal/privacy-policy.
3.6 Server Logs
Our web server automatically records standard technical data including IP addresses, timestamps, and requested URLs. Logs are retained for 30 days and used only for security and troubleshooting.
4. Why We Collect This Information
| Data | Quebec Law 25 Basis | GDPR Basis (if applicable) |
|---|---|---|
| Contact form | Consent via voluntary submission | Legitimate interest (pre-contractual communication) |
| Cal.diy bookings | Necessary to deliver requested service | Performance of a contract / pre-contractual steps |
| Analytics | Consent (anonymized, non-identifying) | Legitimate interest (improving our website) |
| Server logs | Necessary for system security | Legitimate interest (security) |
We do not sell, rent, or trade your personal information.
5. Who Has Access to Your Information
- Studio Signal personnel (currently: Seb Molgat)
- Resend Inc., for contact form email delivery only
- Infrastructure providers (Oracle Cloud) for routine hosting operations
We do not use third-party email marketing, CRM platforms, or advertising networks.
International Transfers
Contact form submissions are relayed through Resend's infrastructure in the United States. Resend maintains GDPR-compliant data processing agreements. All other data (bookings, analytics, logs) stays on our own infrastructure in Montreal, Quebec, Canada.
6. Your Rights
All visitors (Quebec Law 25 / PIPEDA)
- Access: Request a copy of the personal information we hold about you
- Correction: Request that we correct inaccurate or incomplete information
- Withdrawal of consent: Withdraw consent for non-essential processing at any time
- Complaint: File a complaint with the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca
EU/EEA visitors (GDPR, included as a courtesy for any international visitors)
In addition to the above:
- Erasure: Request deletion of your personal information
- Portability: Receive your data in a structured, machine-readable format
- Restriction: Ask us to limit how we process your data
- Objection: Object to processing based on legitimate interest
- Supervisory authority: Lodge a complaint with your local data protection authority
To exercise any of these rights, contact: [email protected]. We will respond within 30 days. Identity verification may be required.
7. Data Security
Personal information is stored on a self-hosted, hardened server in Montreal, Quebec, Canada, protected by:
- Encrypted HTTPS connections (TLS 1.2/1.3)
- Network firewalls and access controls
- Automated backups stored in encrypted cloud storage
- No unnecessary third-party access
In the event of a breach that poses a serious risk of harm, we will notify affected individuals and the appropriate regulatory authority within 72 hours, as required by Law 25.
8. Data Retention
| Data type | Retention period |
|---|---|
| Contact form submissions | Not stored; transmitted by email only, retained per our own mailbox policy |
| Booking records | 3 years (business records) |
| Analytics data | 13 months (rolling) |
| Server logs | 30 days |
9. Our Role as a Data Processor
As a web design and marketing agency, we build and maintain websites that collect personal information from your visitors and customers. In this capacity, we act as a data processor on your behalf, and you (our client) are the data controller.
We process your end-users' data only according to your documented instructions. Clients are responsible for:
- Maintaining their own privacy policy on their website
- Obtaining required consents from their users
- Notifying us of any data subject rights requests we need to fulfill
Clients who require a Data Processing Agreement (DPA) may request one at [email protected].
10. Children's Privacy
Our website is not directed at children under the age of 14 (or 16 for EU visitors). We do not knowingly collect personal information from minors. If we discover we have inadvertently collected such data, we will delete it promptly.
11. Changes to This Policy
We may update this policy periodically. The "Last updated" date at the top will reflect any changes. For material changes, we will post a notice on our website.