Privacy Policy

Introduction

Codeshop.ca ("we", "our") is committed to protecting your privacy. This privacy policy explains how we collect, use and protect your personal information in accordance with Canadian and Quebec privacy laws, including Law 25 (Quebec; An Act to modernize legislative provisions as regards the protection of personal information) and PIPEDA (Personal Information Protection and Electronic Documents Act).

1. Information We Collect

1.1 Information You Provide

• Contact forms: Name, email address, phone number, subject and message
• Cody (message bubble): What you type in the conversation (name, contact details, message)
• Security audit request: Name, email, company, website, project description
• Appointment booking: Name, email, phone, desired service, date/time
• Newsletter: Email address only. It is passed to Codeshop's CRM, which keeps the list and the proof of your consent (date, IP address, accepted sentence and its version, then the date and IP of the confirmation). The site itself keeps nothing. You are only subscribed after clicking the link in the confirmation email, and every email carries an unsubscribe link.

1.2 Automatically Collected Information

• Audience measurement (only if you accept): Google Analytics and Microsoft Clarity (pages visited, duration, device, approximate location, browsing recordings) and Vercel Analytics (visit statistics, cookieless). None of these services is loaded before you accept in the banner, or if you decline.
• IP address: It comes with every form submission: it is used to limit the number of submissions (kept in memory only) and is passed to Cloudflare Turnstile to check that you are not a robot. The decoy pages meant for robots log the address of whoever lands on them. Our host, Vercel, also receives the IP address of any visit, like any host.
• Cookieless visit statistics (server side): For each page viewed, our site sends to our own server (a Codeshop computer in Quebec, reached through Cloudflare): the page, the language, the page you came from, your browser and device, your preferred languages, the IP address and the approximate location provided by Vercel. The IP address is used in memory only, for two calculations, and is never stored: 1) finding the approximate city and region with a local DB-IP file (nothing is sent to DB-IP); 2) computing a fingerprint of the day (an HMAC-SHA256 code made from a secret of the day, the IP, the browser and the languages) used to count unique visitors. That secret is replaced and destroyed every day: your visits cannot be linked from one day to the next, and the fingerprint cannot give back the IP. Robots are excluded. No cookie, nothing is written in your browser. Geolocation: IP Geolocation by DB-IP (db-ip.com), under the CC BY 4.0 licence.
• Google Maps: On the Contact page, the map is Google content: it loads when you scroll near it or click "Show the map", and Google then receives your IP address and may set its own cookies.

1.3 Cookies and Browser Storage

This is everything this site writes in your browser. There is no language cookie anymore: the language comes from the page address.

• cookie_consent: Site cookie. Remembers your choice in the banner (accepted or declined). Lifetime: 1 year.
• theme: Browser local storage (localStorage). Remembers your theme choice (the site is dark by default; nothing is stored until you switch themes). Stays until you clear it.
• style: Browser local storage (localStorage). Remembers your illustration style choice (claymation by default; the value "murale" is only stored if you pick the mural style in the footer). Stays until you clear it.
• cody-auto-opened: Session storage (sessionStorage). Keeps the Cody bubble from opening by itself more than once per visit. Gone when you close the tab.
• cody-pages-viewed: Session storage (sessionStorage). Counts the pages viewed during the visit: the Cody bubble only opens by itself from the 3rd one. Gone when you close the tab.
• cody-dismissed: Browser local storage (localStorage). Remembers that you closed Cody, so it no longer opens by itself. No personal data.
• codeshop-visitor-contact: Browser local storage (localStorage), written only after a form or Cody is sent successfully. Keeps your name, email and phone to prefill the fields next time: these details stay in your browser, are sent nowhere, and you erase them with the "Not you? Forget my details" link under the fields, or by clearing this site's data in your browser.
• Cloudflare Turnstile: On the forms and in Cody. Its own cookies or storage data, set by Cloudflare, for the anti-robot check.
• Google Maps: On the Contact page. Cookies that Google may set.
• Google Analytics and Microsoft Clarity: Only after you accept. Cookies set by these services (for example _ga, _ga_*, _clck, _clsk), with lifetimes they decide. Declining later, with "Manage cookies", stops these services and deletes these cookies.
• Vercel Analytics: Only after you accept. Sets no cookie.
• Server-side visit statistics: No cookie and no storage: everything happens on our servers (see 1.2).

2. Use of Your Information

We use your information to:

• Respond to your contact and meeting requests
• Notify us of your request by email and text message
• Measure the site's audience to improve it: cookieless visit statistics for everyone, and the Google, Microsoft and Vercel tools only if you accept
• Protect our site from abuse and robots

3. Consent

The audience measurement tools (Google Analytics, Microsoft Clarity, Vercel Analytics) only load after you accept in the cookie banner; if you decline, nothing is loaded. Our server-side visit statistics (see 1.2) set no cookie, do not keep your IP address and cannot follow you from one day to the next: they work without the banner, to count the site's visits. What you send through a form or Cody is what you choose to send us, so that we can answer you.

Types of consent:

• Audience measurement: Your choice in the cookie banner, which you can change at any time with "Manage cookies" at the bottom of every page
• Forms and Cody: By sending your request, you voluntarily give us what you typed

4. Sharing Your Information

We do not sell, trade or rent your personal information to third parties.

We may share your information with:

• Gmail (Google): an email for every request sent through a form or Cody
• Twilio: a text message to Vincent for every request, with the name, contact details and an excerpt of the message
• Vercel: site hosting, and Vercel Analytics if you accept audience measurement
• Cloudflare Turnstile: anti-robot check on the forms and in Cody (receives your IP address)
• Cloudflare: carries, encrypted, the details of each page viewed (including the IP address) to our statistics server in Quebec, without keeping them for us
• Google Maps: the Contact page map, when it loads
• Google Analytics and Microsoft Clarity: audience measurement, only if you accept in the banner
• Legal obligations: if required by law

These providers may process the information outside Quebec.

5. Security Measures

In accordance with Law 25, we implement appropriate security measures to protect your personal information from loss, theft, unauthorized access, disclosure or alteration.

• Encrypted connection (HTTPS) for the whole site
• Limit on the number of submissions per visitor, anti-robot check (Cloudflare Turnstile) and decoy fields on the forms
• Browser security headers (including a content security policy) that limit where scripts can come from
• Requests received are read only by the person responsible (sole proprietorship, no staff)
• Passwords and service keys kept in a secrets manager, never in the site code

6. Data Minimization and Limitation

In accordance with Law 25, we only collect personal information strictly necessary for identified purposes. We only retain your data for the necessary duration.

Our minimization principles:

• Minimal collection: Only what is necessary
• Determined purpose: Use only for stated purposes
• Limited retention: Only as long as needed to answer and follow up; deleted on request
• No profile: No sign-up, no newsletter, no account

7. Data Retention

In accordance with Law 25, we retain your personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

• Requests (forms and Cody): They are in the responsible person's mailbox. There is no automatic deletion: they are kept as long as needed to answer and follow up, and deleted on request at data@codeshop.ca
• Text messages: The text that notifies us of a request stays in the responsible person's phone history and at Twilio, according to Twilio's rules
• Audience measurement: Retention periods are set by Google, Microsoft and Vercel, only if you accepted
• Server-side visit statistics: Each page view (without IP address) is kept 1 year, then deleted each night; no total is kept beyond that. The secret of the day's fingerprint is destroyed every day
• Cookie choice: The cookie_consent cookie lasts 1 year
• Newsletter: In Codeshop's CRM. An unconfirmed registration is deleted after 30 days. A subscribed address is kept until it unsubscribes; after that, the proof of consent and of its withdrawal is kept, and the address never receives another email

8. Your Rights (Law 25)

In accordance with Law 25 and PIPEDA, you have the right to:

• Access your personal information held by Codeshop.ca
• Correct your information if it is inaccurate or incomplete
• Delete your information (right to be forgotten)
• Request data portability
• Withdraw your consent at any time
• File a complaint with the Commission d'accès à l'information du Québec (CAI)

9. Security Incident Notification

In accordance with Law 25, in the event of a privacy incident presenting a risk of serious injury, we commit to:

• Notify the Commission d'accès à l'information du Québec (CAI)
• Inform you directly if your information is affected
• Take necessary measures to reduce the risk of injury
• Maintain a register of privacy incidents

10. Contact Us

For any questions regarding this privacy policy or to exercise your rights: