Privacy Policy (Quebec Law 25)

1. Person in charge of personal information protection

Name / function: SamSwell Privacy Officer

Contact: confidentialite@samswell.ca

2. Information we collect

We process account and contact information, delivery addresses, order and subscription history, custom soap selections, consent records, privacy requests, and technical information needed to operate and protect the service. Stripe handles card details; our application stores payment identifiers, not full card numbers.

3. Purposes of use

• Process and confirm orders
• Ensure secure payment processing
• Maintain accounting and operational records
• Respond to customer requests

4. Providers and transfers outside Quebec

We use Supabase for accounts and data, Stripe for payments, Render for hosting, Upstash for request limits, and Resend or ZeptoMail for transactional email. Sentry may be used for error monitoring when enabled. Processing locations depend on each service and its configuration; a Canadian database does not guarantee that all processing stays in Quebec or Canada. Contact us for details about the providers and transfers applicable to your information.

5. Retention

Order data is kept only for the period required by legal, tax, and administrative obligations, then deleted or anonymized according to internal practices.

6. Your rights

Under Quebec Law 25, you may request access, correction, or deletion of personal information, subject to applicable legal obligations.

To exercise these rights, write to: confidentialite@samswell.ca

7. Privacy incidents

If an incident creates a risk of serious harm, we follow Law 25 notification obligations and maintain an incident register.

8. Access, correction, and deletion requests

You can submit a request directly from your account in the "Privacy controls" section (data export and deletion request), or by writing to confidentialite@samswell.ca. We will respond within the timelines required by applicable law.