Law 25 · Privacy Protection
Privacy Policy
Last updated: November 5, 2026
1. Our commitment
Impact Online ("we", "us", or "the Company") is committed to protecting the personal information it collects in the course of its activities, in accordance with the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Bill 64 (Law 25).
2. Privacy Officer
The person responsible for the protection of personal information within our organization is:
3. Personal information collected
When creating an account:
- First and last name
- Email address
- Store name
When using the service:
- Usage data and access logs
- IP address
- Device and browser information
- Connection data for your online store, such as Shopify (store address, encrypted access tokens)
When you write to us (contact form):
- Name, email address, message and chosen plan, if any
- Where your visit came from (the link or ad campaign that brought you to the site, e.g. UTM parameters), attached to your request
Through cookies:
- Language preferences
- Session data
- Analytics data (if consent given)
- Marketing data (if consent given)
4. Purposes of collection
- Account creation and management
- Service delivery (generating and managing online catalogues)
- Subscription-related communications
- Service improvement (with your consent)
- Compliance with legal obligations
5. Disclosure to third parties
We may share your personal information with the following third parties, only to the extent necessary to provide our services or, for audience measurement and advertising, with your consent. We never sell your personal information.
| Third party | Purpose | Country |
|---|---|---|
| Clerk Inc. | Authentication and account management | United States |
| Cloud hosting provider | Application data storage | Canada |
| Payment processor | Transaction processing | Canada / United States |
| MailerLite | Newsletter and contact request management (including IP address, for fraud and spam prevention purposes) | Lithuania (EU) |
| Google LLC (Google Analytics) | Site audience measurement (pages viewed, device, IP address), with your consent | United States |
| Meta Platforms, Inc. (Meta Pixel) | Conversion measurement and ad targeting on Facebook and Instagram (pages viewed, forms submitted, hashed email address, device, IP address), with your consent | United States |
| Google LLC (Google Ads) | Conversion measurement and ad targeting on Google's networks (pages viewed, forms submitted, device, IP address), with your consent | United States |
6. Retention and destruction
We retain your personal information for as long as necessary for the purposes mentioned above, or as required by law:
- Account data: up to 30 days after account deletion
- Access logs: 12 months
- Analytics data: 14 months
- Where your visit came from, kept in your browser: 90 days
Upon expiry of these periods, information is securely destroyed or anonymized.
7. Your rights
Under Law 25, you have the following rights with respect to your personal information:
| Right | What it means |
|---|---|
| Access | Obtain a copy of your personal information |
| Rectification | Have inaccurate or incomplete information corrected |
| Erasure | Request deletion of your personal information |
| Portability | Receive your data in a structured, machine-readable format |
| Withdrawal of consent | Withdraw your consent at any time, without penalty |
| Objection to profiling | Object to automated decisions made about you |
To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days.
8. Cookies and similar technologies
Our site uses three categories of cookies:
Essential cookies
Required for site operation (session, language preferences). Cannot be disabled.
Analytics cookies
Help us understand how you use the site so we can improve it. Enabled only with your consent.
Marketing cookies
Used by the Meta Pixel and Google Ads to measure the effectiveness of our ads and show you relevant ads on Facebook, Instagram and Google's networks. Meta and Google may link this data to your account with them, if you have one. Enabled only with your consent, which you can withdraw at any time.
We also keep in your browser (local storage, not a cookie), for 90 days, the link or campaign that first brought you to the site. This information does not identify you and is only sent to us if you submit a request through the contact form. You can erase it by clearing the site's data in your browser.
Manage your preferences at any time:
9. Privacy incidents
In the event of a privacy incident presenting a serious risk of injury, we commit to:
- Notifying the Commission d'accès à l'information (CAI) within the prescribed timeframes
- Notifying the individuals concerned
- Recording the incident in our internal register
10. Changes to this policy
We may modify this policy at any time. The last updated date is shown at the top of this document. By continuing to use our services after any modification, you accept the updated policy.
11. Contact us
Impact Online
Email: [email protected]
Commission d'accès à l'information du Québec: www.cai.gouv.qc.ca