Privacy Policy

This Policy explains what personal information DraftSignal collects, why it is used, the service providers involved and the choices available to you.

1. Information we collect

• Account: email address, preferred language, verification status, consent versions and dates, and optional marketing preference.
• Authentication and security: one-time verification records, session identifiers, approximate technical connection information, user agent and a one-way hash of the IP address. The verification code expires after 15 minutes; a session normally lasts up to 30 days unless revoked.
• Purchase and access: Stripe customer, checkout, payment and invoice identifiers; product, amount, tax, currency, payment/refund status and entitlement history. Stripe handles card details; DraftSignal does not receive or store the full card number.
• Communications: messages and support requests you send us.
• Analytics: usage events, page interactions, language and device/browser information when analytics consent is granted. We do not use this channel to send names, email addresses or payment details to Google Analytics.

2. Why we use it

We use personal information to create and secure accounts, deliver verification codes, process purchases and refunds, grant or revoke access, provide invoices and receipts, answer support requests, prevent abuse, comply with tax and legal obligations, and improve DraftSignal. Product emails are sent only when permitted, with marketing consent handled separately from essential account and transaction messages.

3. Consent and legal requirements

We collect and use information with your consent, to provide the service you request, and where the law permits or requires it. You may withdraw optional consent at any time without affecting prior lawful processing. Essential account and transaction processing may be required to continue providing paid access.

4. Providers and processing outside Québec

We use service providers such as Cloudflare (hosting, database, security), Stripe (checkout, tax, payments, invoices and refunds), Resend (transactional email), and Google (Tag Manager and consent-based Analytics). They process only the information needed for their services under their own safeguards and terms. Information may be processed outside Québec or Canada, where foreign laws may apply.

5. Cookies and local storage

• ds_session: essential, secure, HTTP-only account session cookie.
• Cloudflare security cookies: essential protection and traffic management.
• ds_consent_v1: stores your analytics choice in the browser.
• Google Analytics cookies: used only when analytics consent is granted. Advertising storage and personalization remain disabled.

You may change your choice at any time using Cookie preferences. Blocking essential cookies may prevent account access.

6. Retention

We keep information only as long as needed for the purposes above. Expired codes and sessions are retained only as reasonably needed for security and audit; account information remains while the account is active; purchase, invoice and tax records are kept for the period required by law; support and consent records are kept only as needed to document and manage the relationship. Information is then deleted or anonymized unless law requires otherwise.

7. Security

We use measures appropriate to the sensitivity of the information, including encrypted transport, secure HTTP-only session cookies, hashed authentication tokens and verification codes, access controls, rate limiting and payment processing through Stripe. No method is risk-free; contact us promptly if you suspect unauthorized access.

8. Your rights

Subject to applicable law, you may request access to or correction of your information, withdraw consent, ask about retention or processing, request deletion where available, or complain about our practices. We may verify your identity before responding. Contact the person in charge at info@draftsignal.ca. You may also contact the Commission d'accès à l'information du Québec.

9. Marketing and children

Marketing consent is optional. Each commercial message must provide a working unsubscribe method; requests are processed within the legally required period. DraftSignal is not intended for children under 14 and we do not knowingly collect their information without required parental consent.

10. Business transactions and changes

Information may be transferred under lawful safeguards as part of a financing, reorganization, merger or sale of DraftSignal or 9559-3828 Québec inc. We will provide notice when required. Material Policy changes will be posted here with a new version date and communicated where required.