Skip to content
Nicolas Cava

Privacy policy

This policy describes how 17900490 Canada Inc., operating as Nicolas Cava, collects, uses, and discloses your information when you use nicolascava.com, and explains your privacy rights and how the law protects you.

1. Introduction

This privacy policy describes how the Company collects, uses, and discloses your information when you use the Service. By using the Service, you agree to the collection and use of information in accordance with this privacy policy.

2. Interpretation and definitions

Interpretation

Words with an initial capital letter have meanings defined below. These definitions apply whether the terms appear in singular or plural.

Definitions

  • Account: a unique account created for you to access the Service or parts of the Service.
  • Company: 17900490 Canada Inc., operating as Nicolas Cava, 6020 rue René-Auclair, G3E 0E2 Quebec City, QC, Canada. For GDPR purposes, the Company is the Data Controller.
  • Cookies: small files placed on your device by a website, containing details of your browsing history among other uses.
  • Personal Data: any information that relates to an identified or identifiable individual.
  • Service: the Website.
  • Usage Data: data collected automatically, either generated by use of the Service or from the Service infrastructure itself, such as the duration of a page visit.
  • Website: nicolascava.com.
  • You: the individual accessing or using the Service, or the company or legal entity on behalf of which that individual is accessing or using the Service.

3. Data we collect

Personal data

When you create an account or purchase a product, we may ask for personally identifiable information. This may include your email address, first name and last name, date of birth, and gender. If you subscribe to the newsletter, we collect your email address.

Payment data

Payment information, such as credit card details, is collected and processed directly by Stripe. We do not store full credit card numbers. We receive and store your Stripe customer ID, payment intent ID, transaction amount, and currency for record-keeping.

Usage data

Usage data may include your browser type and version, the pages you visit, the time and date of your visit, the time spent on pages, unique device identifiers, and diagnostic data.

Location data

If you grant permission, we may collect and store your approximate geographic location, including latitude and longitude, to provide location-relevant features. You can enable or disable location services at any time through your device or browser settings.

4. Cookies and tracking technologies

Session cookie

The site uses a single essential cookie named session to maintain your authentication state. It contains an encrypted JWT with your user ID and expiration date. The cookie is HttpOnly, Secure, and SameSite: Lax, and expires after 7 days by default, or 30 days if you select "Remember me".

Analytics cookies

Third-party analytics services may set their own cookies to track usage patterns. These cookies are governed by the respective third-party privacy policies.

5. How we use your data

We use your data:

  • To provide and maintain the Service, including monitoring usage and managing your account.
  • To process transactions, including purchases and payments.
  • To contact you by email for transactional purposes, such as password resets and purchase confirmations.
  • To send the newsletter when you subscribe.
  • To manage your requests and respond to inquiries.
  • To improve the Service, by analyzing usage patterns, performance metrics, and error logs.

6. Third-party service providers

We share data with third-party providers to operate the Service. Each provider processes data according to its own privacy policy.

  • Stripe: payment processing. Your email, payment details, and transaction information are sent to Stripe when you make a purchase. Stripe privacy policy.
  • Resend: transactional email and the newsletter. Your email address is shared with Resend to send account emails and manage newsletter subscriptions. Resend privacy policy.
  • Google Analytics 4 (Google): We use Google Analytics to measure visits and understand how visitors use this website. On a visit, the Google tag may set first-party cookies and send Google a client identifier and information such as the pages visited, the referring page, session and interaction data, approximate location, and browser or device information. This information may be processed outside Québec. How Google uses information from sites that use its services.
  • Cloudflare: hosting and server logs. Logs may contain your IP address, the pages requested, and error traces. Cloudflare Web Analytics measures aggregate, cookieless traffic. Cloudflare privacy policy.

7. Data retention

We retain personal data only as long as necessary for the purposes set out in this policy, and as needed to comply with legal obligations, resolve disputes, and enforce our agreements.

  • Account data is retained as long as your account is active.
  • Purchase records are retained for accounting and tax purposes as required by applicable law.
  • Password reset tokens expire after 1 hour and are deleted after use.
  • Logs and analytics data are retained according to the third-party providers' retention policies.

8. Data security

  • Passwords are hashed using bcrypt and never stored in plain text.
  • Sessions are managed with encrypted JWT tokens.
  • All data is transmitted over TLS/HTTPS.
  • Payment data is handled entirely by Stripe and never touches our servers.

That said, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Your privacy rights

General rights

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure: request deletion of your personal data, subject to legal retention requirements.
  • Portability: request your data in a structured, commonly used, machine-readable format.
  • Objection: object to processing under certain circumstances.
  • Withdraw consent: where processing is based on consent, you may withdraw it at any time.

For users in the European Economic Area (GDPR)

We process personal data on three legal bases: contract performance (account management and purchases), legitimate interest (improving and securing the Service, including analytics and logging), and consent (optional data collection such as location data). If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority.

For users in California (CCPA/CPRA)

California residents have the right to know what personal data is collected and how it is used, to request deletion of personal data, and to opt out of the sale or sharing of personal data. We do not sell Your Personal Data. You may not be discriminated against for exercising your privacy rights.

For users in Canada (PIPEDA)

Canadian residents have the right to access the personal data we hold, request corrections, and withdraw consent for collection, use, or disclosure, subject to legal or contractual restrictions.

10. Children's privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and become aware that a child has provided us personal data, please contact us so we can remove the information.

11. Changes to this privacy policy

We may update this privacy policy from time to time. Changes are posted on this page with an updated "Last updated" date. You are advised to review this policy periodically.

12. Contact us

For privacy questions or to exercise your rights, contact hello@nicolascava.com.

17900490 CANADA INC., OPERATING AS NICOLAS CAVA, DATA CONTROLLER
6020 RUE RENÉ-AUCLAIR, G3E 0E2 QUEBEC CITY, QC, CANADA
NICOLASCAVA.COM