Cette entente, ainsi que toutes les politiques et tous documents y étant rattachés, ont été rédigés en anglais selon la volonté expresse des parties, les parties reconnaissant avoir d’abord pris connaissance de sa version française disponible sur la page suivante de notre site internet: Politique de Confidentialité
9327-2920 QUÉBEC INC., operating under the name Image Salon (“Image Salon”, “we”, “our”), operates the website imagesalon.com (the “Website”), the Image Salon client dashboard (the “Dashboard”), and the services described in our Terms of Service.
We place great importance on the protection of your Personal Information. This privacy policy (the “Policy”) explains what we collect, why, who we share it with, and what rights you have.
This Policy does not apply to Personal Information concerning our employees and subcontractors.
1. What we mean by Personal Information
“Personal Information” means any information relating to an individual that allows, directly or indirectly, their identification.
We collect only the Personal Information necessary to establish, manage, and maintain our relationship with you.
2. What we collect
When you create an account
First name; last name; email address; phone or mobile number; physical address; company name; timestamp; information about your operating system and user agent; login cookies.
When you place an order
Order data; timestamp; payment data — processed by a third party, namely Stripe or PayPal, and not stored on our servers; user agent; login cookies.
For Post-Production Services
Presets and editing preferences; images; the settings and adjustments applied to them; information needed to establish an editing profile.
For Web Design Services
The material you provide through onboarding so we can build your site: photographs, logo files, existing website copy, brand materials, inspiration references, and your answers to our intake questions. Once your site is live, we also process operational data about the site — traffic, uptime, and error logs.
When you contact us
The content of your messages through the Dashboard’s support and help features, by email, or by phone, and our replies.
Through a website we host for a client
Where we build and host a website for a Web Design client, that site collects information about and from the people who use it: the name, email address, telephone number where given, and message content of anyone who fills in a form, and measurement data about visits to the site.
That information belongs to our client, not to us, and we handle it on their behalf. Section 6 sets out how.
We may also collect Personal Information directly during email, phone, or in-person interactions with our employees or representatives.
3. Your consent
Your consent to the collection, use, or disclosure of your Personal Information must be clear, free, and informed, and given for the purposes identified in this Policy.
Depending on the nature and sensitivity of the information, consent may be explicit — given verbally, in writing, or electronically — or implicit, such as when you voluntarily provide information.
BY USING OUR WEBSITE AND SERVICES, YOU CONSENT TO THE COLLECTION, USE, DISCLOSURE, AND STORAGE OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THIS POLICY.
Unless the law requires otherwise, you may withdraw your consent at any time with reasonable notice. If you do, some features may become unavailable and we may be unable to provide certain services.
4. How we use it
We use Personal Information only to:
provide the Website, the Dashboard, and the Services, and keep them running;
identify you and verify your identity;
open and manage your account, and identify your preferences;
complete your transactions (payment is handled by Stripe or PayPal, each subject to its own terms);
track and fulfil your orders;
design, build, host, and operate your website;
provide technical support and answer your questions;
send you information and promotional offers — you can opt out at any time using the unsubscribe link in any email;
obtain statistics on use of the Website and our services;
produce aggregate, de-identified statistics about the websites we host, as described in section 6; and
develop and train models, within the limits described in section 5.
We may also use Personal Information in accordance with our Terms of Service.
5. Using your material to train AI models
We use AI in both services, and we train models on the work. The scope differs between them.
Post-Production. Where you send us photographic material for post-production, our Terms of Service (Schedule A, section 6) grant us, our Affiliates — including PHAiTO — and our outside Partners a licence to use that material, and statistical data derived from the corrections made to it, to train algorithms and develop models, including through neural network techniques. This is what makes Ai Profile Setup possible.
Web Design. We use AI tools to design and build websites, and we use the material you provide together with the design work produced from it to develop and train our own design models (Schedule B, section 10). What we learn from is design data — layout, structure, typography, spacing, colour, and component patterns — rather than your photographs as images. This licence runs to us and our Affiliates only; unlike Post-Production, it does not extend to outside Partners, and it does not extend to the text our client writes and publishes on their own site. We learn from how a page was built, not from what it said.
Neither licence reaches information collected through a client’s website. We do not use the content of inquiries sent through a site we host, or the personal information of the people who send them, to develop or train any model. See section 6.
Models already trained cannot be untrained.
6. Information we hold for our web design clients
This section is about information that is neither ours nor our client’s own personal information. It is the information of the people who visit and contact a website we host.
Our client is responsible for it. They decide what their site asks for and why. We hold and move it on their behalf and on their instructions, to run their site and for nothing else, on the terms set out in Schedule B, section 11 of our Terms of Service.
Inquiries. Forms on a client’s site are delivered by email to the address that client gives us. We do not keep the message. We record that an inquiry was sent and the page it came from, so the client’s dashboard can count it. If we later hold inquiries for clients inside the dashboard, we will say so here before we begin.
Measurement. We measure visits to the sites we host so our clients can see traffic and inquiry figures for their own site. We do not currently place analytics cookies or similar identifiers on visitors to client websites. If that changes, we will update this Policy and tell our clients before it begins. Our Cookie Notice covers only imagesalon.com and the Dashboard. We do not promise that a client site uses no cookies or needs no consent banner.
Aggregate statistics. We may combine measurements across the sites we host to produce aggregate, de-identified statistics, and we may use and publish those. They never identify a client, a site, or a visitor, and we do not attempt to reverse them.
No training. We do not use this information to develop or train models. See section 5.
Retention. We hold it for as long as the client’s subscription is active. After cancellation it is part of the client’s content export, which they may request for ninety (90) days after their site goes offline; we deliver within thirty (30) days of the request. Once that window closes we delete it. Copies may remain in backups, as described in section 10.
If you are one of those visitors. If you contacted a photographer through a site we host and you want a copy of your information, a correction, or its deletion, ask them: the information is theirs and the answer is theirs to give. If you cannot reach them, write to us at the address in section 15 and we will pass your request on and help where we can.
Client notices. Each client is responsible for the privacy policy and cookie notice on their own site, and for their factual accuracy. We build those pages when a client requests them and provides the legal copy; we do not write that copy, and nothing we give a client is legal advice.
7. Who we share it with
We may disclose Personal Information to third parties only in the circumstances below. Those third parties are obliged to keep it confidential and may not use it for any other purpose.
Subcontractors, agents, and service providers. We contract with providers to deliver or improve our services — including payment processing, website hosting, email delivery, and analytics. Our contracts require them to: use only the Personal Information necessary to provide the service; not disclose it without our consent; implement rigorous security measures; allow us to audit those measures; notify us immediately of any confidentiality incident; and destroy the information at the end of the contract.
A party to a commercial transaction. In connection with the sale or lease of all or part of our business or assets, a change in our legal structure, a loan or other financing, or a security granted over our obligations. The other party is contractually bound to use only what is necessary, secure it, not disclose it, notify us of incidents, and destroy it if the transaction does not complete.
Legitimate authorities. To comply with a court order, a valid search warrant, or a regulatory authority. In general we refuse access unless the request is legally binding.
Our lawyers. To ensure our defence or assert our rights. Both the law and our engagement letters require our lawyers to protect the confidentiality of those communications.
Whenever we disclose Personal Information, we make every effort not to disclose more than is necessary in the circumstances.
8. Where it goes
We may disclose Personal Information outside Quebec, in particular to the United States and elsewhere in Canada.
Before doing so we conduct a privacy impact assessment considering the sensitivity of the information, the purpose of its use, the protection it will receive, and the legal framework where it will be held. We proceed only if that assessment shows the information will receive adequate protection in accordance with generally recognised principles, and only under a written contract reflecting the assessment’s findings.
9. Security
Information security is a priority, but no method of transmission over the internet or electronic storage is completely secure. We use commercially acceptable means to protect your Personal Information but cannot guarantee its absolute security.
Administrative measures. Policies framing the use, disclosure, retention, and destruction of Personal Information; defined roles and responsibilities across its lifecycle; a complaints process; limited retention periods; role-based access controls; and procedures to manage and revoke access.
Technical measures. TLS/SSL encryption in transit; access management for authorised personnel and for data subjects; network monitoring; backups; digital certificates; username and password authentication; firewalls.
All employees who handle Personal Information are bound by confidentiality obligations, have received appropriate training, and can access only what their duties require. Our governance policies provide for sanctions in the event of a breach.
10. Retention
We retain Personal Information only as long as necessary to achieve the purposes for which it was collected, unless legal or contractual requirements demand longer. On request we can tell you the retention period applicable to your information.
Post-production files. Files submitted for processing are stored only as needed to provide the service and are deleted periodically once the work is complete. Keep your own copies.
Web design material. Material you provided for your website, and material you created on it, is retained for as long as your subscription is active. After cancellation you have ninety (90) days from the site going offline to ask for it, and we deliver within thirty (30) days of the request. See Schedule B, section 9. We retain a non-downloadable internal restoration copy for six (6) months after the site goes offline, solely to support an agreed reactivation. That copy does not extend the ninety-day export-request window.
Material sent before a subscription begins. Where you send us onboarding material and do not go ahead, we keep it for three (3) months so you can resume, and delete it sooner on request. See Terms of Service, section 5.
Information collected through a client’s website. Held for as long as the subscription is active, then available in the client’s content export for ninety (90) days after the site goes offline, and deleted once that window closes. See section 6.
Drafts. Unsent and unpublished material in your account is kept for as long as your account is open and is deleted with it. Drafts on a web design client’s website follow the web design retention above (Schedule B, section 12).
Your data may remain in our backups after account deletion but will no longer be accessible through the Website. Backups are rotated and deleted periodically. Where you request deletion, we make reasonable efforts to comply as soon as possible, and within thirty (30) days of the request.
11. Your rights
You have the right to:
be informed about the use, disclosure, retention, and destruction of your Personal Information, as set out in this Policy;
access your Personal Information and obtain further detail about how we handle it;
object to, restrict, or withdraw your consent to those operations, on reasonable notice;
have inaccurate or unclear information corrected, and incomplete information completed;
have your Personal Information deleted, subject to our legal obligations;
be informed of any privacy incident concerning your Personal Information that may cause you serious harm. We maintain a register of all privacy incidents and assess the harm they may cause.
Exercise these rights by signing in to your account and using the account page, or by emailing the address in section 15. Your request must contain enough detail to identify the information concerned and any correction sought. We respond within thirty (30) days, unless the law permits an extension.
If we refuse to provide or correct your information, we will give you the reasons, information about your recourse, and the applicable provisions of the law. Where we refuse a correction, you may attach written comments to your record, and we will retain the information concerned for as long as necessary for you to exhaust the remedies available.
12. Cookies
Our Website and Dashboard use cookies and similar technologies. What we use them for, how they are grouped, and how to control them is set out in our separate Cookie Notice.
13. Children
Our services are not intended for individuals under the age of 18 and we do not knowingly collect Personal Information from minors. If you are a parent or guardian and believe your child has provided us with Personal Information, contact us. If we learn we have collected such information without verified parental consent, we will take steps to remove it.
14. Changes to this Policy
We may update this Policy from time to time. Changes are posted on the Website and take effect when posted. The date of the current version appears at the top. If we make significant changes we will notify you at the email address you have provided, and bring them to your attention when you next sign in.
15. Privacy Officer
The Privacy Officer for Image Salon is Victoria Dimaano.
For any question or request relating to this Policy: info@imagesalon.com
16. Applicable law
This Policy is intended to comply with Canadian and Quebec law on the protection of personal information and, where applicable, California law and the European General Data Protection Regulation (EU/2016/679). Depending on the constraints applicable in those jurisdictions, and which you have informed us of, we will adapt our practices where necessary.
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) governs the processing of personal information received from foreign countries, in addition to the provincial law applicable in Quebec. The European Union recognizes Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) as providing adequate protection. This means a Canadian organization need not enter into the European Standard Contractual Clauses when entering into an agreement with a European organization.
Language. This Policy has been written in English at the express wish of the parties, the parties acknowledging having first read the French version available on our website.