Privacy Policy

1. Who We Are

Studio Signal is a web design and marketing studio based in Montreal, Quebec, Canada, serving clients primarily in Quebec and Ontario.

Person responsible for the protection of personal information: Seb Molgat, [email protected]. For the purposes of Quebec's Act respecting the protection of personal information in the private sector (Law 25), and as the individual accountable under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Seb Molgat is the person responsible for personal information at Studio Signal.

2. What This Policy Covers

This policy explains how we collect, use, share, keep and protect personal information on studiosignal.ca and in the tools linked from it: our contact form, the free visibility diagnostic, the compliance scan, call booking, and our client portal. It also explains your rights and how to use them.

If you are a Studio Signal client, Section 3.8 covers your account data in our client portal. If you are a visitor to a website we build or maintain for one of our clients, that client is responsible for your information and their own privacy policy applies; Section 10 explains our role.

3. Information We Collect

3.1 Contact Form

When you use our contact form, we collect your name, email address, website URL (if you give one), and your message. The submission is emailed to us and saved as a lead record in our own database (see 3.5).

3.2 Free Visibility Diagnostic

When you request a visibility diagnostic, we collect your business name, email address, website URL, location, and your answers to the short questionnaire. Our diagnostic tool then visits your public website, looks up your business's public listing (for example on Google Maps), and produces a written report.

The report is drafted with the help of AI language models. We send them your business name, website URL, location, questionnaire answers and what the tool found on your public site. We do not send them your email address. These requests go through OpenRouter, configured to use only model providers that do not retain the data. The report describes your website; it is not a decision about you.

If you tick the box to receive our updates, we record that choice with your request. You can withdraw it at any time by writing to [email protected].

3.3 Compliance Scan and Compliance Sprint

When you run our compliance scan, we collect your business name, email address, website URL and province, and our tool reads the public pages of that website. No AI model is used for the scan. If you order a Compliance Sprint, we also collect the answers you give in the intake form (for example, which tools your organization uses, and your privacy officer's name and email), and Helcim issues your invoice (see 3.8).

3.4 Booking a Call

When you book a call, we collect your name, email address, the date and time you choose, and any notes you add. Bookings are managed in Cal.diy, a scheduling application we host ourselves. The booking is added to our Google Calendar, and if the call is by video, a meeting link is created through Google Meet or Zoom, depending on the option you choose.

3.5 Our Lead Records

Contact form messages, diagnostic and scan requests, and bookings are saved in a lead database on our own server. Leads we follow up on are added to Twenty, a customer relationship management (CRM) application that we also host ourselves. To review new leads quickly, we receive a notification through Telegram that includes the content of your message. When we write to you, we may log that correspondence in our CRM through an email relay hosted by Google.

3.6 Website Analytics

We use Umami, a privacy-focused analytics tool that we host ourselves. It records pages viewed, the referring site, browser and operating system type, device type, and approximate country. On studiosignal.ca it also records where visitors click and how far they scroll, so we can see which parts of a page get used. This is combined into heatmaps. It is not a recording of your visit, and we do not capture your screen, your keystrokes or anything you type into a form. It does not use cookies, does not store your full IP address, and does not follow you across other websites. We also count form submissions (for example, that a diagnostic was requested), without recording your name or email address.

3.7 Cookies

These cookies are needed for the site to work the way you asked it to. We do not use advertising cookies, analytics cookies, or any technology that identifies, locates or profiles you.

3.8 Client Portal (For Our Clients)

If you become a client, we create an account for you in our client portal. We collect and store your name, company name, email address, and the project information you provide there: support tickets, intake form responses, and files or notes exchanged during your project.

• Payments: invoices are processed by Helcim Inc., a Canadian payment processor. We never see or store your full payment card details.
• Contracts: agreements are signed through DocuSeal, a document-signing tool we host ourselves.
• Billing records: invoicing and time records are kept in our own time-tracking and invoicing system, on our own server.

3.9 Email

We send email (form confirmations, diagnostic reports, and for clients, account setup, password resets, ticket updates and invoice notices) through Resend, a delivery service based in the United States. Resend keeps message content and delivery logs for up to 30 days. Our own mailbox is hosted by Proton, based in Switzerland.

3.10 Hosting, Security and Server Logs

Our server is hosted by Oracle Cloud in its Montreal, Quebec data centre. All traffic to studiosignal.ca passes through Cloudflare, which protects the site against attacks and delivers it faster; Cloudflare therefore processes your IP address and request information, and because it handles the secure connection, it can see the content of pages and forms as they pass through. Our server also records IP addresses, timestamps and requested pages in its logs, which we use only for security and troubleshooting.

3.11 Information From Public Sources

We sometimes contact businesses and organizations about our services. For that, we use business contact information they publish themselves, such as the email address on their website or public business listing, and we may run a visibility diagnostic on their public website. When we write to you this way, we say who we are and how we found your contact information, and we stop if you ask us to.

4. Why We Collect This Information

Giving us information is always optional. If you leave out a required field, we simply will not be able to answer, prepare the report, or provide the service you asked for. We use your information only for the purposes above. We do not sell, rent or trade your personal information, and we do not use it for advertising.

5. Who Has Access to Your Information

Inside Studio Signal, only Seb Molgat has access to personal information. Our cal.diy scheduling, lead database, CRM, client portal, e-signature and invoicing tools are self-hosted on our own server; no outside company operates them.

We rely on the following service providers, each only for the purpose listed:

International transfers

Some of your information is therefore processed outside Quebec, and some outside Canada, by the providers listed above. When it is, it is subject to the laws of those places, which may allow government authorities there to access it. We choose providers whose role is limited to the service they provide to us, and we send each one only the information it needs. Your client portal, contract, invoicing, booking and lead records are stored on our own server in Montreal; copies of them are included in our backups.

We may also disclose personal information where the law requires it, for example in response to a valid court order.

6. Your Rights

Under Quebec's Law 25, and under PIPEDA elsewhere in Canada, you have the right to:

• Access: ask what personal information we hold about you and get a copy.
• Correction: ask us to correct information that is inaccurate, incomplete or out of date.
• Withdraw consent: withdraw your consent at any time. If you withdraw consent we need to provide a service (for example, answering a request you made), we may no longer be able to provide it; we will tell you if that is the case.
• Deletion: ask us to delete information we no longer need, or that was collected in a way the law does not allow.
• Portability: receive the personal information you gave us in a structured, commonly used technological format.
• Stop dissemination: ask us to stop disseminating your information, or to de-index a link attached to your name, where the law allows it.
• Know about automated decisions: we do not make decisions about you based only on automated processing. If that ever changes, we will tell you, and you will be able to ask for the reasons and have a person review the decision.

If you are in the European Union or the United Kingdom, you also have the rights given by the GDPR, including the right to restrict or object to processing and to complain to your local data protection authority.

How to make a request

Write to [email protected]. It is free. We will answer within 30 days. We may ask you to confirm your identity before giving you any information, and we will only use what you send for that purpose.

If you are not satisfied with our answer, you can file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) if you are in Quebec, or with the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you are elsewhere in Canada.

7. Data Security

We protect personal information with measures suited to how sensitive it is, including:

• Encrypted HTTPS connections for all traffic to our site and tools
• A hardened server behind a firewall, with administrative access limited to a private network
• Access to personal information limited to Seb Molgat
• Automated backups, encrypted on our server before they are sent to two storage providers (for backups made since September 28, 2026), including a copy that cannot be altered or deleted for 14 days

No system is perfectly secure. If a confidentiality incident (such as unauthorized access to, or loss of, personal information) creates a risk of serious injury, we will promptly notify the Commission d'accès à l'information and the people affected, as Law 25 requires. For people outside Quebec, we will report to the Office of the Privacy Commissioner of Canada and notify affected people where PIPEDA requires it. We keep a register of every confidentiality incident, whatever its seriousness.

8. Data Retention

We keep personal information only as long as we need it for the purposes above, or as long as the law requires. After that, we delete it or make it permanently anonymous.

9. How We Govern Personal Information

Seb Molgat, as the person responsible for the protection of personal information, approves and oversees our privacy practices. In summary:

• Roles: Seb Molgat is the only person at Studio Signal who handles personal information, from collection to deletion.
• Retention and destruction: we follow the periods in Section 8. Client records are flagged for review automatically when their period ends, and deletions are logged.
• New tools: before we adopt a new tool or service provider that handles personal information, we assess what information it receives and where, and we update this policy before using it.
• Incidents: we assess every confidentiality incident, act to reduce the risk of injury, and record it in our incident register.
• Complaints: send any concern about how we handle your information to [email protected]. We acknowledge it, look into it, and answer in writing within 30 days.

10. Our Role for Our Clients' Websites

When we build or maintain a website for a client, that website may collect personal information from the client's own visitors and customers. In that situation, the client is the organization responsible for that information (the "controller" under the GDPR), and Studio Signal acts as its service provider (the "processor"), handling the information only to provide the services the client asked for and according to its instructions.

Clients are responsible for:

• Publishing their own privacy policy on their website
• Obtaining any consent their visitors must give
• Telling us about any access, correction or deletion request we need to help with

Clients who need a written data processing agreement can ask for one at [email protected].

11. Children's Privacy

Our website and services are meant for businesses and organizations, not for children. We do not knowingly collect personal information from anyone under 14. If we learn that we have, we will delete it.

12. Changes to This Policy

We update this policy whenever our practices change, for example when we start using a new service provider. The "Last updated" date at the top shows when it last changed, and the version history at the bottom of this page lists what changed. For significant changes, we will also post a notice on our website, and clients will be told by email.

13. Contact

Studio Signal

Person responsible for personal information: Seb Molgat

[email protected]

Montreal, Quebec, Canada