the fine print

Privacy Policy

Last updated: September 24, 2026

We collect as little personal information as we can, use it only to work with you, and never sell it. This policy explains exactly what we collect on catlas.ca and in the Catlas client portal, why, and the choices you have.

01Who we are

Catlas is a web design agency for local businesses. This policy covers our website, catlas.ca, and our client portal at portal.catlas.ca. It does not cover the websites we build for our clients; each of those has its own privacy policy.

The person responsible for protecting personal information at Catlas is our Privacy Officer, who you can reach at privacy@catlas.ca or through the contact form on our website.

02Browsing catlas.ca

Our website has no advertising and no tracking cookies, and we never follow you across other sites. We do not build profiles of visitors.

Like every website, some technical information is processed so the site can be delivered:

• Hosting. Our host, Vercel, records standard server logs (such as your IP address, browser type and the pages requested) to deliver the site and protect it against abuse.
• Visit counts and page speed. We use Vercel Web Analytics and Speed Insights to count visits and measure how fast our pages load, so we know which pages help and what to improve. They record things like the page viewed, the site you came from, your country, your type of device and browser, and loading times. They set no cookies and do not identify you: a visitor is recognised only by a scrambled code that is discarded after 24 hours.
• Your language choice. If you pick a language with the EN | FR switch, we save that choice for one year in a small cookie (catlas_lang) so the site opens in your language next time. It holds only “en” or “fr”, is never used for tracking, and you can clear it any time in your browser.

03When you contact us

When you use our contact form, we receive your name, email address, business name (if you give one) and your message. It is delivered to our inbox by email, and we use it only to reply to you, discuss your project, and keep a record of our conversation.

To stop spam, the form briefly records a scrambled, one-way code made from your IP address (never the address itself) so the same visitor can’t send a flood of messages in a few seconds.

04Working with us

During a project you may share content, images, business details, and access to accounts such as your domain, hosting or CRM. We use this only to deliver the work you hired us for, keep it confidential, and stop using any access once it is no longer needed.

05The client portal

The portal at portal.catlas.ca is used only by our clients to update their own menus and announcements. To make it work:

• Sign-in email. You sign in with a 6-digit code or a one-time link, both sent to your email address. Either one works only once and expires after 20 minutes.
• How we store your email. Your address is stored only as a salted, one-way hash, not as readable text. We can check that it matches when you sign in, but it cannot be read back from our records.
• Cookies. The portal uses two strictly necessary cookies: one that keeps you signed in (it lasts 90 days and renews while you keep using the portal) and one that remembers your language choice. Neither is used for tracking.
• Your uploads. Menus, files and messages you publish through the portal are stored so they can appear on your website. They are public once published; that is their purpose.
• Visit counts and speed. The same cookie-free Vercel tools count portal visits and measure its speed. The addresses they record never include sign-in links or codes.

06How we use personal information

We use personal information only to:

• reply to your enquiries and provide our services;
• let clients sign in to the portal and publish their content;
• keep our website and portal secure and working;
• meet our legal and accounting obligations.

We do not use it for advertising, and we do not sell, rent or trade it to anyone.

07Who we share it with

We rely on a small number of trusted providers that process information on our behalf, only as needed to run our services:

• Vercel: hosts our website and portal, stores portal content, and counts visits and measures page speed without cookies;
• Resend: delivers contact-form messages to our inbox, and portal sign-in emails;
• Google: our business email (Google Workspace).

We may also disclose information when the law requires it. We never share it for anyone else’s marketing.

08Where your information is stored

Some of our providers store or process information outside Quebec, including in the United States. Before relying on any provider, we check that it protects personal information to a standard appropriate to its sensitivity, and we choose providers that commit to strong security.

09How long we keep it

We keep personal information only as long as we need it for the purpose it was collected (for example, for the length of a project and a reasonable period afterwards for our records) or as long as the law requires. After that, we delete it or make it anonymous.

10How we protect it

We use encrypted connections (HTTPS) across our website and portal, single-use, time-limited sign-in codes and links, hashed email addresses in the portal, and access limited to the people who need it. No system is perfectly secure, but we take care to protect what you entrust to us, and we will notify you and the relevant authorities if a privacy incident creates a risk of serious harm.

11Your rights

You can ask us at any time to:

• tell you what personal information we hold about you and how it is used;
• correct information that is inaccurate or incomplete;
• delete your information, or withdraw your consent to its use.

Email privacy@catlas.ca or send your request through our contact form, and we will respond within 30 days. If you are not satisfied with our answer, you can contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

12Children

Our services are meant for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 14.

13Changes to this policy

We may update this policy as our services change. The date at the top shows when it last changed, and significant changes will be highlighted here.