Privacy Policy

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information at tonsiteweb Inc. can be reached at info@tonsiteweb.io. Any question, access request or complaint regarding your personal information may be addressed to them.

2. Information we collect

We only collect the information necessary for the purposes described in this policy:

• Information you provide voluntarily: name, email address, phone number and details about your business or project, notably when you book a call or contact us.
• Technical data processed by our servers: IP address, device and browser type, requested page, date and time. It is used to deliver and secure the site. Optional navigation measurements are collected only after the corresponding choice.
• Client portal data: account identity, access rights, optional profile photo and aggregate statistics for the websites assigned to the account.

3. Purposes

Your information is used to:

• Respond to your requests and schedule the calls you book;
• Provide our services and manage our business relationship with you;
• Authenticate portal users and show them only data for websites assigned to their account;
• Improve our website, content and services;
• Send you, with your consent, commercial communications, which you can opt out of at any time.

4. Consent

Consent is requested separately for external features and analytics measurement. Refusing a category does not prevent use of the public site.

You may withdraw consent at any time through “Manage cookies” at the bottom of every page. The external calendar then stops loading. You can also clear site data in your browser settings.

5. Disclosure to third parties and hosting

We never sell your personal information. Our main processors are Vercel (hosting and technical logs), Sanity (content), Supabase (portal authentication, database and storage), HighLevel/LeadConnector — operated in part through links.tonsiteweb.io — (calendar and CRM), PostHog (audience measurement of this site after consent, and measurement of client websites displayed in their portal), and Resend (delivery of requested reports). Each receives only the data required for its mandate.

Some of these providers may be located outside Quebec, notably in the United States. Before transferring personal information outside Quebec, we carry out the required assessments and ensure it receives adequate protection, in accordance with Law 25.

6. Retention and security

We keep each category of information only for as long as needed for its stated purpose, then as required by applicable tax, contractual or legal obligations. The period for each system and the person responsible for deletion must be recorded in our internal retention schedule. At the applicable expiry, data is securely destroyed or anonymized.

We implement reasonable security measures (restricted access, encrypted communications, reputable providers) to protect your information against unauthorized access, use or disclosure.

7. Cookies

Necessary: the consent choice is stored locally for no more than twelve months. The portal uses Supabase session cookies that are HttpOnly, Secure in production and SameSite=Lax, with a technical maximum lifetime of 400 days; they are used only for authentication and are renewed or deleted on sign-in/sign-out.

External features: with your permission, the HighLevel/LeadConnector integration loads the calendar in an isolated iframe and may use its own cookies for the booking session.

Analytics: with your permission, PostHog (hosted in the United States) measures site traffic and usage: page views, sources and interactions such as clicks on buttons and links, tied to a pseudonymous identifier stored on your device. No typed text is captured and no sessions are recorded. It never loads before you consent, the category remains off by default, and withdrawing consent deletes the identifier and ends the measurement.

Marketing: with your permission, a tracking script from our client management system (HighLevel/LeadConnector, served from links.tonsiteweb.io) connects your visits and bookings to your file so we can follow up on your request. It never loads before you consent, and withdrawing consent ends the tracking. A booking submitted in the calendar may also create or update a record in HighLevel/LeadConnector so we can process your request.

8. Calendars and external previews

No external calendar loads before you allow the “External features” category. An email alternative is offered without loading the provider.

Interactive portfolio previews are websites operated by our clients, loaded in an embedded frame as soon as the page displays. Their operator then receives the technical data normally sent during a visit (including IP address, browser and referrer) under its own privacy policy.

9. Your rights

Under Quebec law, you have the following rights, among others:

• Right of access to the personal information we hold about you;
• Right to rectification of inaccurate, incomplete or ambiguous information;
• Right to withdraw your consent to the use or disclosure of your information;
• Right to request de-indexation or cessation of dissemination, in the cases provided by law;
• Right to portability of your computerized personal information.

10. Complaints

To exercise your rights or file a complaint, write to us at info@tonsiteweb.io. If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

11. Changes

We may update this policy at any time. The current version is published on this page with its update date. Significant changes will be clearly indicated on the site.