Privacy notice
What Maison Medina collects, why, where it is kept, and for how long.
This notice is written under British Columbia’s Personal Information Protection Act. Maison Medina is a jewellery atelier in Victoria, British Columbia.
Your commission records, messages and uploaded files are stored in Canada, on servers in Montreal. Some supporting services, listed below, process data outside Canada.
What we collect
When you make an enquiry. Your name and email address, what you are imagining, the occasion and timeline if you tell us, and whether an heirloom is involved. Budget is recorded as a range you choose and never as a figure you type. We also record which page you arrived from, a one-way hash of your network address, and your browser’s description of itself.
When you write to us. Your name, address, subject and message, with the same hash and browser description.
When you have an account. Your name, the name you prefer to be called, your email address, and your notification preferences. Your commission records: reference, description, stage, dates, amounts, and carrier and tracking details once it ships. Messages you exchange with the atelier. Photographs and documents you upload.
What we never collect. Payment card details never reach this site. We do not use advertising or cross-site tracking. Your actual network address is never stored, only a keyed one-way hash of it, which cannot be turned back into an address.
Why
To answer your enquiry, to make what you commissioned, to keep you informed while we do, and to keep the records a business is obliged to keep. We use the hashed network address to limit abuse of the forms, and nothing else. We do not sell personal information, and we do not share it except with the processors named below.
How long we keep it
These are enforced by scheduled jobs, not by intention.
Hashed network addresses: 30 days, then removed from every record that holds one.
Enquiries: 24 months after we close them.
Messages sent through the contact form: 12 months after we close them.
Our record of changes to a commission: 7 years, for tax and dispute purposes. The network hash is removed from it at 30 days like any other.
Closed accounts: 30 days, then permanently removed.
Closing your account
You can close your account yourself, from your account page. Nothing is deleted for thirty days and you can reopen it at any point during them. After thirty days your name, contact details, messages and uploaded files are permanently removed.
Order records are kept, with you detached from them. The reference, the dates and the amounts remain, because there is a business and tax obligation to retain a record of a transaction. They no longer carry your name and are no longer linked to you.
Your rights
Under PIPA you may ask what personal information we hold about you and how it has been used, and you may ask us to correct it if it is wrong. We answer within thirty days. PIPA does not give a general right to have information erased, but we have built account closure anyway, and it is described above.
Who processes data for us
PIPA expects each one named, rather than a phrase about trusted partners.
Supabase: database, file storage and sign-in. Your records and files are held in Montreal, Canada.
Vercel: hosting. Serves pages worldwide; requests may be handled outside Canada.
Cloudflare: Turnstile, which tells a person from an automated script on our forms. Processes outside Canada.
Google (Workspace): delivers our email. Processes outside Canada.
Plausible Analytics: counts page views without cookies and without profiling. Processes in the European Union.
Sentry: tells us when something breaks. Configured to strip email addresses, message content and credentials before anything leaves this site. Processes outside Canada.
Security
Every record is isolated at the database level, so one client’s commission cannot be reached from another’s account. Uploaded files are scanned before anyone can see them and are never public. Passwords are checked against known breached passwords before they are accepted. Every change made in the atelier is recorded with who made it.
If a breach ever affected you, we would tell you directly and in plain language, and report it to the Office of the Information and Privacy Commissioner for British Columbia where the law requires it.
Contact
Our privacy officer is [name to be confirmed], reachable at bonjour@maisonmedina.ca, or by post at Maison Medina, Victoria, British Columbia.
If you are not satisfied with our answer you may complain to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.