Privacy Policy
Studio Envol · Effective [À COMPLÉTER : date d’entrée en vigueur] · Last updated: October 28, 2026
This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with and how you can exercise your rights. It applies to the Studio Envol website, its demo request form and any exchanges you have with us by email, phone, text message or Messenger.
Who we are and who to contact
Studio Envol is a web design studio for local businesses in Quebec and Labrador. We are responsible for the personal information we hold.
Person in charge of the protection of personal information: Théo Isabel, founder of Studio Envol. For any questions about this policy or your information, contact him:
- Email: studioenvol7@gmail.com
- Phone: 581-231-5444
- Mailing address: 2 Rue du Cosmos, Fermont, QC G0G 1J0
Québec enterprise number (NEQ): [À COMPLÉTER : NEQ, si l’entreprise est enregistrée]
The information we collect
Through the “Get my free demo” form, we collect what you enter:
- Your name
- Your business name
- Your current website, if you have one (optional)
- Your type of business
- How you want us to reply (email, phone call, text message or Messenger) and the matching contact detail: your email address, your phone number, or your Messenger name or link
- Your message, if you write one (optional)
- Your consent (the box you check)
When you send the form, our form tool, Web3Forms, also receives technical data: your IP address, the date and time of the submission, the page it was sent from and that page’s language. When you check the consent box, the website loads the Web3Forms tool and the anti-bot service hCaptcha: their servers then receive your IP address and technical data about your browser, and hCaptcha may also collect usage signals, even if you don’t send the form (see “Who we share it with” and “Cookies and other technologies”).
If you contact us directly by email, phone, text message or Messenger, we also receive the contact detail you use (email address, phone number or Messenger name) and the content of your messages. If we talk on Messenger, according to Meta, we also see some of your profile information, such as your profile photo, gender, the country and language chosen in your settings, and your time zone (see “Who we share it with”). We only ask for what we need to reply to you and prepare your demo.
Why we collect it
We use your information only for the following reasons:
- To reply to your request, using the method you chose
- To prepare the demo of your new website
- If you become a client, to carry out our contract and meet our legal obligations, such as tax obligations
We do not sell your information. We do not use it for advertising. We do not use it for any other purpose without your consent, unless the law requires it.
How we collect it
We collect your information in two ways: when you fill out and send the demo request form, and when you contact us directly by email, phone, text message or Messenger. Our providers also collect the technical data described above. Before sending the form, you check a box to give your consent.
By sending the form after reading this policy, you agree that we may use your information for the reasons described above, and share it with the service providers named below for those same reasons.
You can withdraw your consent at any time by writing to studioenvol7@gmail.com. We will then stop using your information. Without it, however, we won’t be able to reply to you or prepare your demo.
Prefer not to use the form? You can reach us directly by phone, text, email or Messenger using the “Or reach us directly” buttons. As long as you don’t check the consent box, Web3Forms and hCaptcha receive nothing from you.
Who we share it with
Your information is shared with the following service providers, or collected directly by them, to run the website, the form, our email, our phone and Messenger:
- Web3Forms (Web3Creative, a company based in India): our form tool. It receives what you enter and the technical data from your submission, then forwards your request to us by email. According to Web3Forms, its data is hosted on Amazon Web Services (AWS), and its documentation lists servers in the United States. It also relies on its own subcontractors, including Cloudflare and Hetzner (Germany and Finland). To filter spam, it may send your IP address and email address to CleanTalk and Akismet, located in the United States and elsewhere in the world.
- hCaptcha (Intuition Machines, Inc., United States): the anti-bot service built into our form tool. It checks that the form is being filled out by a person, not a bot. According to hCaptcha, it collects technical data (IP address, browser, device, operating system, internet provider, date and time) and usage signals (mouse movements, scrolling, keystrokes, touch gestures). If you are shown a challenge, hCaptcha may share your answers with its customers who buy this kind of data; according to hCaptcha, those answers are not linked to an identified person. Its data is processed and stored in the United States, and may also be processed in other countries where it has facilities or providers.
- Google (Gmail): our email inbox. Requests sent through the form land there, as do your emails. According to Google, messages are stored in its data centres and encrypted in transit and on its servers. Google does not say where a given email is stored. According to its official list, its data centres are in the United States, South America, Europe and Asia. According to Google, Gmail does not read the content of messages to show ads.
- Cloudflare (Cloudflare, Inc., United States): our website host, through its Cloudflare Pages service. Our website is served from Cloudflare’s global network. According to its privacy policy, Cloudflare processes your interactions with our website when you visit it; this information may include your IP address, traffic routing data, system configuration information and other information about traffic to and from our website. It also derives data from this traffic (such as threat scores for IP addresses), which it uses in particular to detect and block malicious activity. According to Cloudflare, its data centres are located in more than 330 cities around the world, including several in Canada, such as Montréal and Toronto. Its policy states that it stores the information it collects mainly in the United States and the European Economic Area, and that it may access it from anywhere in the world. The policy does not give a specific retention period for visitors’ data.
- Phone call, text message or Messenger: if you choose one of these, in the form or with the direct contact buttons, our conversations go through those services. Calls and text messages to 581-231-5444 go through TELUS (TELUS Communications Inc.), our mobile phone provider. According to TELUS, it collects, among other things, phone numbers and the date, time and length of calls, and it reviews the date and time of text messages sent and received, but it does not collect the content of conversations, except voicemail messages (so they can be delivered), or the content of text messages. Also according to TELUS, this information is stored and processed in Canada or in other countries and, in either case, it may be available to foreign government agencies under applicable law. TELUS does not publish a specific retention period.
- Messenger goes through Studio Envol’s Facebook Page and belongs to Meta (Meta Platforms, Inc., United States). According to Meta, it collects messages, including their content, and conversations with a business are not end-to-end encrypted. Meta also states that it may use messages exchanged with a Page to personalize your ads and improve features such as translation and AI: this is Meta’s practice, not Studio Envol’s.
- According to Meta, when you write to our Page, we see your name, profile photo, gender, the country and language chosen in your settings, your time zone, whether you use Messenger or Instagram and, if you have made them public on Facebook, certain information such as your email address, date of birth, address, phone number, job or city. According to Meta, its data is transferred, stored and processed in places including the United States, Ireland, Denmark and Sweden, as well as other countries where its partners and providers are located. Meta decides case by case how long it keeps this information.
Processing outside Québec: because these providers are located or have servers outside Québec, your information may be communicated, processed and stored outside Québec, including elsewhere in Canada, in the United States, India, Europe, South America and Asia.
How long we keep it
If you do not become a client, we keep your information for 6 months after our last exchange, then destroy it. If you become a client, we keep it for the full term of our contract, then for 6 years after it ends, before destroying it. If a law requires certain documents to be kept longer, that period applies. For example, Québec and Canadian tax laws generally require a business to keep its records and supporting documents, such as contracts and invoices, for 6 years after the end of the last year they relate to.
Our providers also have their own retention periods:
- Gmail: emails stay in our inbox until we delete them. A deleted message stays in the trash for up to 30 days. According to Google, full deletion then usually takes about 2 months; encrypted backup copies may remain for up to 6 months.
- Web3Forms: according to its policy, submissions are kept for up to 3 years, then deleted automatically, unless a shorter period applies or we delete them sooner. Period set for our form: [À COMPLÉTER : durée réglée dans le tableau de bord Web3Forms].
- hCaptcha: according to its policy, data collected through its cookies is deleted as soon as possible. It may be kept for up to one year after the cookie expires, usually in a de-identified or aggregated form, except where abuse is detected. hCaptcha says it keeps no long-term data on visitors, but does not say how long it keeps usage signals and challenge answers.
How we protect it
We take reasonable security measures to protect your information. For example:
- The form is sent to Web3Forms over an encrypted connection (HTTPS).
- According to Web3Forms, its database is encrypted.
- According to Google, Gmail messages are encrypted in transit and on its servers.
- People who have access to your information at Studio Envol: only Théo Isabel, founder and person in charge of the protection of personal information.
If a confidentiality incident occurs (for example, unauthorized access or loss of information), we will take reasonable steps to reduce the risks. If there is a risk of serious harm, we will promptly notify the Commission d’accès à l’information and the people affected, as required by law. For its part, under its data processing agreement, Web3Forms commits to informing us without undue delay, and within 72 hours at the latest, if a data breach occurs.
Cookies and other technologies
A cookie is a small file that your browser saves. Here is what our website uses:
- No advertising cookies. Our website host, Cloudflare, may however set its own cookies. According to Cloudflare, its cookies are strictly necessary to provide the services its customers request, unless its cookie list states otherwise, and each one is tied to a specific function. For example, if Cloudflare shows you a security challenge and you pass it, it sets a cookie (cf_clearance) that proves it; this cookie lasts 30 minutes by default. These cookies belong to Cloudflare, not to Studio Envol.
- hCaptcha: it only loads when you check the form’s consent box. It may then set its own cookies. According to hCaptcha, they are used for security, load balancing, accessibility and anonymous statistics, and last up to 30 days. These cookies belong to hCaptcha, not to Studio Envol.
- Animation setting: if you click the “Stop animations” button, your browser remembers that choice using local storage. This setting stays on your device and contains no personal information.
- Fonts: they are hosted on our own website. No request is sent to Google Fonts.
You can block or clear cookies and local storage in your browser settings. If you block hCaptcha’s cookies, the form may not work. You can then reach us directly by phone, text, email or Messenger.
Your rights
The law gives you the following rights:
- Access: find out whether we hold information about you, see it and get a copy. On request, we will also tell you what information we collected, who has access to it at Studio Envol and how long we keep it.
- Rectification: have inaccurate, incomplete or ambiguous information corrected. You can also do so if its collection, communication or retention is not permitted by law.
- Withdrawal of consent: withdraw your consent to the use or communication of your information at any time.
- Portability: receive the computerized information you provided to us in a structured, commonly used technological format, or have it sent to a person or body authorized by law to collect it, unless this raises serious practical difficulties.
To exercise your rights, write to our person in charge, Théo Isabel, at studioenvol7@gmail.com or at our mailing address. Your request must be in writing, and you will need to confirm your identity. If needed, we will help you clarify your request.
Access to your information is free. Reasonable fees may apply to transcribe, reproduce or send it; if so, we will tell you the approximate amount before processing your request.
We will reply in writing to any access or rectification request within 30 days of receiving it, as required by law. If we do not reply within those 30 days, your request is deemed refused. If we refuse, we will explain why, citing the section of the law involved, your remedies and the deadline for using them.
Making a complaint
Concerned about how we handle your information? Start by writing to our person in charge, Théo Isabel, at studioenvol7@gmail.com or at our mailing address. Describe your concern and tell us how to reach you. He will review your complaint and reply in writing within 30 days of receiving it. If you are not satisfied with his reply, you can contact the Commission d’accès à l’information (see below). Our complaint process is explained in detail in our governance policies and practices:
Our governance policies and practices for personal information
If your access or rectification request is refused or goes unanswered, you have 30 days to ask the Commission d’accès à l’information du Québec (CAI) to review the disagreement. You can also file a complaint with the CAI about our practices, even anonymously. Complaints are made in writing, using the CAI’s online form: formulaire.cai.gouv.qc.ca.
Commission d’accès à l’information du Québec:
- Québec City office: 525, boulevard René-Lévesque Est, bureau 2.36, Québec (Québec) G1R 5S9 · 418-528-7741
- Montréal office: 2045, rue Stanley, bureau 900, Montréal (Québec) H3A 2V4 · 514-873-4196
- Toll-free: 1-888-528-7741
- Website: www.cai.gouv.qc.ca
Changes to this policy
We may update this policy, for example if we change providers. The new version will be posted on this page, with a notice summarizing the changes and the new update date. We will also let the people concerned know by appropriate means.

