Privacy and personal information protection policy
Version 1
In effect since October 15, 2026
This English version is provided for convenience. The French version prevails.
At Vestimoi, your trust matters to us. This policy explains how we collect, use, disclose, retain and protect your personal information when you browse our site, create an account, buy or sell items, request a home guidance service or contact us.
Personal information is any information about a natural person that allows that person to be identified, directly or indirectly.
1. Who is responsible for your information?
The Vestimoi platform is operated by [to be completed], [to be completed].
We apply Québec's Act respecting the protection of personal information in the private sector, as amended in particular by Law 25, as well as the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies to our activities.
For any question, request or complaint, write to our person in charge of the protection of personal information:
- Responsable de la protection des renseignements personnels
- Email: vie-privee@vestimoi.com
2. What information do we collect and why?
We limit collection to the information needed for the services requested and for the purposes explained at the time of collection.
| Context | Information concerned, depending on the service used | Purposes |
|---|---|---|
| Account and profile | Name, email, phone, sign-in identifier; picture and bio if you provide them; notification preferences | Create and manage your account and profile |
| Purchase and shipping | Recipient name, address, phone needed by the carrier, items ordered, amounts, taxes and parcel tracking | Process the order, arrange shipping, issue the invoice and follow up |
| Payment | Card data entered directly with Stripe; Vestimoi only receives the brand, last four digits and expiry date of saved cards | Collect payment, prevent fraud, calculate taxes |
| Selling and payouts | Listings, photos, prices, sales history. The seller's identity, date of birth, identity documents and bank details are collected directly by Stripe; Vestimoi only receives the status of the verification and of the payouts | Publish items, manage sales and pay the amounts due |
| Home guidance | Contact details, appointment address, availability, notes and information about the items | Assess the request and organize the service |
| Support, reports and disputes | Messages, name and email from the contact form, order number, relevant photos and supporting documents | Answer requests and handle delivery problems and disputes |
| Browsing and security | IP address, browser, device, technical logs | Run and secure the site and detect abuse |
| Accepted terms | Version of the terms accepted and date of acceptance | Prove which terms apply to your account and your orders |
| Promotional communications | Email and subscription preferences | Send authorized communications and manage unsubscriptions |
Mandatory information is marked in the forms. Refusing to provide necessary information may prevent the service concerned from being provided. Optional information is not required to access a service that does not need it.
3. How do we collect it?
We collect information:
- directly from you, in forms, orders, listings and exchanges with our team;
- from Google, through Auth0, when you sign in with a Google account (name, email, picture);
- through the technologies needed to run and secure the site, including strictly necessary cookies;
- from payment and shipping providers, for the confirmations and information needed to follow transactions.
On request, we can tell you the source of information collected from a third party, subject to legal exceptions.
4. Your consent and your choices
We explain the purposes of collection and obtain your consent when the law requires it. Consent requests are worded clearly and separately for the purposes concerned. Express consent is obtained when required, in particular for sensitive information.
Browsing the site or reading this policy does not constitute general authorization for every use of your information.
You may withdraw your consent to the uses or disclosures concerned by contacting our privacy officer. We will explain any consequences for the services. Withdrawal does not remove retention obligations or processing permitted or required by law.
5. Who do we share your information with?
We only disclose the information needed for the stated purposes, with your consent or where the law allows it. We do not sell your personal information.
Between buyers and sellers. The information needed for the transaction and shipping is available to the other party, in particular the buyer's name and address and the seller's shipping address on the shipping label. These details must not be used for unauthorized marketing.
Service providers. Our providers are OVH (hosting), Auth0 (sign-in), Stripe (payments, tax and payouts), Resend (email), Canada Post (shipping and address verification) and Cloudflare (contact form protection), as well as the authorized staff of the home guidance service. The table in section 8 sets out the information, purposes and processing locations. Processing carried out on our behalf is governed by appropriate contractual commitments.
Authorities and advisers. Information may be disclosed where the law requires or allows it, in particular to comply with an order or handle legal proceedings.
Business transaction. In case of a sale, merger or restructuring, information may be disclosed under the conditions set by law and with the required confidentiality measures.
6. Public profile, listings and photos
Some information you publish to present your wardrobe or items (display name, picture, listings, reviews) may be visible to other people.
Avoid publishing your address, identity documents, banking information or information about another person without permission. Also check what is visible in your photos.
The service's privacy settings, where they exist, provide by default the highest level of confidentiality required by law.
7. Cookies
The site only uses cookies strictly necessary for the functions you request: signing in (Auth0) and payment fraud prevention (Stripe). No analytics, personalization or advertising cookies are used. Details are in the Cookie policy.
Before using any technology that can identify you, locate you or profile you, we will inform you of its use and of the means to activate the functions concerned, as required by law.
8. Processing outside Québec
Some of our providers process or store your information outside Québec, in other provinces or countries:
| Provider | Information | Purpose | Location |
|---|---|---|---|
| OVH (server in Beauharnois): database, files, logs | All the information described in section 2 | Hosting | Québec (parent company based in France) |
| Auth0 / Okta | Email, name, picture, sign-in events | Sign-in | European Union |
| Stripe (payments, tax, Connect payouts) | Buyer's card and billing details; seller's identity and bank details; amounts; shipping province | Payment, tax calculation, payouts | United States / Canada |
| Resend | Email, name, message content | Transactional email | United States |
| Canada Post (shipping, AddressComplete) | Names, addresses, phone, parcel weight | Rates, labels, tracking, address verification | Canada (outside Québec) |
| Cloudflare Turnstile | IP address, technical device signals | Anti-spam protection of the contact form | Global / United States |
Before entrusting processing to, or disclosing information to, a party outside Québec, we carry out the required privacy impact assessment. The information must receive adequate protection and the disclosure must be governed by an appropriate written agreement. Information processed outside Québec may be accessed by the authorities of the jurisdiction concerned under the laws that apply there.
9. Retention and destruction
We keep information for as long as needed for the stated purposes, subject to legal obligations and legitimate needs related to claims and proceedings:
| Information | Retention period | Then |
|---|---|---|
| Profile, addresses, preferences, cart, wishlist, notifications | Until the account is deleted | Deleted |
| Unsold listings and their photos | Until the account or the listing is deleted | Listing removed, photos deleted |
| Orders, items, order shipping address, invoices, accounting entries, refunds, disputes, tax data | Until 31 December of the 7th year after the order (tax obligations) | Anonymized |
| Acceptances of terms and checkout consents | As long as the related order; for a deleted account with no order, 3 years after deletion (limitation period) | Deleted |
| Shipping labels (PDF) | 12 months after the order closes | Deleted |
| Account deletion log | 3 years | Deleted |
| Stripe payout account of a seller whose account is deleted | 180 days after the last payout (possible chargebacks) | Deleted at Stripe |
| Privacy incident register | At least 5 years after the incident became known | Destroyed manually |
| Technical logs, traces, metrics | 14 days, 7 days, 30 days | Erased automatically |
| Emails sent through the contact form | 24 months | Deleted by the team |
Stripe keeps the identity verification information it collected from sellers under its own legal obligations.
When the applicable periods expire, information is securely destroyed or anonymized as required by law, for serious and legitimate purposes.
Deleting an account does not erase the information we must keep: orders, invoices and proof of acceptance remain attached to a "deleted member" that no longer identifies you by your name, email or sign-in identifier.
10. Security and governance
We apply reasonable measures proportionate to the sensitivity of the information and the risks associated with its processing.
The privacy officer oversees protection practices and the handling of requests and complaints. People in charge of operations only access the information needed for their duties. People in charge of systems apply the technical measures and retention rules within their responsibilities.
No transmission or storage method guarantees absolute security. If you suspect unauthorized use of your account, contact us promptly.
11. Confidentiality incidents
When an incident involving personal information occurs, we take reasonable measures to reduce the risk of harm and prevent it from happening again. We keep the required register.
If an incident presents a risk of serious harm, we promptly notify the Commission d'accès à l'information and the people concerned, as required. Where PIPEDA applies, we also comply with the federal reporting, notification and record-keeping obligations.
12. Your rights
Subject to the conditions and exceptions provided by law, you may:
- ask whether we hold information about you and access it;
- have inaccurate, incomplete or ambiguous information corrected;
- withdraw your consent to the uses or disclosures concerned;
- request the deletion of information whose collection, disclosure or retention is not authorized;
- request the computerized information collected from you in a structured, commonly used format, or its transfer to an authorized person or body, subject to serious practical difficulties and legal limits;
- request that the dissemination of information cease, or that information be de-indexed or re-indexed, when the legal conditions are met.
From My account › Privacy, you can download your data yourself (JSON file) and delete your account. Deletion is possible once your ongoing orders, sales, payouts, reports and appointments are completed.
For any other request, write to the privacy officer named in section 1. We verify your identity in a proportionate way and answer in writing no later than 15 days after receipt.
Access is free of charge. Reasonable fees for transcription, reproduction or transmission may be charged where the law allows; you are told the approximate amount beforehand. Any refusal is explained and comes with the applicable remedies and time limits. You may also file a complaint with the Commission d'accès à l'information du Québec.
13. Promotional communications
Promotional communications are sent on the basis of valid consent or another authorization provided by law. You can unsubscribe through the link in the messages, in your notification preferences or by writing to us.
Unsubscribing does not stop the communications needed to process your orders, secure your account or meet our legal obligations, including notices of changes to our terms and to this policy.
14. Changes
We publish a notice of changes to this policy and update the version and date at the top of the page; previous versions remain available. For material changes, we also inform members by notification and by email.
A change to the policy does not replace obtaining new consent where it is required.