01 Person in charge
Under Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the person in charge of the protection of personal information is Reza Abtahian, Stellaire Web, info@stellaireweb.com.
02 What we collect
Account holders: name, business name, email, password (stored only as a salted hash), plan and billing status (card details are handled by Stripe, never by us). Documents: the files you upload and the fields filled in. Signers: name and email given by the sender, the signature image, typed name, the time, IP address, approximate location derived from it, browser and device, and the codes used to confirm their identity.
03 Why
To provide the Service: send documents, identify signers, produce the signed PDF and the certificate of completion, keep the audit trail that makes the signature valid, bill subscriptions, prevent abuse, and answer support requests. We do not sell personal information and we do not use documents for advertising or to train AI models.
04 Who receives it
Netlify, Inc. (hosting, functions and storage, United States); Stripe (payments, Canada and United States); our email provider (sending invitations and codes). They process data only on our instructions. When a document is completed, we send only its SHA-256 fingerprint (never the document or any personal information) to DigiCert, an independent time-stamping authority, to timestamp it. Anyone holding a signed copy can see its basic record (title, signers' names and dates) on our verification page by entering its envelope number or scanning its QR code. Because data is stored outside Québec, we assessed the transfer and rely on these providers' contractual and security commitments (encryption in transit, access controls).
05 How long we keep it
As long as the account is open, then 90 days for export, then deletion, except signed documents and audit trails that the Customer or the law requires to keep. Signers can ask the sender (the Customer) for a copy of the signed document at any time.
06 Security
HTTPS everywhere, private storage reachable only through the account or the signers' secret links, hashed passwords, SHA-256 fingerprints and a digital seal on every signed document, and limited access by our team.
07 Your rights
You can ask to access, correct or delete your personal information, withdraw consent, or ask how a decision was made, by writing to info@stellaireweb.com. We answer within 30 days. For documents sent to you by a business, we may forward your request to that business, which controls the document. You can also complain to the Commission d'accès à l'information du Québec.
08 Cookies
The app uses the browser's session storage to keep you signed in; the public site uses no advertising cookies. If we add analytics or advertising tags later, we will ask for consent first.
09 Changes
We will post changes here and notify account holders of significant changes by email.