Privacy Policy

1. Two roles: the platform and the seller

When you buy from a Draupix shop, the seller of that shop receives your order and contact details to prepare it, ship it and meet their own legal obligations. The seller is responsible for how they use that information afterwards. Draupix acts as the seller’s service provider and uses your information only to run the shop.

For seller accounts, the shop directory and draupix.com itself, Draupix is directly responsible for the information collected.

2. Information we collect

Sellers (shop owners):

• name, email, password (stored only as a hash), language;
• shop name, address, province and category, and the texts and images you publish;
• the identifier of your Stripe Connect account (Draupix never sees your full banking details);
• access tokens for the accounting software you connect (QuickBooks Online, Xero, FreshBooks), encrypted before they are stored;
• credentials of the carrier accounts you choose to connect (FedEx, UPS, Purolator, Canpar);
• sales volumes and commissions, needed for billing.

Customers (buyers in a shop): name, email, shipping address, order contents, favourites and published reviews, and, if you create an account, your hashed password, temporary sign-in codes and the devices you mark as trusted.

Technical information (everyone): IP address, browser type, pages requested and timestamps, in server logs kept for at most 90 days for security and troubleshooting.

3. Why we use it

• to fulfil orders: payment, tax and shipping calculation, email confirmation, invoice, tracking;
• to run and secure your account: sign-in, one-time codes, trusted devices, fraud prevention;
• to bill sellers (commissions, monthly minimum, add-ons);
• to answer you when you write to us;
• to meet our legal obligations, in particular tax and accounting rules;
• to improve the platform from aggregated statistics that identify no one.

We do not sell your information, we do not use it for targeted advertising and we make no automated decisions with legal effects about you. Draupix does not send marketing emails to shop customers.

4. Cookies

We only use cookies required for the service to work: seller or customer session, cart contents, chosen language, trusted device and protection against request forgery. No advertising cookies, no third-party analytics. The page for prospective sellers loads fonts from Google Fonts, which sends your IP address to Google.

5. Payments

Payments are processed by Stripe on a secure page hosted by Stripe. Your card number is never sent to Draupix or to the seller. Stripe processes your information under its own privacy policy (stripe.com/privacy). Draupix receives from Stripe the payment confirmation, the amount and the last four digits of the card when needed for a refund.

6. Providers we share information with

We share only what the service requires:

• Stripe (payments, payouts to sellers) — United States and Canada;
• DigitalOcean (hosting of the server and database, Toronto data centre) — Canada;
• Brevo (transactional emails: confirmations, sign-in codes) — France;
• Canada Post and, when the seller enables them, FedEx, UPS, Purolator and Canpar (shipping rates: destination address, parcel dimensions and weight) — Canada and United States;
• Intuit QuickBooks Online, Xero or FreshBooks, only if the seller connected that software (customer name and email, order lines and amounts, to create the invoice) — United States, New Zealand, Canada;
• Let’s Encrypt (HTTPS certificates: domain name only).

Some of these providers are located outside Québec and Canada. Before selecting them we assessed the sensitivity of the information sent and the protections offered; each is bound by contractual commitments and security measures comparable to those required in Québec. We may also disclose information when the law requires it or to protect our rights.

7. How long we keep it

• account and shop: while the account is active, then deleted within 30 days of closure;
• orders, invoices and commission records: as long as tax laws require (generally seven years);
• sign-in codes and reset links: minutes to hours;
• technical logs: at most 90 days;
• accounting software tokens: deleted and revoked as soon as the seller disconnects.

8. Security

All communications are encrypted (HTTPS/TLS). Passwords are hashed with Argon2; accounting software tokens are encrypted (AES-256-GCM) before reaching the database. Server access is limited to the Draupix team and protected by keys and a firewall. Signing in from a new device requires a code sent by email.

Should a privacy incident present a risk of serious injury, we would notify the Commission d’accès à l’information du Québec and the people concerned as the law requires, and record it in our incident register.

9. Your rights

You may at any time ask to access the information we hold about you, have it corrected, withdraw your consent, obtain a copy in a structured and commonly used format, or ask for its deletion, subject to the records the law requires us to keep. Write to contact@draupix.com; we answer within 30 days. Sellers can change most of their information directly in their dashboard.

If you believe your request was not handled properly, you may file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca). California residents have the rights provided by the CCPA, including the right to know that we do not sell their information.

10. Minors

Draupix is not directed at people under 14 and does not knowingly collect their information. If you believe a minor has given us information, write to us and we will delete it.

11. Changes

We may update this policy. The date at the top of the page shows the version in force; material changes are announced to sellers by email before they take effect.

12. Contact

Draupix — Maxime Ethier, Joliette, Québec, Canada. Email: contact@draupix.com.