Privacy policy

In short

SHAY SKIN is an online skincare shop. We ask you for the bare minimum needed to ship your order and answer you: that is all. There is no account to create, no file in your name on our side, and this site no longer holds any database. Your order and payment are handled by Shopify; your message goes through our contact form; analytics only start after you agree. This page states what we actually hold, not what would sound good.

Who we are

This policy applies to the website https://shayskin.ca, operated by SHAY SKIN, trade name of Shay Médico-Esthétique Inc. (Quebec enterprise number 1177409779), 111 Rue Chabanel Ouest #604, Montréal (QC) H2N 1C8.

• Person in chargeThe management of SHAY SKIN — Person in charge of the protection of personal information
• Write to usinfo@shayesthetiques.ca · Contact form
• Phone+1 438 796-3111
• Address111 Rue Chabanel Ouest #604, Montréal (QC) H2N 1C8

Write to us at info@shayesthetiques.ca (an @shayskin.ca address, however, would bounce: that domain does not receive mail), or use the contact form: it reaches management directly and we reply to the address you enter on it. Access, correction, consent-withdrawal requests and complaints all go through it as well.

What we collect, and when

We would rather tell you moment by moment than give you a vague list. There are four moments, not one more.

1. When you browse and fill your cart

Nothing is asked of you and there is no account to create. Our server keeps a technical log of every page served: your IP address, the date and time, the page requested, the page you came from and your browser type. That log keeps the site running and helps us spot abuse.

Your cart stays in your browser until you check out: it is not sent to us and we cannot see it.

2. When you place an order

When you click “Checkout”, you are taken to the checkout hosted by Shopify. That is where you enter your name, email, shipping and billing address, your phone if you give one, and your payment. This information is collected by Shopify on our behalf: we then see it in our merchant area, to prepare, ship and invoice your order, and to answer you if you write to us about it.

Your card number never reaches us: it is handled by Shopify and its payment provider, and all we see is the last four digits and the result of the transaction.

As soon as an order is paid, an alert is sent to management's internal messaging through Telegram, so the order goes out quickly. That alert contains the order number, your name, the delivery city, the products and the total.

3. When you sign up for the newsletter

One item is asked for: your email. It is stored with Shopify, where the mailing list lives, and you receive your welcome code in return. We use it to send you our new arrivals and offers. You may unsubscribe at any time, through the link at the bottom of every mailing or by asking us — and unsubscribing takes away no discount you have already used.

4. When you write to us through the form

The form asks for three things: your name, your email and your message. The email is used solely to reply to you. Your message is sent to management's internal messaging through Telegram, and it is stored in no database here. We also keep, for a few minutes in memory, a per-IP submission counter: that is what stops a bot from drowning out a real request. The counter is never written to disk and disappears on every restart.

Do not write health information in this form, and never send us a card number: it is not the channel for that. For a skin question that touches your health, speak to a physician, dermatologist or pharmacist.

What this site does not do

Saying this is as useful as saying what it does.

One honest clarification: if you signed up for the newsletter or placed an order, we may email you about your orders and our offers. You can ask us to stop at any time, through the unsubscribe link or through the contact form.

Cookies, local storage and analytics

During a normal visit, this site sets no cookie in your browser until you have accepted something. It does save a few markers in your browser's “local storage”. They are never sent to our servers, except the third one:

• shay_cart — your cart contents, as product and quantity. No personal data.
• shay-consent-v1 — your choice about analytics and advertising cookies, with the date of that choice.
• shay_cart_id — the technical identifier of your Shopify cart, once you check out. It is used only to clear your cart after payment. No personal data. It is the only one of these items the site sends back to our server, and only to check whether the order was paid.
• shay_news — a simple flag noting that the newsletter window has already been shown to you, so it is not repeated. No personal data.
• shay_recent — the products you viewed most recently, so you can find them again. That list never leaves your browser.

Shopify's checkout, once you are on it, sets its own cookies: they hold your cart and secure the payment, and its own policy governs them.

For measurement, only one tool is in place: Meta's pixel, which tells us which Facebook and Instagram ads bring real visits and real orders. It loads only AFTER you agree: as long as you have not accepted advertising in the choices panel, no Meta script is loaded and nothing is sent to it. Declining is as easy as accepting, and takes nothing away from the site. Once accepted, the pixel collects what you do not give us: IP address, cookie identifier (“_fbp”, “_fbc”), browser, pages viewed and purchases. That information goes to the United States.

Google Analytics is NOT connected on this site: no identifier is configured, so no Google script is loaded, even if you accept analytics. The day it is, this page will change and so will the date at the top.

You can open the choices panel at any time: Manage cookies. The same link sits at the bottom of every page. Withdrawing your consent deletes the relevant cookies and reloads the page.

Who receives your information

We sell nothing to anyone. Here is the complete list of the companies that handle your information, named rather than summarized as “our partners”:

• Shopify Inc. — our commerce platform. It hosts the catalogue, the cart, the checkout, payment, your order history and the newsletter list. It uses its own subcontractors to process payments and to buy shipping labels. Its servers are outside Quebec.
• The carrier — to deliver to you, your name, your shipping address and, if needed to reach you, your phone are passed on. Nothing else: it does not know what is in the parcel.
• Telegram — the messaging service that carries our internal alerts: the new-order notice and the message you send through the contact form. Those messages go to management, never to a third party, and its servers are outside Quebec.
• Meta Platforms (Facebook, Instagram) — only if you accepted advertising in the choices panel. It then receives your IP address, a cookie identifier, the pages you view and your purchases. It receives neither your name, nor your address, nor the message you write us. Its servers are in the United States. If you decline, no Meta script is loaded and nothing is sent to it.
• Hostinger — rents us the server that delivers this site's pages. The technical log described above (IP address, time, page requested, browser) sits on that machine, located in the United States. No order and no file are stored on it.

We may also disclose information if the law requires us to — a court order, for instance. That has never happened.

Outside Quebec

Let us be clear: our providers are foreign companies, and your information leaves Quebec. Four transfers actually take place: Shopify when you order or sign up for the newsletter, the carrier for delivery, Telegram for our internal alerts, the host for the server log — and a fifth, Meta, only if you accepted advertising. The law requires us to assess each transfer before it happens and to frame it in a written agreement: that is the case here, in particular through Shopify's data processing agreement, in force simply because the account is open.

Shopify's privacy policy: https://www.shopify.com/legal/privacy

How long we keep it

Let us be frank rather than reassuring: nothing deletes itself. As of today there is no automatic purge. What we hold stays until we erase it — at your request, or on our own initiative when it no longer serves a purpose. That is a real limitation, and we would rather write it down than promise a deletion that would not happen.

• Orders (contact details, shipping address, items and payment): kept with Shopify for the duration of our accounting and tax obligations, that is six years after the financial year concerned.
• Newsletter: your email stays on the list until you unsubscribe or ask us to remove it.
• Form messages: they live in our internal messaging for as long as it takes to answer you and keep a record of the exchange. Ask us to delete yours and we will.
• Server technical logs: they are not yet subject to a defined retention period. That is an open item on our side.
• Anti-bot counter: a few minutes, in memory only.

Your rights, and how to use them

It all happens in one place: use the contact form, or call us. Tell us what you want and give us enough to identify you (the email or order number used at purchase are enough). The law gives us 30 days to respond, and we answer in writing.

• Access — obtain the list of what we hold about you and receive a copy of it.
• Correction — have anything inaccurate, incomplete or outdated fixed, for instance a wrong shipping address.
• Withdrawal of consent — unsubscribe from the newsletter, or withdraw your agreement to analytics and advertising cookies. Withdrawing one does not force you to withdraw the other, and it does not stop you from ordering.
• Deletion — ask that your information be erased. We will tell you honestly what we can erase and what we must keep, with the reason: an invoice must be kept for tax purposes, a newsletter address need not.
• Portability — receive, in a common computer format, the information you yourself provided to us.
• Cessation of publication and de-indexing — require that we take down content about you that we published, and that we ask search engines to stop referencing it.

No decision about you is made by a computer alone: we do no scoring and no automated sorting of customers.

How it is protected

Exchanges with this site are encrypted, and payment happens on Shopify's checkout, which meets payment card industry standards. Access to our merchant area is restricted to management. Since this site no longer holds a database, the exposed surface is deliberately small: there is nothing to steal here that is not already with Shopify, under its protection.

If a confidentiality incident occurred — a loss, unauthorized access, an unintended disclosure — the law requires us to record it in a register, take steps to limit its consequences, and notify you as well as the Commission d'accès à l'information when the incident presents a risk of serious injury. That is what we would do.

Changes to this policy

Every time our practices change — an analytics tool switched on, a provider added, a processing activity removed — this page is rewritten and the date at the top is changed. That date is the only promise we make here: if it has not moved, nothing has moved.

Questions, complaints and recourse

For any question about this policy, to exercise your rights, or to complain about how we handle your information, write to the person in charge through the contact form, or call +1 438 796-3111. We will answer you and tell you what we are doing with your request.

If our answer does not satisfy you, you may contact the Commission d'accès à l'information du Québec, which oversees the application of the law and receives complaints.

If you buy a product from us, our terms of sale apply in addition to this policy.

This policy applies the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), known as “Law 25”. In case of any discrepancy, the statute prevails: https://www.legisquebec.gouv.qc.ca/fr/document/lc/P-39.1

The management of SHAY SKIN