Privacy Policy

1. Introduction and legal framework

This privacy policy describes how NOX.PET collects, uses, discloses, and protects the personal information of users of the nox.pet website and related services. It applies to residents of Quebec and Canada and is intended to ensure compliance with Quebec's Law 25 (An Act to modernize legislative provisions on the protection of personal information, CQLR, chapter C-12) and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Person in charge of the protection of personal information

Under Law 25, the person in charge of the protection of personal information for NOX.PET's activities is:

Mr. Julien Brisset

Email: privacy@nox.pet

Any request for access, rectification, erasure, or portability, or any complaint regarding the protection of personal information, may be sent to this address.

3. Personal information collected

We collect only the personal information necessary for the purposes identified below. Main categories:

a) Account and contact data

• First and last name
• Email address
• Phone number (optional)
• Full mailing address (for medallion delivery)
• Password (stored securely and encrypted by our authentication provider)

b) Pet-related data

• Name, species, breed, date of birth (optional)
• Status (lost, on walk, memorial)
• Photo and description (optional)
• Public note and medical information (allergies, treatments, vet) according to your privacy settings and consent

c) Scan data

• Date and time of scan
• Medallion identifier scanned
• IP address, browser type and operating system (for security and proper operation of the service)
• GPS location only if the person scanning explicitly chooses to share it to help locate the pet

d) Subscription and order data

• Subscription type, status and order history
• Billing and payment data (processed directly by Stripe; we do not store card numbers)
• Communication preferences (newsletter, marketing alerts, product updates)

Data from the contact form (name, email, subject, message) is used to respond to your request and is not retained in a database after processing unless needed for follow-up of the complaint.

4. Purposes and legal basis

Personal information is used to:

• Perform the contract (delivery of medallions, provision of identification service and alerts)
• Manage your account, subscription and scan history
• Send you alerts when the medallion is scanned and transactional communications (order confirmation, password reset, etc.)
• Respond to requests sent via the contact form
• Improve site security and prevent abuse (including via anti-bot tools)
• Send you marketing communications (newsletter, offers) only with your explicit consent

Collection and use are based on contract performance, your consent where required by law (e.g. for commercial communications or sensitive data), and our legitimate interests (security, proper operation of the service) in compliance with your rights.

5. Cookies and similar technologies

The site uses cookies and local storage strictly necessary for the operation and security of the service:

• Session cookies (Supabase): identification of your logged-in session; duration limited to the session or as per the provider's configuration.
• Cloudflare Turnstile: cookies or storage used to verify that forms (registration, contact) are not submitted by bots; processing in accordance with Cloudflare's privacy policy.
• Meta pixel (Facebook / Instagram): placed only if you accept marketing cookies via the banner. It measures visits and conversions from our ads and helps optimize campaigns. Processing is carried out by Meta (Meta Platforms Ireland Ltd. or another Meta group entity), which may involve transfers outside Canada. You may withdraw consent at any time via "Cookie settings" in the footer; if the pixel was already loaded, a page refresh may be needed for the refusal to take full effect.

Advertising or ad-measurement cookies are not used without your prior consent. Audience tools that do not use personal cookies (e.g. Vercel hosting analytics) may be used for service operation and are described here where applicable.

6. Sharing and transfers outside Quebec

We never sell your personal information. We may share it with service providers (subcontractors) who help us provide the service, under contracts requiring confidentiality and security measures:

• Supabase (hosting may be outside Quebec, e.g. Singapore/US): database and authentication.
• Stripe (US): payment processing; card data remains with Stripe.
• Resend: sending transactional emails and, where applicable, newsletters.
• Cloudflare (Turnstile): anti-bot protection on forms.
• Meta (Facebook / Instagram), when you accept marketing cookies: conversion and audience measurement for our ads via the Meta pixel; processing by Meta may involve transfers outside Canada. You can withdraw consent anytime via "Cookie settings" in the footer.
• Persons scanning the medallion: they only see the information you have set as public on the pet's page (e.g. owner name, contact details).

Any transfer of personal information outside Quebec is governed in accordance with Law 25 (assessment of level of protection, contractual clauses or other recognized mechanisms). You may request details on the safeguards applied to a given transfer by writing to privacy@nox.pet.

7. Security

We implement technical and organizational measures to protect personal information against unauthorized access, loss or disclosure, including:

• Encrypted communications (HTTPS/TLS)
• Restricted access to data (authentication, roles)
• Providers bound by contractual confidentiality and security obligations

No system can guarantee absolute security. In the event of an incident likely to pose a serious risk of harm, we are committed to complying with the notification obligations under Law 25 (notification to the Commission d'accès à l'information du Québec and, where applicable, to the individuals concerned).

8. Retention

Personal information is retained while your account is active and for as long as necessary to provide the service, handle complaints and comply with our legal obligations (e.g. retention of accounting records).

After account deletion or service termination: data is deleted within a maximum of 30 days, unless legal retention applies. Scan data may be retained for the duration of the history displayed in your account, then deleted in accordance with the same rule.

9. Your rights

Under Law 25 and applicable legislation, you have the following rights:

• Right of access: obtain a copy of the personal information we hold about you.
• Right to rectification: have inaccurate or incomplete information corrected.
• Right to erasure: request deletion of your data, subject to legal exceptions.
• Right to portability: receive your data in a structured, commonly used format.
• Right to withdraw consent: for processing based on consent (e.g. newsletter), withdrawal does not affect the lawfulness of prior processing.
• Right to object to processing based on legitimate interests, for reasons related to your particular situation, subject to exceptions under the law.

To exercise these rights, contact us at privacy@nox.pet. We will process your request within the timeframes required by law. You can also manage some of your data (profile, preferences, pets) directly from your account.

Right to complain: You have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca. For matters under federal private-sector legislation, the Office of the Privacy Commissioner of Canada may also be contacted.

10. Minors

The service is intended for adults or minors with the consent of a parent or guardian. We do not knowingly collect personal information from minors without such consent. If you become aware that a minor has provided us with data without authorization, please contact us at privacy@nox.pet to request its deletion.

11. Modifications and contact

We may update this policy to reflect changes in practices or regulation. The current version is the one published on this page with the “Last update” date. We encourage you to review it periodically.

For any questions: privacy@nox.pet.