Privacy Policy

1. Who is responsible

Creative Drops is responsible for the personal information of DropScene's customer companies and their teams (account, billing, support). For people using a customer company's public pages (votes, estimates, reports…), that company is responsible: its own policy is linked at the bottom of its pages.

2. What we collect, and why

• Account and team: name, email, password (hashed), role, language, two-factor secret (encrypted).
• Billing: company details, plan, payment history. Card numbers never pass through our servers (Stripe).
• Support and technical logs: exchanged messages, IP addresses and login logs kept as long as needed to diagnose and secure the service.
• Information collected through customer companies' public pages: processed on their behalf, under their instructions, never reused by the publisher.

3. Consent

By completing a form, you consent to the use of the information provided for the purpose stated next to the form — and for that purpose only. You may withdraw your consent at any time by writing to the person in charge above; we will then stop using it, except for what the law requires us to keep (invoicing, for instance).

4. Cookies and technologies

Pages use one strictly necessary session cookie (to recognise you from one page to the next and protect forms) and your browser's local storage for display preferences. No advertising cookie, no third-party tracker, no profiling. Augmented reality and 3D visits run on your device: your camera images are only transmitted if you choose to send a photo.

5. Where the information goes

Data is hosted in Canada (hébergement infogéré (cPanel)). Some technical services may receive information outside Québec; each has been assessed for privacy impact and receives only what is necessary:

Service	Role	Country
Stripe	subscription, deposit and invoice payments	États-Unis / Irlande
Fournisseur de courriel (SMTP)	transactional email delivery	selon le fournisseur configuré
Cloudflare	traffic protection and routing	États-Unis (points de présence au Canada)
OpenAI	ambiance renders and moodboard analysis — no personal data, only design captures and venue photos	États-Unis
Google (Gemini)	3D model classification and image analysis — no personal data	États-Unis
Pusher	live seller + client sessions (first names shown, ephemeral)	États-Unis / UE

We neither sell nor rent any personal information.

6. How long

A company account and its team are kept while the subscription is active, then thirty days in the trash before permanent destruction; invoices, six years (tax obligations); technical logs, ninety days.

7. Your rights

You may ask to see the information we hold about you, have it corrected, obtain a copy in a structured format, withdraw your consent or request its erasure. Write to the person in charge named at the top of this page: we answer within thirty days. If you are not satisfied with the answer, you may contact the Commission d'accès à l'information du Québec.

8. Security and incidents

Encryption in transit (HTTPS) and of secrets at rest, two-factor authentication available to the whole team, access limited to what each role requires, backups. Every confidentiality incident is recorded in a register; if it presents a risk of serious harm, the Commission d'accès à l'information and the persons concerned are notified.

9. Changes

The date at the top indicates the last revision. A significant change is announced on the pages concerned.