Privacy Policy

Last updated: September 29, 2026

Meubles Medusa builds custom furniture and re-upholsters pieces for homes, restaurants and hotels. To do that we need some information about you — your name, how to reach you, and what you would like made. This page explains exactly what we collect, why, how long we keep it, who else sees it, and what you can ask us to do with it.

We follow Quebec’s Act respecting the protection of personal information in the private sector, as modernized by Law 25 (formerly Bill 64). We have written this in plain language on purpose. If anything here is unclear, write to us and we will explain it.

1. Who we are

We are the business responsible for the personal information described on this page. This policy is governed by the laws in force in Quebec, Canada.

2. Who to contact about privacy

The person responsible for the protection of personal information at Meubles Medusa is:

Under Quebec law the role of privacy officer belongs by default to the person with the highest authority in the business. That person has assigned it to the individual named above. Write to them with any question, request or complaint about your personal information — that is the address for all of it.

3. What we collect, and why we collect each piece

We ask for what we need to quote your project, build it, deliver it and stand behind it — and nothing more. Fields that are optional are marked as optional on the form.

We do not ask for sensitive information such as health, financial identifiers or government-issued ID numbers, and you should not send them to us through the website.

4. What allows us to collect it

For each purpose there is a reason the law recognizes:

• Because you asked us for something, and we need it to deliver it. Your name, contact details, project details, files and delivery address are necessary to prepare a quote, build the piece, deliver and install it, and provide after-sales service. Without them we simply cannot do the work you asked for. The quote form now also carries its own tick box, unticked by default, confirming that we may use your contact details, your project information and any files you upload to prepare a quote and to contact you about that project; the form cannot be sent until you tick it.
• Because you gave us your consent, freely and separately. Our newsletter and our marketing emails rest on your consent. We ask for it separately, in plain terms, and never bundle it into a quote request: the newsletter sign-up form in the footer of every page now carries its own tick box, unticked by default, which you must tick yourself before the sign-up can be sent. You can withdraw it at any time — use the unsubscribe link in any email, or write to our privacy officer. Withdrawing does not affect anything we did lawfully before, and it will never cost you your quote, your order or your warranty.
• Measurement and advertising cookies: nothing is running, and we are not treating anything as your consent. We do not rely on your consent for the measurement and advertising tools described in section 8, because right now we are not in a position to ask you for it. This site is built so those tools stay switched off until a visitor agrees to them through a cookie banner, and that banner is not appearing on the site at the moment. So no one is being asked, no agreement is being given, and no measurement or advertising cookie is being placed in your browser. Until the banner works, we will not treat browsing this site as agreement to be measured or advertised to. When it is in place it will appear on your first visit and will ask about measurement (analytics) cookies — the one optional category now configured for this site — refusing will take one click, and a cookie-preferences control will stay on the page so you can change your mind later.
• Because a law requires it. Invoices, transaction records and accounting entries must be kept for tax and consumer-protection purposes, even after a project ends.
• Because it is needed to keep the site and your submission safe. The limited technical signals used to block spam and fraudulent form submissions are necessary to protect both of us.

Consent to marketing is never a condition of getting a quote, placing an order or being served.

5. How long we keep it

Once the purpose we collected something for has been fulfilled and no law requires us to keep it, we destroy the information or anonymize it so that it can no longer be linked back to you.

6. Who else handles your information

We do not sell, rent or trade your personal information. A small number of service providers handle parts of it on our behalf, each limited to what its job requires:

The measurement and advertising services in this table — Google Analytics, Google Tag Manager, Google Ads and the Meta Pixel — are configured but are not currently active on the site, and receive nothing from it. See section 8.

Each of these providers is bound by a written agreement that limits them to the purpose we hired them for, requires them to keep the information confidential and secure, forbids them from using it for their own purposes, and requires them to return or destroy it when the work is done.

We may also disclose information without your consent where the law requires or permits it — for example in response to a court order or a lawful demand from a public authority.

7. Does any of it leave Quebec?

Some of it does, and we want to be straightforward about which.

• Stays in Quebec: this website and everything you send through a form on it — your quote request, your messages, your uploaded photos and drawings — are hosted on Nestor’s Quebec infrastructure, in a data centre in the Montreal region. Your order, invoice and accounting records stay with us, in Quebec.
• Leaves Quebec: the measurement, advertising, mapping and anti-spam tools listed in section 6 are operated by companies based in the United States, and the browsing data they collect is handled there.

Before using those tools we assessed, as Quebec law requires, whether the information would receive protection equivalent to what it gets here. We looked at how sensitive it is (browsing and technical data, not your project files or your financial information), the purpose it is used for, the contractual protections each provider gives us, the security measures in place such as encryption in transit and the shortening of IP addresses, and the legal framework of the country concerned. On that basis we concluded the transfers are acceptable, and we limit them to what is described above.

You can write to our privacy officer at any time to learn more about that assessment.

8. Cookies and tracking

Cookies are small files a website leaves in your browser. This site uses three kinds:

• Strictly necessary — these make the site work and keep the forms safe from bots (Cloudflare Turnstile). The site cannot function properly without them.
• Measurement — Google Analytics and Google Tag Manager, which tell us how many people visit and which pages they read. We see totals and trends, not individuals.
• Advertising — Google Ads and the Meta Pixel, which tell us whether someone who saw one of our ads came to the site.

At the moment this site does not display a cookie banner, and the measurement and advertising tools listed above are not running. They are set to stay switched off until a visitor agrees to them, and because no one is being asked, no agreement is being given — so no measurement or advertising cookie is being placed, and no browsing data from this site is reaching those tools. Only the strictly necessary cookies are in use. One optional cookie category is now configured for this site — measurement (analytics), which covers Google Analytics; no advertising category is configured, so the advertising tools above stay switched off and no one is being asked to agree to them. Once the banner is working you will be asked about measurement on your first visit, refusing will be one click, and a cookie-preferences control will stay on the page so you can change your mind. In the meantime, you can also control these cookies yourself: your browser’s settings let you block or delete cookies for this site, Google offers an opt-out for Analytics and ad-settings controls for Ads, and Meta lets you manage ad preferences in your Facebook or Instagram account. You can also write to our privacy officer and ask us to stop using your information for measurement or advertising, and we will act on it.

9. Your rights, and how to use them

You may ask us to:

• See what we hold about you — a copy of your personal information, and information about how it is used and who it has been given to.
• Correct it — if something is wrong, incomplete or out of date.
• Delete it, or stop using it — where the information is no longer necessary for the purpose we collected it for, or where you withdraw the consent it was based on. Some records, such as invoices, we must keep for the legal period in section 5; we will tell you when that is the case.
• Receive it in a portable form — computerized information you gave us, in a structured, commonly used technology format, or sent directly to another organization when that is technically feasible.
• Withdraw your consent — to marketing emails, at any time. Measurement and advertising cookies are not running today (section 8); if we ever switch them on with your agreement, you will be able to take that agreement back the same way.
• Complain — see section 13.

How to make a request

Email infomeublesmedusa@gmail.com with “Privacy request” in the subject line, or write to the privacy officer at the address in section 2. Tell us what you would like — to see, correct, delete, or stop something — and, if you can, roughly when you dealt with us, which helps us find your file.

How we confirm it is you

So that we never hand your information to someone else, we confirm your identity before we act. Usually that simply means replying from the email address we already have on file, or confirming a detail only you would know, such as the date or content of a quote. We ask for the least we can: we do not require a copy of a government ID unless there is no other way to be sure, and anything you send us for verification is destroyed once we have verified you.

How long we take

We answer within 30 days of receiving your request, as Quebec law requires. Our response is free in almost every case; if reproducing or transcribing the information would carry a reasonable charge, we will tell you the amount before doing anything. If we refuse a request in whole or in part, we will tell you in writing why, which provision of the law we rely on, and how you may have that decision reviewed by the Commission d’accès à l’information.

10. Minors

Our products and services are meant for adults, and we do not knowingly collect personal information from anyone under 14. If we learn that someone under 14 has sent us personal information without the consent of a parent or guardian, we delete it. Where information about a person under 14 is genuinely needed — for example a young person named on a family order — we require the consent of a parent or guardian before collecting or using it. In every case we consider the interest of the minor before using their information, and we do not use it for marketing. A parent or guardian can write to our privacy officer to see, correct or have that information removed, and we will act on it promptly.

11. Automated decisions and profiling

No decision about you is made only by a machine. Quotes, prices, accepting or refusing an order, payment terms and delivery arrangements are all decided by a person here at Meubles Medusa, who reads your request and thinks about it. We do not use software to score, profile or screen customers, and the analytics and advertising tools in section 6 measure audiences as a whole rather than making decisions about you individually.

If that ever changes, we will tell you at the time the decision is made, explain what personal information was used and the main reasons for the outcome, and you will be able to ask a person to review it and to submit your own comments.

12. Keeping it safe, and what happens if something goes wrong

We protect your information with measures suited to how sensitive it is: access limited to the few people who need it to do their work, individual accounts and strong passwords, encryption of the connection between your browser and this site, hosting in secured Quebec infrastructure, bot protection on the forms, and the retention limits in section 5.

If a confidentiality incident happens — information lost, disclosed, used without authorization or accessed by someone who should not have it — we act immediately to contain it and reduce the risk of it happening again. Where the incident presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec and the people affected promptly, without delay. Quebec law requires this notification to be made with diligence rather than within a fixed number of hours, so we commit to acting as fast as the situation allows rather than to an arbitrary deadline. We may also notify anyone who could reduce the risk. We keep a register of all confidentiality incidents, including those that do not trigger notification, for five years, and we make it available to the Commission on request.

13. If you are not satisfied

Please come to us first — write to our privacy officer at infomeublesmedusa@gmail.com and we will look into it and answer you within 30 days.

If our answer does not satisfy you, you may file a complaint with the regulator, the Commission d’accès à l’information du Québec, which can examine our practices and review a decision we made about your request. The Commission can be reached through its website at www.cai.gouv.qc.ca or by telephone at 1 888 528-7741.

14. Changes to this policy

We update this page when our practices change — for example if we add a tool, change how long we keep something, or start taking payments online. The date at the top always shows the version in force. If a change materially affects your rights, we will highlight it on the site and, where it concerns our newsletter, tell subscribers by email.

Last updated: September 29, 2026.