Privacy Policy

1. Introduction

This Privacy Policy explains how Gradientor ("we," "our," or "the Service") collects, uses, discloses, and protects your personal information in compliance with Quebec's Law 25 (Act respecting the protection of personal information in the private sector, as modernized by Bill 64) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

We are committed to protecting your privacy and ensuring the confidentiality of your personal information. This policy describes your privacy rights and how you are protected under Quebec and Canadian privacy laws.

Privacy Officer Contact:
For any privacy-related inquiries, you may contact our Privacy Officer at: privacy@gradient.jaxk.dev

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, and password (managed through Clerk authentication)
• Payment Information: Billing details and payment card information (processed by Stripe)
• User Content: Gradient designs and related creative content you create
• Communications: Information you provide when contacting support or providing feedback

2.2 Information Collected Automatically

• Usage Data: Information about how you interact with the Service
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed, and referring URLs
• Cookies: Session cookies and preference settings (see Cookie Policy section)

2.3 Information from Third Parties

• Authentication Providers: Profile information from Clerk when you sign in
• Payment Processors: Transaction confirmations from Stripe

3. How We Use Your Information

We use your personal information only for the purposes for which it was collected, including:

3.1 Service Provision

• Creating and managing your account
• Providing access to gradient creation tools
• Storing and retrieving your saved designs
• Processing payments and managing subscriptions

3.2 Service Improvement

• Analyzing usage patterns to improve features
• Troubleshooting technical issues
• Developing new features and functionality

3.3 Communication

• Sending service-related notifications
• Responding to your inquiries and support requests
• Sending marketing communications (with your consent)

3.4 Legal and Security

• Complying with legal obligations
• Protecting against fraud and abuse
• Enforcing our Terms of Service

4. Legal Basis for Processing

In accordance with Quebec Law 25 and PIPEDA, we process your personal information only when we have a valid legal basis:

• Consent: Where you have given clear consent for processing
• Contract: Where processing is necessary for our agreement with you
• Legal Obligation: Where we must process data to comply with the law
• Legitimate Interests: Where processing is necessary for legitimate interests that do not override your privacy rights

Consent Withdrawal: Where we rely on consent, you may withdraw it at any time by contacting us at privacy@gradient.jaxk.dev. This will not affect the lawfulness of processing before withdrawal.

5. Data Sharing and Third Parties

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers

• Clerk (Authentication): For secure user authentication and account management
• Stripe (Payments): For processing payments and managing subscriptions
• Convex (Database): For storing user data and gradient designs
• Vercel (Hosting): For hosting and delivering the Service

All service providers are required to protect your information in accordance with this policy and applicable laws. We ensure appropriate contractual safeguards are in place.

5.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect rights, property, or safety.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change and any choices you may have.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

Retention Periods:

• Account Information: Duration of account plus 30 days after deletion
• User Content: Until you delete it or 30 days after account termination
• Payment Records: As required by tax and accounting laws (typically 7 years)
• Communications: 2 years or as required for legal purposes
• Usage Analytics: 12 months in identifiable form, then anonymized

Deletion Rights: You may request deletion of your personal information at any time, subject to legal retention requirements.

7. Your Rights

Under Quebec Law 25 and PIPEDA, you have the following rights regarding your personal information:

7.1 Access Rights

• Right to know what personal information we hold about you
• Right to receive a copy of your personal information
• Right to know how your information is used and shared

7.2 Correction Rights

• Right to correct inaccurate information
• Right to update incomplete information
• Right to have corrections communicated to third parties

7.3 Deletion Rights (Right to be Forgotten)

• Right to request deletion of your personal information
• Right to de-indexing from search engines (where applicable)

7.4 Portability Rights

• Right to receive your data in a structured, machine-readable format
• Right to transfer your data to another service

7.5 Consent and Objection Rights

• Right to withdraw consent at any time
• Right to object to processing for marketing purposes
• Right to object to automated decision-making

7.6 Exercising Your Rights

To exercise any of these rights, contact us at privacy@gradient.jaxk.dev. We will respond to your request within 30 days, as required by law. We may require verification of your identity before processing your request.

7.7 Complaints

If you have concerns about our privacy practices, you have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Security Measures Include:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Secure authentication through Clerk
• Regular security assessments and updates
• Access controls and authentication for internal systems
• Incident response procedures

Data Breach Notification

In accordance with Quebec Law 25, if a confidentiality incident occurs that presents a risk of serious injury, we will:

• Notify the Commission d'accès à l'information du Québec
• Notify affected individuals without unreasonable delay
• Keep a register of all confidentiality incidents

9. International Data Transfers

Your information may be transferred to and processed in countries other than Canada, including the United States, where our service providers operate.

When we transfer your information internationally, we ensure appropriate safeguards are in place:

• Contractual clauses requiring equivalent protection
• Verification of adequate privacy laws in destination countries
• Limiting transfers to what is necessary for service provision

Notice: Personal information transferred outside Quebec and Canada may be subject to the laws of the destination jurisdiction, including lawful access by courts, law enforcement, or national security authorities.

10. Cookies and Tracking Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device when you visit our Service. We use cookies and similar technologies to enhance your experience.

10.2 Types of Cookies We Use

• Essential Cookies: Required for the Service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand usage patterns (anonymized)

10.3 Managing Cookies

You can control cookies through your browser settings. Disabling certain cookies may limit your ability to use some features of the Service.

10.4 Do Not Track

We respect Do Not Track signals. When detected, we do not track your activity across websites or load any third-party tracking scripts.

11. Children's Privacy

In accordance with Quebec law, users must be at least 14 years old to use the Service independently. Users between 14 and 18 should have parental consent.

We do not knowingly collect personal information from children under 14 without parental consent. If we learn we have collected such information, we will delete it promptly.

Parents or guardians who believe their child under 14 has provided personal information should contact us immediately at privacy@gradient.jaxk.dev.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date
• Sending email notification for significant changes
• Obtaining consent where required by law

We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Information

Language Rights:
You have the right to communicate with us and receive services in French. Cette politique de confidentialité est disponible en français sur demande.

Accessibility:
We are committed to making our privacy practices accessible to all. If you need this policy in an alternative format, please contact us.