Privacy Policy

1. Who we are and how to reach us

Ollie Page Creations ("we", "us", "our") operates olliepagecreations.com and is the business responsible for the personal information described in this policy — the "controller" under the GDPR, and the "enterprise" under Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).

Ollie Page Creations

432 Rue des Cèdres

Saints-Anges, Quebec, G0S 3E0

Canada

Quebec law requires every enterprise to designate a person responsible for the protection of personal information. Ours is:

Olivier Lepage Dumont, Privacy Officer (Responsable de la protection des renseignements personnels)
[email protected]

We aim to acknowledge every privacy request within 2 business days and to resolve it within 30 days, which is the deadline Law 25 and the GDPR both set.

2. Which laws apply

We are based in Quebec, Canada, and we sell worldwide. Our baseline is Quebec's Law 25 and Canada's PIPEDA. Where you are in the EEA or the UK, we also apply the GDPR / UK GDPR — including the legal bases in section 5 and the rights in section 8. Where you are in California, see section 9. Whichever framework gives you more protection is the one we follow.

3. Information we collect

a. Browsing the site

You can browse the entire shop without an account and without identifying yourself. Our host (Cloudflare) records standard server logs — IP address, browser type, pages requested, timestamps — which we use for security, abuse prevention, and diagnosing faults.

b. Analytics

We use Google Analytics 4 to understand which pages and products people find useful. It sets a pseudonymous identifier and records page views and a small set of events (for example, adding an item to the cart, or clicking through to our Etsy shop). IP addresses are truncated by Google before storage, and we have not enabled Google Signals, advertising features, or cross-device tracking.

Analytics cookies are off until you accept them in our cookie banner — for every visitor, wherever you are, not only where the law requires us to ask. You can change your mind at any time. Full details in the Cookie Policy.

c. Buying from us

Payments are processed by Lemon Squeezy, LLC, which acts as our Merchant of Record — legally, it is the seller on your receipt. You enter your payment details on Lemon Squeezy's checkout, not on our site. We never see or store your full card number. What we receive is the order record: your email address, order reference, the items purchased, the amount, any discount code used, and the country used for tax.

d. Delivering your files

Each completed order generates a short-lived download token, stored by our Cloudflare Worker and tied to your order reference. It exists only to prove you are entitled to the files, and it expires shortly after purchase.

e. Binder Studio accounts

Binder Studio works fully without an account: your binders are saved in your own browser's local storage and never leave your device. If you choose to create an account so your binders follow you between devices, we then store:

• Your email address.
• A hash of your password (PBKDF2 with a per-user salt) — never the password itself. If you sign in with Google instead, we store a Google account identifier and no password at all.
• A session record so you stay signed in, held as a hash of an opaque random token. The matching cookie is HttpOnly and Secure.
• The binders you save: their names, layouts, colours, which cards you placed in which pocket, and any images you uploaded.

f. Images you upload

Images you add to a binder are stored with that binder. If you use the AI "extend into my binder" feature, the image is transmitted to Google's Gemini API to generate the extended artwork and the result is returned to your browser. Do not upload photographs of identifiable people, or anything confidential, to this feature. See the Acceptable Use Policy.

g. When you contact us

If you email us or message us on Etsy, we keep the correspondence and whatever you choose to put in it, so we can deal with your question and any follow-up.

We do not collect special-category data, we do not run advertising or retargeting pixels, we do not build marketing profiles, and we do not make automated decisions that produce legal or similarly significant effects about you.

4. How we use it

• To take your order, deliver your files, and honour any refund.
• To operate Binder Studio accounts and sync your binders between your devices.
• To answer your questions and provide support.
• To keep the site secure and prevent fraud and abuse.
• To understand, in aggregate, how the site is used so we can improve it.
• To meet our tax, accounting, and other legal obligations.

We do not sell, rent, or trade your personal information, and we do not share it with third parties for their own marketing. We do not send marketing email unless you have separately asked us to.

5. Legal bases (EEA / UK visitors)

• Performance of a contract — processing your order, delivering your files, running your Binder Studio account.
• Consent — analytics cookies, and any marketing email you opt into. You can withdraw consent at any time without affecting what came before.
• Legitimate interests — securing the site, preventing fraud and abuse, and keeping the service working. We have weighed these against your rights and consider them proportionate, since they involve no profiling and minimal data.
• Legal obligation — retaining transaction records for tax and accounting.

6. Who else processes your information

We keep the list short on purpose. Each provider below is bound to process personal information only on our instructions, with appropriate security, except where noted that they act as an independent controller.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If the business is ever sold or reorganised, personal information may transfer with it; you would be told before that changed anything about how your information is handled.

7. Where your information goes

We are in Canada and several of our providers are in the United States, so your information is processed outside your country and, for Quebec residents, outside Quebec. Before using a provider we assess whether the information will receive adequate protection, as Law 25 s. 17 requires.

For EEA and UK visitors: Canada holds a partial adequacy decision from the European Commission covering private-sector organisations subject to PIPEDA, which includes us. Transfers onward to our US providers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), incorporated into our agreements with them.

8. How long we keep it

Images sent to the AI extend feature are processed to generate your result and are not stored by us beyond the binder you save them into.

9. Your rights

Wherever you live, you can ask us to give you a copy of your information, correct it, or delete it. Depending on where you are, you may also have the rights below. We do not charge for this, and we will never treat you differently for exercising a right.

Quebec (Law 25) and Canada (PIPEDA)

• Access the personal information we hold about you.
• Rectify information that is inaccurate, incomplete, or ambiguous.
• Withdraw consent, and ask us to cease disseminating information or to de-index a link where it causes you serious injury.
• Portability — receive the information you gave us in a structured, commonly used technological format.

EEA and UK (GDPR / UK GDPR)

• Access, rectification, erasure, restriction, portability, and objection.
• The right to withdraw consent at any time.
• The right to lodge a complaint with your supervisory authority.

California (CCPA / CPRA)

You may request to know, delete, or correct your personal information, and to know what we disclose. We do not sell or share personal information as those terms are defined by the CCPA, and we do not process it for cross-context behavioural advertising — so there is no "Do Not Sell or Share My Personal Information" link to offer.

How to exercise a right

Email [email protected] and tell us what you want. We may need to verify your identity first — usually by writing to you from the email address on your order or account. If you hold a Binder Studio account you can also delete it yourself from within the app, which erases your binders.

10. Security

The whole site is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes. Session tokens are random, stored as hashes, and carried in HttpOnly, Secure cookies that JavaScript cannot read. Payment card data never touches our systems. Access to the order and account databases is limited to what is needed to run the shop.

No system is perfectly secure. If a breach ever creates a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the people affected, as Law 25 requires — and the relevant EU/UK authority within 72 hours where the GDPR applies.

11. Children

This site is intended for adults. Our products are not sold to children, and Binder Studio accounts are not for anyone under 16 (or the minimum age of digital consent where you live, if it is lower — 13 in the UK and Canada). We do not knowingly collect personal information from children. If you believe a child has given us information, email [email protected] and we will delete it.

12. Complaints

Please come to us first — most things are quickest to fix directly. If you are not satisfied, you can complain to a regulator:

• Quebec: Commission d'accès à l'information du Québec
• Canada: Office of the Privacy Commissioner of Canada
• EEA: your national data protection authority
• UK: Information Commissioner's Office

13. Changes to this policy

We update this policy when what we do changes. The current version always lives here with its "last updated" date. If a change materially affects how we use information you already gave us, we will tell you directly — by email where we have your address — before it takes effect.

Questions about anything here: [email protected]. Ollie Page Creations — thank you for reading this far.