Privacy Policy

StickerMTL is a division and a trade name of Les Créations François Lacroix inc., an incorporated Quebec company based in Blainville, Quebec. StickerMTL is not a separate legal entity. The stickermtl.com and autocollantmtl.com sites are ours.

Les Créations François Lacroix inc. is therefore the company responsible for your personal information. Our details: 101 rue Gaston-Dumoulin, Blainville (Québec), Canada · NEQ to come · to come · francis@creationslacroix.com.

Quebec law requires a named person to be in charge of the protection of personal information inside the company, and requires that person's title and contact details to be published. Here, that person is François Lacroix, whose title is Person in charge of the protection of personal information.

You can write to them any time at francis@creationslacroix.com, or by mail at 101 rue Gaston-Dumoulin, Blainville (Québec), Canada. Put "personal information" in the subject line and it will move faster.

We collect only what we need to print and deliver your order. Here is the full list.

First name, last name, email, phone number. To identify you, confirm your order, send your invoice and reach you if there is a problem with your file.

Shipping address. To calculate shipping costs and mail your parcel. If you choose free pickup in Blainville, we do not ask for an address.

Your artwork: the file you upload and the print-ready PNG generated by the on-site editor. We need it to produce your stickers. We also keep it so we can reprint if you reorder the same thing or if there is a quality problem.

Your child's first name, and their last name if you want it printed, when you order a school label set. It is used to print their labels and nothing else: the details are in the section "School labels: your child's name".

Your order details: items, sizes, quantities, finishes, amounts, GST and QST, payment method, delivery method, tracking number, and any notes you leave us. For production, bookkeeping, taxes and after-sales service.

Technical information. Our hosting providers keep server logs that may contain your IP address, the date and time of your visit and your browser type. This is for security and troubleshooting. We build no profile from it and we look at those logs only if there is a bug or an abuse attempt.

If you write to us through the contact form: your name, your email and your message. The message reaches us by email, in our orders mailbox, and we answer at the address you gave. For anything touching your personal information, write directly to francis@creationslacroix.com instead: that is the address we watch for this.

Your cookie choice. When you accept or decline in the banner, we record that choice in a register, with a fingerprint of your IP address rather than the address itself. The law requires us to be able to prove your choice. The details are in the "Cookies and browser storage" section.

A school label set is your child's first name printed on every label. To make it, we ask for that first name, the last name if you want it on the labels too, and the theme you choose (design, colour, font). It is the only information about a child that we collect, and it serves one purpose: printing their labels. We do not use it to contact you, for advertising, or for anything else.

Where it goes. Your browser composes the label sheets with the name on them and sends them to Supabase, in Montreal, in the same private space as the other order artwork. The name also appears in the internal production email sent through Resend, in your order record and in the shop's print queue: it is what we proofread before cutting, so no typo gets through. It never goes to Stripe or to our accounting software: the payment line and the invoice say "School label set", with no name.

How long. A sheet that was prepared but never ordered — abandoned cart, payment not completed — is deleted automatically by our daily clean-up, at most 72 hours after it was uploaded (48 hours of waiting, then the next run); an order whose Stripe payment never went through is covered too. The sheets of a placed order are kept like your other print artwork, for as long as a reprint or a quality issue could need them (section "How long we keep it").

In your browser. While you prepare the set, the name is kept for the life of the tab (session storage) and disappears when you close it. Once the set is in the cart, the name and the sheets sit in the "stickermtl" IndexedDB database, never in the cart's permanent local storage, and they are erased when you remove the set from the cart, when the order is placed, or when you clear the site's data.

To have your child's name erased before those deadlines, write to us at the address in the section "How to exercise your rights" with your order number or the email you used.

Your card number never touches our servers. Never.

Payment happens on a page hosted by Stripe (Stripe Checkout), which also accepts Apple Pay and Google Pay. You enter your card details with Stripe, not with us. Stripe is a PCI-DSS Level 1 certified payment processor.

From Stripe our servers receive only a confirmation: whether the payment went through, the amount, and a transaction identifier. Your full card number, its expiry date and the code on the back are never transmitted to us. Like any merchant, we see the card type and its last four digits in our Stripe dashboard, and nothing more.

We collect your information with your consent, which you give by placing your order or by writing to us. The fields marked as required are the ones without which we cannot produce or deliver: if you leave them empty, we cannot take the order.

We use your information only for the purposes described here. If we ever wanted to use it for something else, we would ask you first, in a separate request.

We do not send you a newsletter. If we ever launch one, signing up will be optional, separate from the order, and you will be able to unsubscribe in one click.

We do not work alone. Here are all the third parties that touch your information, what they see and where they are.

Stripe (Stripe, Inc., United States, and Stripe Payments Canada, Ltd.): payment. Sees your name, your email, the amount, and your card data, which it processes itself.

Supabase: the database and the file storage. This is where your order and your artwork live. Our project is hosted in the ca-central-1 region, which is Montreal, Quebec. Your artwork sits in a private space: no public listing, no guessable URL. That said, Supabase, Inc. is a US company whose support staff may access the project from outside Quebec.

Resend (Resend, Inc., United States), which runs on Amazon SES infrastructure: sending the confirmation emails and the internal production emails. Sees your name, your email and your order details. The internal production email carries a temporary download link to your artwork, valid for 48 hours (or the file as an attachment if the database is unavailable).

Vercel (Vercel, Inc., United States): hosting the site. The site's code and all its server functions — including the one that receives your order — run on Vercel's infrastructure, outside Quebec: we have pinned no region in our configuration, so it is our project's default region, in the United States. Vercel sees the traffic and keeps technical logs. Vercel also counts the site's visits (Vercel Web Analytics): page views, landing page, country, device type. This measurement sets no cookie and does not follow anyone from site to site; it cannot identify you, which is why it does not go through the banner.

Canada Post: delivery. Receives your name, your address and your phone number to deliver the parcel. If you choose pickup in Blainville, Canada Post receives nothing.

Google (Google LLC, United States, and Google Ireland Limited): traffic measurement with Google Analytics 4 and ad measurement with Google Ads. Both load only if you accept cookies in the banner. When active, Google sees your browsing on the site and, for a paid order, the order number and the amount before taxes — never your name, address, email or artwork. If you decline, nothing goes to Google.

That is all. No data broker, no social network, no advertising network other than Google Ads. The cookie banner is our own, in the site's code: no external consent management service is used. If we ever added a third party, we would name it here before turning it on.

Quebec law requires us to assess a transfer before sending personal information outside Quebec, and to tell you about it. Here is where things stand.

Stored in Quebec: your order and your artwork live with Supabase, in the ca-central-1 region, in Montreal. Note that "stored in Quebec" does not mean "never left Quebec". Every order passes through our hosting servers, outside Quebec, before it reaches Montreal — your name, your address, your phone number and the bytes of your artwork with it. And Supabase, Inc. is a US company whose support staff may access the project from outside Quebec.

Leaves Quebec, to the United States: the site's hosting at Vercel, the sending of emails at Resend, the payment processing at Stripe, and — only if you accept cookies — the traffic and advertising measurement at Google. This information may therefore be subject to United States law, including access requests from United States authorities.

Before using these providers, we assessed the sensitivity of the information involved (order contact details and artwork: nothing medical, no card data on our side, no social insurance number), the purpose of the use, the protection measures offered including contractual commitments, and the legal regime of the destination country. Each provider's processing is governed by the written data processing agreement it imposes on its customers and that we accepted. We concluded that the protection is adequate. You can write to us to learn more about that assessment.

The transfer to Google is the only one of the four that depends on you: it happens only if you accept cookies, and you can withdraw it at any time through the "Manage cookies" link at the bottom of every page. The other three are necessary to deliver your order, so declining cookies does not stop them.

We keep your information for as long as needed, and no longer. Here are the rules we apply.

Orders, invoices and tax records: at least six years after the end of the fiscal year concerned. That is the minimum Canadian tax law imposes on us.

Print artwork (your file and the generated PNG): we keep it as long as it is useful to reprint or to settle a quality problem on your order, then we destroy it. You can ask us to destroy it sooner: we do that within 30 days, unless an order is still in production.

Emails from the contact form: for as long as it takes to handle your request and the reasonable follow-up that comes with it.

Cookie consent register: we keep it as long as we must be able to prove your choice — while that choice is in force, plus a reasonable time for an audit or a complaint that might follow. The register is append-only: a new choice is added to the history instead of erasing the old one, otherwise we could no longer prove what happened and when.

Let's be clear about the how: only one clean-up is automatic in our systems, the deletion of school label sheets that were prepared but never ordered, by the daily clean-up at most 72 hours after upload (section "School labels: your child's name"). For everything else, destruction is done by hand, when the purpose is fulfilled or when you ask for it. The criteria we apply: how long our tax and accounting obligations last, a reasonable window for a claim or dispute on an order, and the useful life of a reprint. When the purpose is fulfilled, we destroy the information.

Since 8 October 2026 the site uses analytics and advertising cookies. They all start blocked: nothing is set and nothing is sent before you click "Accept" in the banner.

What is strictly necessary and works without your consent, because the site would not run without it: your cart (local storage, key "stickermtl_cart_v2"), your shipping details if you have ordered before, so you don't retype them (key "stickermtl_customer"), the colours you last used in the editor (key "stickermtl_recent_colors"), your in-progress design files (IndexedDB database "stickermtl") and your cookie choice itself (key "stickermtl-cookie-consent"). All of it stays in your browser and never leaves your device unless you place an order. You can wipe it by clearing the site's data in your browser.

Only one real server cookie exists: "stickermtl_admin". It is the login cookie for the order management system, set only when a staff member logs into the admin, for 30 days. It is strictly necessary for that private area, and it has nothing to do with you.

If you accept: two Google tools load. Google Analytics 4 (id G-YRCP4XMTQ9) measures site traffic — pageviews, where the visit came from, device type. Google Ads (id AW-18500485325) measures how well our ads work: when an order is paid we send Google the order number, the amount before taxes and the currency, so we know which ads are worth running. Never your name, your address, your email or your artwork. Google's cookies can last up to two years; you clear them by clearing the site's data.

If you decline: both tools stay blocked and no data goes to Google. The site works exactly the same — there is nothing hidden behind the "Accept" button. We still record your refusal, because that is precisely what we have to be able to prove.

We keep a register of your choices, as the law requires. Every time you accept or decline we record: a random identifier that holds nothing about you, your choice, the version of the banner wording, the language, the page you were on, your browser, the date and time, and a fingerprint of your IP address. The fingerprint is a one-way computation (SHA-256 with a secret that is not in the code): your IP address is never stored in the clear and cannot be reconstructed from the fingerprint. This register is kept in our database at Supabase, in Montreal, and serves only to prove that we asked for your choice and honoured it.

You can change your mind at any time: the "Manage cookies" link at the bottom of every page reopens the banner, and your new choice replaces the old one immediately. If we change the banner wording or the tools it covers, we ask you again instead of assuming your old yes still stands.

The law gives you rights over your information. Exercising them is free.

Access. You can ask what information we hold about you, and get a copy of it.

Rectification. If it is inaccurate, incomplete or ambiguous, you can have it corrected. If we collected something we had no right to collect, you can have it deleted.

Withdrawal of consent. You can withdraw your consent at any time. If you withdraw it while an order is in production, we will have to cancel it: without your name, your address and your artwork we can neither print nor deliver. What happens to any amount already paid is covered in our terms of sale. Information we must keep for our tax obligations stays on file until the legal period ends.

Portability. Since September 22, 2024, you can ask for the computerized information you provided to us in a structured, commonly used technological format, unless doing so raises serious practical difficulties, or ask us to send it directly to another business or organization you designate. We will send you a JSON or CSV file with your contact details and your orders, plus your artwork in its original format. This right does not cover what we created or inferred on our side, such as our production notes.

Cessation of dissemination and de-indexing. If we were disseminating information about you unlawfully, or in a way that seriously harms your reputation or your privacy, you can require us to stop disseminating it or to have the link attached to your name de-indexed — provided that injury is clearly greater than the public's interest in knowing the information or freedom of expression, and that what you ask for goes no further than necessary to prevent the injury. In practice we publish nothing about our customers: no named testimonials, no project gallery with your name, unless you asked us in writing.

Complaint. You can file a complaint with the supervisory authority. Contact details are below.

Write to François Lacroix, at francis@creationslacroix.com, or by mail at 101 rue Gaston-Dumoulin, Blainville (Québec), Canada.

Tell us what you want — access, correction, deletion, portability, withdrawal of consent — and give us something to find you with: the email used for the order, or an order number.

We will verify it is really you before handing anything over. That may mean replying to us from the email address used for the order. We do not ask for ID documents or photos by email; if we cannot confirm who you are another way, we will suggest one.

We answer in writing promptly, and no later than 30 days after receiving your request. If we refuse in whole or in part, we will tell you why, which provision of the law we rely on, and how to challenge it.

If our answer does not satisfy you, or if we do not answer within 30 days, you can turn to the Commission d'accès à l'information du Québec (CAI). It is the body that oversees Quebec's private-sector personal information law.

Commission d'accès à l'information du Québec — Québec City: 525, boulevard René-Lévesque Est, bureau 2.36, Québec (Québec) G1R 5S9 · 418 528-7741 · 1 888 528-7741. Montreal: 2045, rue Stanley, bureau 900, Montréal (Québec) H3A 2V4 · 514 873-4196 · 1 888 528-7741. Website: cai.gouv.qc.ca.

For matters falling under federal law — in particular information crossing a provincial or national border in the course of commercial activity — you can also turn to the Office of the Privacy Commissioner of Canada: priv.gc.ca · 1 800 282-1376.

We do not sell your personal information. We do not rent it. We do not trade it. Never, to anyone.

The only third parties that touch it are the ones named above. They work for us, on our instructions, and they are not allowed to use it for their own purposes. We disclose it to no one else, unless the law requires or permits it — for example under a court order — and we would tell you if we are allowed to.

One exception, and only one: if the business were sold, merged or financed, your information could be communicated to the other party as part of the transaction, as the law permits. That would happen under a confidentiality agreement, limited to what is necessary to close, and the acquirer would be held to the same commitments made here. If the transaction closed, we would tell you.

We do not knowingly collect personal information from a child under 14 without the consent of the person having parental authority or of the guardian. The site is designed for orders placed by adults.

If you are under 14, have your parent or guardian place the order.

If we learn that a child under 14 has given us information without that consent, we delete it. A parent or guardian can write to us at francis@creationslacroix.com to request deletion. We will only confirm the request really comes from the parent or guardian, then we delete.

Here are the measures we apply, given the sensitivity of the information and the size of our business.

The whole site runs on HTTPS. The database and the file storage are reachable only with a service key that stays on the server, never in your browser.

Your artwork sits in a private space: no public listing, no guessable URL. To look at it we generate a time-limited signed link — 48 hours in the production email, 24 hours in our order management system. For that window the link gives access to the file to whoever holds it: that is the trade-off we chose so we can print without copying your files everywhere. After the window the link stops working.

Our order management system sits behind a shared password and a signed login cookie. Only the people who produce and ship the orders have that password. Know the limit: because the password is shared, the system keeps no trace of who looked at what.

No system is perfect. If something happens anyway, we follow the procedure set out below.

A confidentiality incident is unauthorized access to, use of or disclosure of personal information, a loss of such information, or any other breach of its protection.

If we have reason to believe an incident has occurred, we act immediately to limit the damage and prevent a repeat: cut off access, rotate keys, restore from backups.

We then assess whether there is a risk of serious injury to you, looking at the sensitivity of the information involved, the anticipated consequences of its use, and the likelihood that it will be used for harmful purposes. We document that assessment, even when the conclusion is that there is no serious risk.

If there is a risk of serious injury, we promptly notify the Commission d'accès à l'information and each affected person. The notice states what happened, which information is involved, what we did, and what you can do on your side to reduce the risk.

We keep a register of all incidents, including those with no risk of serious injury, and we retain it for at least five years. The Commission may request it.

No decision about you is made solely by a system, without human involvement. Every order is looked at by a person before it goes into production.

Law 25 requires that any technology able to identify, locate or profile you be deactivated by default, and that we tell you so. That is the case here: Google's cookies start blocked and only activate if you click "Accept" in the banner.

We do not do profiling ourselves, and we activate no identification or localisation function. But let's be honest about one thing: if you accept cookies, Google Ads can personalise ads based on your visit, which is a form of advertising profiling — at Google, not here. It gives us no profile of you: we see only totals and audience statistics, never a record per person. If you decline, it does not happen at all.

The only other information that could locate you is the IP addresses in our hosts' logs, which we do not use to track you, and the address you give us for delivery.

We do not use your artwork for anything other than your order: no portfolio, no advertising, no training of an artificial intelligence model. If we ever wanted to show one of your projects, we would ask you first, in writing.

We may change this policy, for example if we switch providers, add a delivery method or turn on an analytics tool.

When a change is significant, we flag it on the site. The version in force is always the one published here.

Last updated: 2026-10-12.