Privacy Policy

Mariez is a wedding planning platform available at mariez.ca. For questions about this policy or your personal information, contact us at privacy@mariez.ca.

We collect the following categories of information:

• Account: name, email address, hashed password, language preferences.
• Wedding: date, venue, theme, budget, task lists, vendor notes.
• Guests: names, contact details, RSVPs, dietary restrictions you enter on their behalf.
• Media: photos and documents you upload.
• Billing: subscription history and invoices. Card details are processed and stored by Stripe — Mariez does not store payment card numbers.
• Technical: IP address, device type, operating system, browser, connection data, unique identifiers, and any other technical information necessary to provide and secure the service.
• Analytics (PostHog): pages visited, session duration, interaction events. For authenticated users, these events are linked to their profile (email, plan). Unauthenticated visitors are not profiled.

• Provide, maintain and improve the service.
• Manage your account and subscription.
• Send transactional emails (confirmations, password resets, reminders).
• Respond to support requests.
• Detect and prevent fraud and abuse.
• Meet our legal and regulatory obligations.
• Improve features using aggregated, non-identifiable data.
• In the future, power AI-based features (suggestions, automations) — a separate notice will be provided where required by law.

• Consent: account creation, non-essential cookies, marketing communications.
• Contract performance: delivering the features of your paid or free plan.
• Legitimate interest: security, fraud prevention, service reliability and improvement.
• Legal obligation: tax records, regulatory compliance.

• Essential cookies: session management, authentication, language preferences. These are required for the service to function and do not require consent.
• Analytics cookies: aggregate audience measurement. Consent is requested before placing these cookies.

No third-party advertising cookies are used. You can manage cookie preferences through your browser settings or the consent banner.

We do not sell personal information. We share it only with the following service providers, strictly to operate the service:

• Supabase — database hosting and file storage (servers in the United States).
• Stripe — subscription and payment processing (servers in the United States and Canada).
• Resend / Sendgrid — transactional email delivery (servers in the United States).
• PostHog — behavioural analytics (servers in the United States).

We may also share information where required by a court order or clear legal obligation.

Some of our service providers host data in the United States. Before any such transfer, we conduct a Privacy Impact Assessment (PIA) as required by Quebec Law 25. Data processing agreements (DPAs) with contractual privacy protections are in place with each provider. We limit transfers to what is strictly necessary to provide the service.

• Account data: retained for the duration of your subscription plus 12 months after cancellation.
• Wedding and guest data: deleted upon request or 12 months after account cancellation.
• Billing records: 7 years (Canadian tax obligation).
• Technical logs: 90 days.
• Encrypted backups: up to 30 days after logical deletion.

We use TLS encryption in transit and AES-256 encryption at rest. Passwords are hashed and never stored in plain text. Access to personal data is limited to personnel and contractors who need it, following the principle of least privilege. We monitor for anomalies and respond promptly to incidents. No online service is perfectly secure, but we continuously work to reduce risk.

Under Quebec Law 25 and PIPEDA, you have the right to:

• Access — obtain a copy of your personal information.
• Rectification — correct inaccurate or incomplete information.
• Withdrawal of consent — withdraw consent for future processing.
• Erasure — request deletion of your personal information (subject to legal exceptions).
• Portability — receive your data in a structured, machine-readable format.
• De-indexing — request removal of content about you published online.

To exercise any of these rights, email privacy@mariez.ca. We respond within 30 days. Identity verification may be required. Some exceptions apply under applicable law.

We maintain an internal register of all confidentiality incidents. If an incident presents a serious risk of harm, we notify the Commission d'accès à l'information (CAI) within 72 hours and notify affected individuals as soon as possible. Corrective measures are documented and applied promptly.

We provide 30 days' notice by email for material changes to this policy. The date at the top of this page always reflects the latest version. Continued use of the service after the effective date constitutes acceptance of the updated policy.

Mariez designates a privacy officer responsible for compliance with Law 25 (Art. 3.1), handling rights requests and managing incidents. Contact: privacy@mariez.ca. Response time: 30 days.

Privacy requests: privacy@mariez.ca. General support: support@mariez.ca. You may also file a complaint with the Commission d'accès à l'information (CAI) or the Office of the Privacy Commissioner of Canada (OPC).