Privacy Policy

Last updated: October 28, 2026

Marie's Beauty Spa (“we”, “us”) is a beauty studio in Orléans, Ottawa, Ontario. This policy explains what personal information we collect through maries.io and our booking system, why, how long we keep it, and your choices. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for clients in Quebec, Quebec's Act respecting the protection of personal information in the private sector.

1. Who is responsible

The person in charge of the protection of personal information is Marie Zaylah, Owner. Contact: [email protected], (343) 777-2700, 601 Prominence Way, Orléans, ON.

2. What we collect and why

When you book or manage an appointment

• Your name, email address and phone number, the treatments, date and time you choose, and any note you add. We use them to schedule and provide your appointment, send confirmations and reminders, and contact you about your booking.
• Please don't put health details in the note unless they're needed for your treatment (for example, an allergy). If you do, we use them only for your care.
• After a visit we may email you once when it's time to book again. Every such email has an unsubscribe link, and unsubscribing never affects your booking confirmations or reminders.

When you visit the website: our own statistics

We measure how the site is used so we can improve it and protect it from abuse. We do this ourselves:

• the pages you visit, the treatments you look at or add to your visit, the booking steps you reach, the website you came from (the site name only), and campaign tags in links (such as utm_source);
• your approximate location (country, province and city), derived from your IP address by our hosting provider. We do not store your IP address;
• your device type, browser, screen size, language and time zone, page speed, and technical signals that help us tell people apart from automated bots;
• to count visitors without tracking you over time, we make a one-way code from your IP address, browser and language combined with a random value that changes every day and is deleted after two days. The code can't be reversed, and today's code can't be matched to yesterday's;
• a short-lived first-party cookie (mb_sid, 30 minutes) groups the pages of one visit, and a small value stored in your browser (mb_seen) remembers roughly when you first visited. Neither contains your name or contact details, and neither is shared with anyone;
• if you book during a visit, we link that visit to your booking so we can see which pages and campaigns lead to bookings. We use this only for overall totals, not to profile you;
• we never record what you type into forms, and we don't use these statistics for advertising.

If your browser sends a “Do Not Track” or “Global Privacy Control” signal, our statistics script doesn't run. Our web server still keeps a basic technical log of requests (page, time, browser type and the same daily one-way code) to keep the site secure.

Advertising and Google/Meta tools

We use Google Tag Manager, Google Analytics, Google Ads and the Meta (Facebook) pixel to understand how people find us and to measure and show our ads to people who visited our site. These tools set cookies and send information about your visit to Google and Meta, which process it under their own privacy policies. You can limit this at any time: use your browser's privacy or cookie settings, Google's Ad Settings, Meta's ad preferences, or the Google Analytics opt-out add-on. You can also contact us to withdraw your consent.

3. Who we share it with

We don't sell personal information. We use service providers who process it on our behalf, under contracts that require them to protect it:

• website hosting and content delivery: Vercel and Cloudflare;
• database: Supabase (United States, Oregon);
• email delivery: Resend;
• advertising and measurement: Google and Meta.

Some of these providers store information outside Quebec and outside Canada, including in the United States, where it may be accessible to authorities under local law. Before using them, we assess whether the information will be adequately protected.

4. How long we keep it

When information is no longer needed, we delete or anonymize it.

5. Your rights

You can ask to see the personal information we hold about you, to correct it, or to withdraw your consent (for example, to rebooking emails). Quebec residents also have the right to have information de-indexed and to be told about automated decisions (we don't make any). Contact the person named in section 1; we'll reply within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

6. Security

Access to booking records is limited to Marie and protected by a password. Data is encrypted in transit. If a privacy incident creates a risk of serious harm, we'll notify you and the regulators as the law requires.

7. Changes

We'll post any change to this policy on this page with a new “Last updated” date.

8. Children

Our services and website are meant for adults. We don't knowingly collect information from children under 14.