Privacy Policy

This Privacy Policy describes how Auteur (“Auteur,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information from visitors to useauteur.com (the “Site”), people who join our waitlist, and customers who use our virtual business address and mail handling services (the “Service”). By accessing the Site, joining the waitlist, or using the Service, you agree to the practices described in this Policy.

Auteur is a Canadian virtual mailbox brand offering real street addresses in Toronto, Ontario and Vancouver, British Columbia. The Service is currently in pre-launch; some sections of this Policy (payments, identity verification, mail handling) describe practices that apply once the Service is active.

2.1 Information You Provide

When you contact us, join our waitlist, or open an account, we may collect:

• Your first and last name
• Email address
• Phone number (optional)
• Company name (optional)
• City and use case information you select on our reservation form
• Any other content you include in messages, support tickets, or form fields you complete

2.2 Information Collected Automatically

When you visit the Site, we and our analytics providers automatically receive:

• IP address and approximate location derived from it
• Browser type, language, operating system, and device characteristics
• Pages viewed, links clicked, time on page, scroll depth, and referrer
• A session identifier and cookies as described in Section 4

2.3 Payment Information (when the Service is active)

When the paid Service launches, payments will be processed by Stripe. We do not store full credit or debit card numbers on our systems. We receive only a tokenized reference, the last four digits, the card brand, and billing address as needed for tax and fraud-prevention purposes.

2.4 Mail Handling and Identity Verification (when the Service is active)

When you activate mail services, we will collect identity verification documents (government-issued ID and supporting documentation as required by Canadian commercial mail-receiving rules) and any authorization forms required by Canada Post. We will also process metadata about mail items addressed to you (sender, postmark date, weight, photographs of envelopes), and the contents of items only when you request a content scan or forwarding.

We use the information described in Section 2 to:

• Operate and maintain the Site and Service
• Communicate with you about your account, the waitlist, and launch updates
• Process payments and prevent fraudulent or abusive use
• Provide customer support and respond to your inquiries
• Send marketing emails about Auteur where you have opted in (you can unsubscribe at any time using the link in every marketing email)
• Measure how visitors use the Site so we can improve it
• Comply with applicable laws, lawful requests from authorities, and our own contractual obligations

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We use the following categories of cookies and similar technologies:

• Strictly necessary— required for the Site to function (for example, to remember your form progress on the reservation page).
• Analytics— Google Analytics 4 (property G-YRCTLTLEPR) and Microsoft Clarity (project vr0chcjjes), which help us understand how the Site is used. Clarity may capture session recordings with inputs masked.
• Marketing— we may use marketing pixels in the future; this Policy will be updated before any are introduced.

You can control cookies through your browser settings. Disabling some cookies may affect Site functionality.

5.1 Service Providers

We share information with vendors who process data on our behalf under written contracts that restrict their use to providing services to Auteur. Our current providers include:

• Vercel — Site hosting
• Resend — transactional email delivery
• ImprovMX— inbound email forwarding for hello@useauteur.com
• Google (Apps Script, Sheets, Analytics)— waitlist intake and Site analytics
• Microsoft Clarity — Site analytics
• Stripe — payments (when the Service is active)

5.2 Legal Disclosures

We may disclose information if we believe in good faith that disclosure is required to comply with a law, regulation, court order, or other legal process, or to protect the rights, property, or safety of Auteur, our users, or the public.

5.3 Business Transfers

If Auteur is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to the protections of this Policy.

5.4 With Your Consent

We may share information for purposes not described in this Policy when you have given us your consent.

The Service is provided from and to Canada. Some of our service providers may process information outside the province where you reside, including in other countries with different data-protection laws. Where required, we use contractual safeguards (such as standard data-protection clauses) and choose providers with comparable protections.

We retain personal information for as long as we need it for the purposes set out in this Policy, including:

• Waitlist and inquiry data — for up to 24 months from your last interaction, then deleted or anonymized
• Active-customer account data — for the life of your account and for up to 7 years after closure to comply with tax and recordkeeping obligations
• Analytics data — typically up to 14 months at the provider level
• Mail-handling metadata — for the life of your subscription and up to 12 months after closure (separate retention windows apply to physical mail under our mail-handling terms)

We protect information using HTTPS in transit, access controls, infrastructure provided by reputable hosting providers, and segregation of payment-card data via Stripe (PCI DSS Level 1). No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and applicable regulators in accordance with PIPEDA’s Breach of Security Safeguards Regulations and any other laws that apply.

9.1 Canada — PIPEDA

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws give you the right to access the personal information we hold about you, to ask us to correct it if it is inaccurate, and to withdraw consent to certain uses (subject to legal or contractual restrictions).

9.2 Quebec — Law 25

Residents of Quebec have additional rights under An Act respecting the protection of personal information in the private sector (“Law 25”), including the right to data portability and to be informed about automated decision-making that affects them. We do not currently make decisions about you based solely on automated processing.

9.3 European Economic Area and United Kingdom — GDPR / UK GDPR

If you are in the EEA or UK, you have rights under the General Data Protection Regulation, including the rights of access, rectification, erasure, restriction, portability, and objection. Our lawful bases are: performance of a contract (account and Service); consent (marketing emails, non-essential cookies); legitimate interests (analytics, fraud prevention, security); and legal obligation (tax, recordkeeping).

9.4 California — CCPA / CPRA

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of “sales” or “sharing” as those terms are defined in California law. We do not sell or share personal information for cross-context behavioural advertising.

9.5 How to Exercise Your Rights

To exercise any of these rights, email us at hello@useauteur.com with “Privacy request” in the subject line. We will respond within 30 days (or up to 45 days where the law allows for an extension).

The Service is intended for adults running businesses. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child under 13 (or under 16 in the EEA), we will delete it.

The Site may link to third-party websites. We are not responsible for the privacy practices of those sites; please review their policies before providing information to them.

We may update this Policy from time to time. If we make material changes, we will notify you at least 30 days in advance by posting a notice on the Site and, where you have given us an email address, by email. The “Effective” date at the top of this Policy reflects the most recent material update.

For questions, requests under Section 9, or any other privacy matter, please contact:

Auteur — hello@useauteur.com