Privacy policy

Last updated: 2026-09-29

Who we are

DVLCE (“we”, “us”) is the brand name of a Toronto-based audio/video production service. This policy describes how we collect, use, and protect your personal information in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

What we collect

  • Account: email, password (stored only by Firebase as a salted hash), optional display name.
  • Transactional: booking details, subscription hours, Stripe customer IDs (billing info lives with Stripe, not us).
  • Technical: IP address (session-scoped), user-agent, and analytics/advertising data subject to your cookie choice (see below).

Cookies, analytics & advertising

  • Essential (always on): security, load-balancing, and remembering your cookie choice. No tracking.
  • Analytics: Google Analytics 4 (IP-anonymized) to understand which pages are useful.
  • Advertising: Google Ads measurement / remarketing.
  • Regional defaults. If you're in Canada outside Quebec, analytics and advertising cookies are on by default — permitted opt-out (implied) consent under PIPEDA for non-sensitive purposes — and you can opt out anytime. In Quebec or outside Canada they stay off until you opt in.
  • We never use sensitive categories for advertising, never sell your data, and never share data that personally identifies you with advertising partners without your express opt-in.
  • Manage or withdraw consent anytime via the cookie button at the bottom-left of any page. Opt-out takes effect immediately and is remembered on your device.

Why we collect it

  • To authenticate you when you sign in.
  • To deliver booked services and process payments (via Stripe).
  • To send you receipts and service-related notices.
  • To protect the site from abuse (breach-password checks, rate limiting).

Third-party sub-processors

  • Google / Firebase (US) — authentication, Firestore database.
  • YouTube API Services (Google, US) — managing our own YouTube channels (see below).
  • Google Analytics & Google Ads (US) — analytics + measurement/remarketing, subject to your cookie choice above.
  • Cloudflare (US/Global) — hosting + edge.
  • Stripe (US) — payments.
  • ZeptoMail (Zoho, .ca region) — transactional email.
  • haveibeenpwned.com — k-anonymity breach-password check (full password never leaves our server).

YouTube API Services

  • DVLCE uses YouTube API Services, through an internal tool run only by the owner, to upload and manage videos on its own YouTube channels: Dvlce (@dvlce_music) and The BASEment Recording Studio (@thebasementrecordingstudio).
  • The tool uploads and schedules videos, sets thumbnails, manages playlists and updates video descriptions on those two channels. It reads only data about our own channels and videos. It does not collect, store or share any data about other YouTube users or viewers.
  • The Google authorization tokens are kept encrypted in our own secret store, never in code. Nothing is sold or shared with third parties.
  • By watching or interacting with our videos you agree to the YouTube Terms of Service. Google's handling of data is covered by the Google Privacy Policy.
  • A channel owner can revoke the tool's access at any time in their Google Account under Security, or at Google security settings.

Your rights

Retention

  • Active account: while active.
  • Deleted account PII: scrubbed within 30 days of delete request.
  • Transactional records: 7 years (CRA requirement) with PII anonymized on delete.
  • Consent records (CASL): 3 years after the relationship ends.

Security

Passwords live with Firebase and are hashed with scrypt (Google's implementation). Sessions use secure cookies. Breach passwords are rejected at signup. IP addresses are not retained beyond the audit window.

Contact

Privacy questions: privacy@dvlce.ca. We respond within 30 days (PIPEDA).

Privacy Policy | DVLCE