Privacy Policy

Zenith Studio · Last updated: August 8, 2026

This Privacy Policy describes how Zenith Studio ("we," "us," or "our") collects, uses, and protects information you provide when visiting zenithstudio.ca or using our services. We are based in Montreal, Quebec, and we are committed to handling personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25 (Loi 25). Where the two set different standards, we apply the stricter one.

1. Information We Collect

We collect personal information only when you voluntarily provide it through our contact form. This includes:

• Your name
• Your email address
• Your phone number (optional)
• The content of your message

We do not collect payment information directly. Payments are processed through third-party processors and are subject to their respective privacy policies.

2. How We Use Your Information

Information you submit through the contact form is used solely to:

• Respond to your inquiry
• Provide the services you request
• Send service-related communications (invoices, project updates)

We do not use your information for unsolicited marketing and do not sell or rent your personal information to third parties.

3. Third-Party Service Providers

Our contact form is processed by Formspree (formspree.io), which receives and forwards form submissions to us. Formspree acts as a data processor on our behalf. Their privacy policy is available at formspree.io/legal/privacy-policy.

Our AI receptionist service is powered by Vapi (vapi.ai). If you interact with the AI receptionist, voice data is processed by Vapi. Their privacy policy is available at vapi.ai/privacy.

Website infrastructure is hosted on Railway (railway.app). Standard server access logs (IP address, browser type, pages visited) may be retained by Railway. Their privacy policy is available at railway.app/legal/privacy.

4. Cookies and Tracking

We do not use cookies for tracking, advertising, or analytics purposes. No third-party analytics scripts (e.g., Google Analytics) are loaded on this site. Standard browser caching may store static assets locally on your device to improve load times.

5. Data Retention

Contact form submissions forwarded to us via Formspree are retained only as long as necessary to fulfill the purpose for which they were collected, or as required by applicable law, after which they are destroyed or anonymized. You may request deletion at any time (see Section 7).

6. Data Security

All data transmitted between your browser and our site is encrypted using HTTPS/TLS. We apply reasonable technical and organizational measures to protect personal information from unauthorized access, use, or disclosure.

7. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Know what personal information we hold about you
• Request access to your personal information
• Request correction of inaccurate information
• Request deletion of your personal information
• Withdraw consent to the collection or use of your information

To exercise any of these rights, please contact us using the information below. We will respond within 30 days.

8. Quebec Law 25 (Loi 25)

Zenith Studio is headquartered in Montreal, Quebec, and collects personal information from individuals located in Quebec. We are therefore also subject to Quebec's Act respecting the protection of personal information in the private sector, as amended by the law commonly known as Law 25 (Loi 25). Law 25 is stricter than PIPEDA in several respects, and this section describes the commitments we make under it.

Person in charge of the protection of personal information. Law 25 requires every business to designate a person responsible for the protection of personal information. At Zenith Studio, that role is held by the person exercising the highest authority in the business, as Law 25 provides by default. You can reach this person using the contact details at the bottom of this page. Any privacy question, access request, or complaint sent to us is routed to them.

Consent. We collect personal information only when you give it to us knowingly and voluntarily, for the purposes described in Section 2. We do not use it for any new purpose without asking you first, and we do not require you to consent to anything beyond what is necessary to provide the service you asked for. You may withdraw your consent at any time by contacting us, and we will stop using the information and delete it unless we are legally required to keep it.

Confidentiality incidents. If we become aware of a confidentiality incident involving personal information we hold (unauthorized access, unauthorized use, unauthorized disclosure, or loss), we will take reasonable steps to reduce the risk of injury and prevent further incidents. Where the incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and the affected individuals promptly, and we maintain a register of confidentiality incidents as required by Law 25.

Your rights under Law 25. In addition to the rights listed in Section 7, if you are in Quebec you may:

• Be informed, at the time of collection, of the purposes of the collection, the means used, and the categories of third parties that may receive your information
• Request that inaccurate, incomplete, or ambiguous information about you be corrected
• Request that we stop disseminating your personal information, or de-index a link to it, where the dissemination contravenes the law or a court order
• Request that the personal information you provided to us be communicated to you, or to a third party you designate, in a structured and commonly used technological format (data portability)
• Be informed if a decision about you is made exclusively by automated processing, and ask for that decision to be reviewed by a person
• File a complaint with the Commission d'accès à l'information du Québec if you are not satisfied with how we handled your request

Information handled outside Quebec. Some of the service providers described in Section 3 (Formspree, Vapi, Railway) store or process information on servers located outside Quebec. Before entrusting personal information to a provider outside Quebec, Law 25 requires us to assess whether the information would receive adequate protection there. We review each provider's privacy and security commitments before using it and record that assessment. These providers are based in the United States and may store or process information there.

AI receptionist calls. Where we operate an AI receptionist for a client business, that business decides why calls are handled and what is kept, and Zenith Studio acts as its service provider. Call audio and transcripts are processed by Vapi (see Section 3). Calls may be recorded for quality and booking purposes, and callers are told so at the start of the call. How long recordings and transcripts are kept is set by the client business on whose behalf we operate the receptionist.

This policy is written in good faith to describe our practices. It is not legal advice, and it does not by itself certify compliance with any law.

9. Children's Privacy

Our services are intended for adults and business owners. We do not knowingly collect personal information from individuals under 18 years of age.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the site after changes constitutes acceptance of the updated policy.