Privacy Policy
Last updated: August 18, 2026
What this covers
This page covers pachetdigital.ca. It does not cover the websites we build and run for clients. Those are the client's, and they run under the client's own privacy policy.
Who we are, and who is accountable
Shawn Pachet, carrying on business as Pachet Web Design & Automation. Shawn Pachet, Owner, is the person accountable for how we handle personal information.
653 McMillan Ave #201, Winnipeg, MB R3M 0S6, Canada.
hello@pachetdigital.ca
What we collect
What you give us. If you fill in the contact form, we collect your first name, last name, phone number, email, business name, website, which service you are interested in, and whatever you tell us about your goal. Phone is the only field we require. If you book a call, we collect your name, your email address, the time you chose and anything you add in the notes, and that becomes a calendar event.
When you send the form we also store a scrambled, one-way copy of your IP address. It is how we stop the form being flooded, so that real messages get through. We cannot turn it back into your address, and we never see the address itself. We do not do this anywhere else on the site.
What we collect only if you agree. With analytics turned on we record which pages you viewed, where you arrived from, any campaign tags in the link you followed, what you clicked including the visible label of the thing you clicked, how far you scrolled, how long you stayed, your device and browser, an approximate location worked out from your IP address, and a random identifier that lets us tell repeat visits apart. That identifier is not linked to your name. We do not build a named profile of you from this site.
Session recording. If you agree, we also record your visit so we can play it back and see where the site works and where it does not. That covers mouse movement, clicks and scrolling. Anything you type into a form field is masked and is not recorded, including your name, email, phone number and anything you write in the message box. Recordings are deleted after 30 days. Nothing is recorded unless you accept, and rejecting stops it.
What we collect either way. Our host keeps ordinary server request logs, and reports aggregate visitor and page-speed numbers that are not tied to an identifier stored in your browser.
Why we use it
To answer you when you get in touch. To work out whether we are a fit and to deliver the work if we are. To see which pages are doing their job so we can improve them.
We do not sell your information. We do not rent it. We do not use it for advertising, we do not run advertising pixels, and we do not track you across other websites.
Cookies and tracking technologies
Nothing in this table is written to your browser until you agree, except the last row, which is the record of your answer.
| Name | Type | Set by | Purpose | Lifetime | Needs consent |
|---|---|---|---|---|---|
_ga | Cookie | Tells one visitor from another | About 2 years | Yes | |
_ga_DLRJJFE3B7 | Cookie | Holds Google Analytics session state | About 2 years | Yes | |
ph_…_posthog | Local storage | PostHog | A random visitor and device identifier | Until you clear it | Yes |
ph_…_window_id | Session storage | PostHog | Keeps track of the current visit | Until you close the tab | Yes |
NID | Cookie (google.com) | Advertising personalisation and recognising your browser | About 6 months | Yes | |
IDE | Cookie (doubleclick.net) | Advertising personalisation and measurement | Up to 13 months | Yes | |
DSID | Cookie (doubleclick.net) | Recognises a signed-in user so their Google ad settings are respected | About 2 weeks | Yes | |
pd_consent | Local storage | Us | Remembers whether you said yes or no | Until you clear it | No. It is how we honour your choice |
The three Google cookies at the bottom of that list are advertising cookies. They are set once you accept, and they let Google measure and personalise advertising. We do not run any ads today. We allow them so that measurement still works if we do, rather than having to ask you again later.
What we do not use: no social media pixels and no trackers from any company other than the ones named on this page. Google Signals, which would tie your visit to your Google account for demographic reporting, is turned off.
Your choices
When you first arrive, analytics is off. A bar at the bottom of the page asks you to accept or reject, and both buttons are equally easy to press. No analytics loads until you choose. Two other things load without asking, and only when you reach for them: the booking widget when you open it, and a Cloudflare spam check when you reach the second step of the contact form. We do not use either one for advertising, and we receive no cross-site profile from either.
You can change your mind at any time. Cookie settings at the bottom of every page reopens that choice. If you reject after having accepted, we delete the cookies and stored identifiers we set on this site, rather than just stopping. Google's own advertising cookies sit on Google's domains and we cannot reach them from here, so what we do instead is tell Google you have withdrawn consent. You can clear those yourself in your browser, and control them directly at Google My Ad Center.
If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a no and never show you the bar. Ad blockers and browser privacy features that block analytics work fine here. You can also clear cookies and local storage yourself in your browser settings at any time.
Who else touches your information
| Provider | What it does | Where it processes |
|---|---|---|
| Vercel | Hosts this site. Keeps request logs, and reports aggregate traffic and page-speed numbers. | United States |
| n8n Cloud | Receives your contact-form submission and routes it onward. | European Union (Germany) |
| Cloudflare | Runs the spam check on the second step of the contact form, so we can tell a person from a script. It never sees what you typed into the form. | Global |
| Supabase | Stores your submission so we can follow up on it. This is our system of record. | United States |
| Formspree | Passes through the notification email that tells us you got in touch. Keeps no copy. | United States |
| Google Calendar | Holds the booking itself. When you book a call, the time, your name, your email address and anything you type in the notes become a calendar event and an invitation is emailed to you. Your browser never contacts Google to do this — our server does. | United States |
| PostHog | Site analytics and session recording. Only with your consent. | United States |
| Google Analytics 4, and Google advertising cookies. Only with your consent. | United States | |
| Google Workspace | Our business email, so anything you send us lands in an inbox there. | Global |
We do not sell or rent personal information to anyone, and we do not disclose it for advertising.
Where your information goes
Several of the providers above process information outside Canada, mostly in the United States. Information held in another country can be reached by that country's courts and law enforcement under that country's laws. We choose providers that commit contractually to protecting it.
How long we keep it
| What | How long |
|---|---|
| Google Analytics event and user data | 14 months, then Google deletes it. Google keeps aggregated reporting for longer. |
| PostHog analytics data, including session recordings | 30 days, then PostHog deletes it. |
| Your contact-form submission, in our database | As long as we need it to answer you, plus 24 months. Then we delete or anonymize it. |
| The scrambled copy of your IP address from the contact form | Kept while it is doing its job of stopping the form being flooded. It cannot be turned back into your address. |
| The notification email in our inbox | Kept with our business email while we are in contact with you, and deleted when it is no longer needed. |
| Your details if you become a client | Business records are kept 6 years, which is what the Canada Revenue Agency requires. |
| A copy at Formspree | None. Formspree only passes the notification email through and does not store your submission. |
| A booked call in Google Calendar | Kept until you cancel it or we delete it. Cancelling through the link in your invitation removes the event. Google retains its own copies under its policy. |
How we protect it
The site is served over HTTPS. Access to anything you send us is limited to Shawn. The accounts that hold it are protected with multi-factor authentication, and we pick providers partly on their security track record. No method of sending or storing information is completely secure, and we will not pretend otherwise.
Your rights, and how to use them
You can ask what information we hold about you, ask us to correct it, ask us to delete it, and withdraw consent you have given. Email hello@pachetdigital.ca and we will respond within 30 days.
If you are not satisfied with how we handle it, you can complain to the Office of the Privacy Commissioner of Canada.
If you live in Quebec, you also have the right to receive your information in a portable format and to ask us to stop spreading it or to de-index it. Same email.
Children
This site is aimed at businesses, not children. We do not knowingly collect information from anyone under 13.
Websites we build for clients
When we build or run a site for a client, we are working on their behalf and their privacy policy governs it, not this one. Clients own their domain, their analytics and their data. That is how we work, and it does not change when the project ends.
Changes to this policy
If we change this policy we update the date at the top and note what changed below. If a change widens what we track, we ask for your consent again rather than assuming the answer you already gave still covers it.
Contact
Shawn Pachet, Owner
Pachet Web Design & Automation
653 McMillan Ave #201, Winnipeg, MB R3M 0S6, Canada
hello@pachetdigital.ca
Change history
- August 2026: added a spam check from Cloudflare to the second step of the contact form, and began storing a scrambled, one-way copy of your IP address when you send that form, so the form cannot be flooded. Both are described above.
- August 2026: added consent controls so nothing is collected until you agree, disclosed every service provider by name and where it processes your information, added retention periods, named the person accountable. Session recording and Google advertising cookies both run only after you accept, and both are listed above.
- July 2026: first version.