Privacy Policy

Effective date: October 24, 2026

This Privacy Policy describes how JS Designs (“we”, “us”, “our”) collects, uses, and protects information through Stelld (“the Service”). It is written to align with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.

Two kinds of personal information pass through Stelld. We are responsible for your account information, and this Policy explains how we handle it. You are responsible for the responses people submit to your forms; we handle those only as your service provider, under our Data Processing Addendum. If you filled in a form and have a question about your response, please contact the organization that published the form.

1. Information We Collect

  • Account information: your name, email address, and password (stored as a secure hash) when you register.
  • Form data: the forms you create, their settings, and the responses submitted to them by your respondents.
  • Billing information: if you subscribe to a paid plan, Stripe collects and processes your payment details. We store only the Stripe customer ID and subscription status — we never store full card numbers.
  • Usage data: basic server logs (IP address, request timestamps) for security monitoring and debugging purposes.

2. How We Use Your Information

  • To provide, operate, and improve the Service.
  • To send transactional emails — submission notifications and password resets — via our email provider (Resend).
  • To process payments via Stripe for paid subscriptions.
  • To respond to support requests and inquiries.
  • To detect, investigate, and prevent fraudulent or unauthorized use.

We do not sell your personal information or your respondents’ data to any third party.

3. Data Residency

Your account information, the forms you create and every submission you collect are stored on Amazon Web Services (AWS) infrastructure in the ca‑central‑1 region (Montréal, Canada). Backups of that data also remain in Canada. Form submissions are never sent outside Canada by us.

A limited amount of other information is handled outside Canada by the providers listed in section 4: your email address and limited context such as a form’s title when we send you a notification (Resend), and your billing details if you subscribe to a paid plan (Stripe). Before personal information is handled outside Quebec, we assess whether it will be adequately protected, and we rely on written agreements with these providers.

Form submissions are encrypted before they are stored, with keys unique to your account. Those keys are held separately from the data, on infrastructure operated by VEXXHOST, a Canadian-owned cloud provider in Montréal. The database and its backups hold only encrypted submissions and wrapped keys. Other information — your account record, your form definitions and any banner images you upload — is stored in AWS without this additional layer of encryption. Our application servers, which run on AWS, decrypt a submission only in memory, at the moment you view or export it.

4. Third-Party Services

We use the following third-party services to operate Stelld:

  • Stripe — payment processing. Stripe is PCI-DSS compliant. See Stripe’s Privacy Policy.
  • Resend — transactional email delivery (United States). Emails carry your email address and limited context, such as the title of the form that received a submission, or the name of the person who invited you to an account. Submission content is never included.
  • Amazon Web Services — cloud hosting and storage, located in Canada.
  • VEXXHOST — hosts the key management service that holds your account’s encryption keys, located in Canada (Montréal). It does not receive form content, submissions or account information.

5. Cookies

We use a session cookie to keep you signed in. We do not use analytics, advertising or other tracking cookies or scripts, and we never sell your personal information.

6. Data Retention

We retain your account information and form data for as long as your account is active. Server logs are retained for up to 90 days. You can delete your account and its associated data yourself at any time from your account preferences, or ask us to do it by contacting us.

When you delete your account, a form or a submission, it is removed from the live database immediately. Encrypted copies in our automated backups are permanently deleted within 7 days.

7. Your Rights

Under PIPEDA and, in Quebec, the Quebec private-sector Act, you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Receive the personal information you provided to us in a structured, commonly used technological format.
  • Withdraw consent to collection or use of your personal information (which may require closing your account).
  • Lodge a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information du Québec.

To exercise any of these rights, contact us at info@stelld.ca. We respond within 30 days.

8. Security

We use industry-standard measures to protect your data, including encryption of form submissions with keys unique to your account and held separately from the database, encrypted connections (TLS 1.2+), hashed passwords (bcrypt), and access controls on our infrastructure. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

We keep a register of confidentiality incidents. If an incident involving your personal information presents a risk of serious injury, we will promptly notify you and the competent privacy authority. Incidents affecting the responses your forms collect are covered by our Data Processing Addendum.

9. Children’s Privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. Continued use of the Service after changes constitutes acceptance of the updated Policy.

11. Contact and Person in Charge

Our person in charge of the protection of personal information is Jack So. Privacy inquiries may be directed to Jack So at info@stelld.ca.

For our full Terms of Service, see our Terms of Service page.