Privacy Policy

1. Privacy contact

Contact the Privacy Officer, Salon Avalon, at info@avalonmassage.info, 514-620-0303, or 15430 boul. de Pierrefonds, Pierrefonds, QC H9H 4K3. Describe your question, request or complaint without initially sending identity documents or unnecessary sensitive information.

2. Enquiries and recruitment

The contact form collects your name, email address and message so we can respond. Messages are sent by email; copies may remain in mailboxes and backups.

The status guide also offers a private question box. It asks for no name or email. With your consent, it stores your message, language, submission date, a reference and consent version for authorised administrators to review, until they delete it. Messages are not published, emailed or sent to an AI service by this feature, and no reply is promised. It is not a booking channel. Please do not include sensitive information. To ask about a message, keep its reference.

This question box uses a required anti-spam checkbox, a hidden trap field, signed form tokens and rate limits. It does not add a third-party CAPTCHA or browser tracking storage. Keyed IP fingerprints are used in hourly abuse counters, separately from messages; raw IP addresses are not stored in the question box. Counter data is replaced on a later submission in a new hour. Short-lived duplicate-prevention receipts expire after two hours and are cleared on a later submission. Hosting security logs and backups remain subject to the practices described below.

The recruitment form requires your name, phone number and one to six photographs, with an optional message. We use these to review your application and contact you. New applications are stored privately, and notification emails contain a protected viewing link. Application records and photographs are restricted to authorised administrators, not published as candidate profiles. Uploaded photographs may retain embedded metadata; remove information you do not wish to submit.

3. Email updates

Subscription requires selecting the consent checkbox and confirming through an emailed link. We keep your email address, language and request, consent and confirmation dates. Unconfirmed links expire after 24 hours; expired pending records are removed during the next newsletter operation.

A confirmed subscription remains until you unsubscribe. The link in each update lets you unsubscribe without signing in. This removes your email address and metadata from the active subscription record; a keyed, hashed fingerprint and removal date remain in a history limited to the 5,000 most recent removals. A new subscription requires confirmation again. Our newsletter module adds no email-open tracking pixels or tracked link redirects. Sending an enquiry or application does not subscribe you.

4. Reviews and optional tools

An approved review displays the name you provide, rating, comment and date publicly. The optional review email address is not displayed with the review. Do not include information you want to keep private.

If you use the Timing Map or horoscope, the server processes the birth date and any birth time, place, coordinates, mood or other preferences you submit. Saved result cards use browser storage and may include place and preference information; they do not include the birth-date or birth-time fields. Tool interactions and related preferences may also enter site usage records described below.

5. Site usage and security information

Our own statistics record selected page and feature interactions to understand website use: page and destination addresses, including URL parameters, referring pages, event details, browser information, time and a hashed IP address. Hashing does not make these records necessarily anonymous. Optional Avalon usage statistics and Google Analytics run only after you enable Analytics in Privacy choices. Refusing does not block ordinary browsing. Withdrawing consent stops future optional collection; it does not erase previously stored records.

Hosting and security logs may contain IP addresses, requested addresses and technical connection information for operation and abuse prevention. Form protections also use temporary request counters.

6. Cookies and browser storage

Cookies support functions such as authorised sign-in; external services may use their own storage. Local browser storage keeps weather results and selected Journal articles or horoscope cards. Weather is refreshed after about 30 minutes, but the stored entry can remain longer. Saved cards have no automatic time expiry. Session storage supports article counting and interface preferences.

Our privacy-choice cookie stores your analytics and external-media selections for up to 180 days, without a unique visitor identifier. Reopen Privacy choices in the footer to change or withdraw them. A successful Turnstile check is remembered through a signed, browser-bound security cookie for up to four hours. Between 10 am and 9 pm, Montréal time, a separate random security cookie, expiring at midnight Montréal time, limits this browser to three live-status viewing sessions of up to ten minutes per day. The first starts automatically; later sessions require a click. Reloads and other tabs share the same active session. Photos and the published schedule remain available.

From 9 pm until 10 am, Montréal time, live statuses remain available without the viewing-session limit, including nighttime and morning icons. Overnight viewing does not use any of the three daytime sessions; the daytime limit applies again at 10 am. Human verification and automated-abuse protection remain active. For the daytime limit, the private server ledger stores a keyed hash of the random browser identifier, the daily reset time, session count and expiry—not names or a history of the profiles or statuses viewed. Old daily entries are discarded when their storage shard is next updated. Temporary hashed request counters also limit automated abuse. These security controls are separate from optional analytics consent and do not identify a physical phone or a person.

You can clear or restrict cookies and site storage in your browser; some features may stop working. Clearing storage does not delete server records or prevent every external connection.

7. External services

• Our hosting provider supplies the website infrastructure; hosting mail services and Google mailbox services process correspondence.
• Google Fonts supplies fonts, Google Maps supplies the embedded location map, and Google reCAPTCHA is loaded on certain form pages.
• The Home page embeds YouTube using its privacy-enhanced player. It connects only after you allow External media; permission loads the player before you press Play. This is not a guarantee of no data processing. The embedded Google Map is also withheld until External media is allowed.
• Cloudflare Turnstile checks browser signals to protect live status data. Verification starts automatically when you open the live schedule without a valid security pass. Cloudflare receives technical connection information; its server validation result is checked before access is granted. See Cloudflare’s privacy policy.
• Open-Meteo supplies weather through browser requests for fixed Montréal coordinates, not your device location.

These connections disclose technical information such as your IP address and browser details. External links lead to services with their own privacy practices. See Google's privacy policy and Open-Meteo's terms and privacy information.

8. Recipients and processing locations

Information reaches the people handling your request and providers supporting the relevant service. Hosting, email and external services may process or store information outside Québec or Canada. This policy does not promise exclusively Canadian storage. Contact the Privacy Officer for information about recipients or processing applicable to your request.

9. Retention and safeguards

There is currently no single fixed automatic deletion period for applications, messages or reviews. Usage records, technical logs, mailboxes and backups may have different retention arrangements. Ask us about a particular record or request deletion where applicable. Removing an active record does not necessarily remove every backup immediately.

When reviewing retention, we consider whether the information is still needed to handle the enquiry, application or subscription, resolve a complaint, protect the service or meet applicable legal obligations.

Access restrictions and technical safeguards protect private features, but no website or email transmission can be guaranteed completely secure.

10. Your requests and choices

You may request access or correction, withdraw applicable consent, or request deletion or cessation of publication subject to law. Contact the Privacy Officer and identify the information concerned. Limited identity verification may be needed before disclosure. Withdrawing information needed for a feature may prevent its provision.

You can also make a privacy complaint to us. We will publish notice of changes to this policy on this page and update the date.