Privacy

This policy explains what Crestovista collects, why, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the anti-spam law CASL for any messages we send, and Québec's Law 25 for visitors in Québec. We wrote it in plain language on purpose.

Who we are

Crestovista is a non-commercial fan editorial site run by three people in Vancouver, British Columbia. We are the party responsible for the personal information described here.

Privacy contact

Questions, requests or complaints go to our privacy contact at [email protected]. We answer within about three days.

What we collect

• Contact form: your name, email and message, so we can reply.
• Update sign-up: your first name and email, if you ask us to send you updates.
• Server logs: our host records standard technical data such as your IP address, browser type and the pages requested, for security and to keep the site running.
• Push notifications: if you opt in, OneSignal stores a browser or device token so an update can reach you. We never ask for a phone number anywhere on this site.

Why we use it

• To reply to messages you send us.
• To send occasional updates about new picks, only if you signed up for them.
• To send web push notifications, only if you turned them on.
• To keep the site secure and diagnose technical problems.

Consent, and how to withdraw it

We rely on your consent for updates and push notifications. That consent is opt-in: the boxes are never pre-ticked, and CASL requires it. You can withdraw it as easily as you gave it. Every email and every push includes a way to unsubscribe, and you can also email [email protected] to be removed. Withdrawing consent does not affect anything you received before.

Service providers and disclosure

We do not sell your personal information and we do not trade it. We share it only with the providers that help us run the site:

• Our web host, which stores the site and keeps server logs.
• OneSignal, Inc. (United States), which processes email and web push on our behalf as a service provider. OneSignal loads its script, may register a service worker in your browser and store identifiers in local storage or IndexedDB, and holds your subscription token only to deliver the updates you asked for. See the OneSignal Privacy Policy.

Transfers outside Canada

OneSignal processes data in the United States, so if you subscribe, your email and subscription token are transferred and stored there. That means it may be accessible to US authorities under US law. OneSignal relies on recognised safeguards for international transfers, including Standard Contractual Clauses and the EU-US Data Privacy Framework. Law 25 requires us to tell you about this transfer, and by opting in you consent to it.

How long we keep it

We keep contact messages only as long as needed to handle your request and a short period after. Sign-up and push data is kept until you unsubscribe, after which it is removed from the active list. Server logs are rotated by our host on its standard schedule.

Automated tracking

We do not run advertising pixels, analytics profiling or third-party trackers. The only non-essential technology on this site is OneSignal, and it loads only after you accept it in the cookie banner. You can change that choice any time through Manage cookies. Details are in our Cookie Notice.

Your rights

You can ask to access the personal information we hold about you, correct it, or have it deleted, and you can withdraw consent at any time. Email [email protected] and we will act on it.

How to complain

If you are not satisfied with how we handled your information, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of Québec may also contact the Commission d'accès à l'information du Québec (CAI).

Changes

If we change this policy, we will update the date at the top. Continued use of the site after a change means you accept the updated version.