Last updated: October 14 2026
sofast is a static website hosting service operated by Agence Chocolat, a company based in Quebec, Canada (“sofast”, “we”, “us”). This policy explains what personal information we collect when you visit sofast.host, create an account, publish a site or pay for a plan; why we collect it; who we share it with; and how you can exercise your rights.
It is written to meet Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada’s PIPEDA, and, for users in the European Union and the United Kingdom, the GDPR.
1. Who is responsible for your information
Agence Chocolat
625, rue Shefford
Bromont, Quebec J2L 1C2, Canada
Person in charge of the protection of personal information:
Pascal Couturier
[email protected]
You can write to this person about anything in this policy, including requests to access, correct or delete your information.
2. What we collect
When you create and use an account
- Your email address and username, to identify you, sign you in and write to you about your account.
- Your password, which we never store in readable form: we keep only a one-way hash of it.
- Your sites’ settings: their names, their sofast.website subdomains and any custom domains you connect.
- The files you publish. They are stored so we can serve them, and the sites you publish are public by nature. We keep a few previous versions of each site so it can be restored.
- Usage figures for your account: storage used, number of files and the volume of traffic your sites serve each month, which we need to apply your plan’s limits.
When you pay for a plan
Payments are handled by Stripe. Your card details are entered on Stripe’s pages and never reach our servers. We receive and keep your Stripe customer and subscription references, your plan, its billing cycle and the status of your payments. Stripe also collects your name, billing address and payment information under its own privacy policy.
When you contact us
If you use our contact form or write to us, we receive your name, your email address and whatever you choose to tell us. Contact form messages are stored on our website so we can follow up.
To keep the service secure
- IP addresses. When you sign up, sign in or reset a password, we record your IP address for a short time to limit repeated attempts and stop bulk account creation. These records are deleted automatically once the limit window expires.
- Cloudflare Turnstile checks that the sign-up form is filled in by a person rather than a script. Cloudflare processes technical information from your browser to do so.
- Abuse reports. If a site is reported for phishing, malware, copyright infringement or other abuse, we review the report and the content involved.
Visitors to sites hosted on sofast
Sites published on sofast.website and on custom domains are served through Cloudflare’s network, which processes visitors’ IP addresses and request information to deliver pages and protect against attacks. We count the volume of traffic per account to enforce plan limits; we do not build profiles of the people who visit our customers’ sites.
Each customer is responsible for their own site’s content and for any personal information that site collects from its visitors, including the privacy policy it shows them.
3. Cookies
We use cookies that are needed for the website to work, such as the cookie that keeps you signed in to your dashboard and the one that remembers your language. Any other cookie is only placed with your consent, which you can change at any time.
The full list of cookies, what they do and how long they last is in our Cookie Policy.
4. Why we use your information
We use your personal information only to:
- create and run your account and host your sites;
- process payments and keep the records the law requires us to keep;
- send you messages about your account: email verification, password resets, billing receipts, and notices when you approach or reach a plan limit;
- answer your questions and support requests;
- protect the service, our customers and the public against fraud, spam and abuse;
- comply with our legal obligations and respond to lawful requests from authorities.
We do not sell your personal information, and we do not send marketing emails unless you have agreed to receive them.
For users in the EU and the UK, the legal bases for this processing are: the performance of our contract with you (account, hosting, billing, support); our legal obligations (accounting and tax records, responding to authorities); our legitimate interests (security and abuse prevention); and your consent, where we ask for it (non-essential cookies, marketing).
5. Who we share it with
We share personal information only with the service providers we need to run sofast, and only what each one needs:
| Provider | Purpose |
|---|---|
| Cloudflare, Inc. | Hosting and delivering sites, file storage, security, sign-up verification |
| Stripe, Inc. | Payment processing and subscription management |
| Postmark (ActiveCampaign, LLC) | Sending account emails |
| Rapidenet | Hosting our website and the account database |
These providers are bound by contract to use the information only to provide their service to us and to protect it.
We may also disclose information when the law requires it, to respond to a valid legal request, to investigate abuse or protect people’s safety, or as part of a merger or sale of the business, in which case this policy will continue to apply to your information.
6. Where your information is stored
Some of our providers are located in the United States, and Cloudflare serves content from data centres around the world. Your information may therefore be stored or processed outside Quebec and Canada, where privacy laws may differ. Before sending information outside Quebec, we assess whether it will be adequately protected, and we rely on contractual safeguards with each provider. For transfers out of the EU and UK, we rely on the safeguards recognised by those jurisdictions, such as standard contractual clauses or the EU–US Data Privacy Framework.
7. How long we keep it
- Account information and published sites are kept for as long as your account exists. When you delete your account, your sites are taken offline and deleted, and your subscription is cancelled.
- A custom domain you disconnect is held for 30 days so it can be reconnected, then released.
- Billing records are kept for as long as tax and accounting laws require, usually six years.
- Security records such as IP addresses used for rate limiting are deleted automatically, in most cases within a day.
- Traffic usage figures are kept for about three months.
- Messages you send us are kept for as long as needed to deal with them, and no more than 2 years.
Backups may hold copies of deleted information for a short additional period before they are overwritten.
8. How we protect it
We use encrypted connections (HTTPS) everywhere, hash passwords, limit access to personal information to the people who need it, and keep our own website on a separate domain from the sites we host so customer sites cannot read your sign-in cookies. No system is perfectly secure, but if a confidentiality incident presents a risk of serious harm, we will notify you and the Commission d’accès à l’information du Québec, as the law requires.
9. Your rights
You can, at any time:
- access the personal information we hold about you;
- correct information that is inaccurate or incomplete;
- delete your account and its data — you can do this yourself from your account page;
- withdraw your consent where we rely on it, such as for non-essential cookies;
- receive your information in a structured, commonly used format;
- object to or ask us to restrict certain uses of your information (EU and UK users).
To exercise these rights, write to [email protected]. We will answer within 30 days, and we may ask you to confirm your identity first.
If you are not satisfied with our answer, you can file a complaint with the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or, in the EU and UK, the data protection authority where you live.
10. Children
sofast is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We may update this policy as the service changes. The date at the top shows when it was last revised. If a change significantly affects how we use your information, we will tell you by email or in your dashboard before it takes effect.
12. Contact
Questions about this policy or your information: [email protected]
To report abuse on a site we host: [email protected]