Privacy Policy

This policy explains what personal information Maison d’Herbes collects on maisondherbes.com, why we collect it, who we share it with, how long we keep it and how to exercise your rights. It applies to the website and the services offered on it: online store, customer account, newsletter, text messages and customer service.

Last updated: November 11, 2026.

Privacy officer and your rights

Maison d’Herbes is operated by Groupe La Feuille Verte inc. The person in charge of the protection of personal information is the holder of the Compliance Officer position.

To reach them:

by email: [email protected]
by phone: 1 866 318-0390
by mail: Compliance Officer, Groupe La Feuille Verte inc., 455, 4e Rang de Simpson, Saint-Cyrille-de-Wendover, Quebec J1Z 1T8
online: the Contact page, choosing “Privacy and personal information”.

At any time, you can:

find out whether we hold personal information about you, see it and get a copy of it;
have inaccurate, incomplete or ambiguous information corrected;
withdraw your consent to the use or disclosure of your information, for example by unsubscribing from the newsletter or withdrawing your consent to browsing history;
ask us to stop disseminating information about you, or to have it de-indexed, in the cases provided for by law;
receive, in a structured, commonly used technological format, the computerized information you provided to us, or have it sent to the person or organization of your choice;
find out what information we collected from you, which categories of people have access to it within our organization, and how long we keep it.

Make your request in writing to the person in charge, by email, by mail or from the Contact page. We may ask you to confirm your identity before acting on it.

We reply in writing no later than 30 days after receiving your request. Seeing your information is free; if a copy or a transmission involved a fee, we would tell you the approximate amount before processing your request.

If we refuse your request, in whole or in part, we give you the reasons in writing and tell you about your recourses. You can then, within 30 days, ask the Commission d’accès à l’information du Québec to review the refusal (cai.gouv.qc.ca). You can also file a complaint with the Commission at any time.

Consent

We collect your personal information from you, when you give it to us: by placing an order, creating an account, subscribing to the newsletter or writing to us. We tell you then what it is used for. Simply visiting the website is not consent.

We use your information for the purposes for which you gave it to us. Any other use requires your consent, except where the law allows otherwise.

Some uses only take place with your express consent, given separately: sending the newsletter and text messages, tracking your browsing history and advertising cookies. They stay off until you accept them.

You can withdraw your consent at any time. Withdrawing it does not prevent you from visiting the website or buying from it. We do keep the information needed to complete an order in progress and the information the law requires us to keep.

We do not sell your personal information or our customer lists.

Information we collect

We only collect the information needed for the purposes described in this policy.

When you place an order: your name, billing and shipping addresses, email address, phone number, the content of the order and your purchase history. Payment is processed by PayPal: your card details are entered in fields hosted by PayPal. We do not receive or keep your card number.
When you create an account: your email address, password, name, addresses and, if you choose to provide them, your date of birth and your wish list. The account is optional: you can order without creating one.
When you subscribe to the newsletter or to text messages: your email address or phone number, along with the date and proof of your consent.
When you write to us (contact form, email, chat): your contact details and the content of your messages.
When you take part in the affiliate program: the information needed to calculate and pay your commissions.
When you browse the website: technical data, described in the next section.

Providing this information is your choice. Without the information needed for an order, however, we cannot process or deliver it.

IP address and technical data

Your browser sends technical data with every page: your IP address and the type and version of your browser and operating system. An IP address or a device identifier is personal information when it can identify you, and we treat it as such.

Your IP address appears in the technical logs of our hosting providers, which are used to run and protect the website. We also record it with your newsletter subscription, as proof of your consent, and with the messages you send us through the contact form or the chat, to prevent abuse. It is not recorded in your browsing history tracking.

Overall statistics that cannot identify anyone, such as the number of visits or the most viewed pages, are not personal information.

Use of data

We use your personal information to:

process, ship and invoice your orders, and issue refunds;
manage your account;
answer your requests and provide customer service;
send you emails about your orders and your account (confirmation, shipping, important notices), whatever your communication preferences;
send you our newsletter and text messages, if you consented to them. You can unsubscribe at any time with the link in each message, or by writing to us from the Contact page;
prevent fraud and protect the website;
meet our legal obligations, including tax obligations;
produce overall statistics to improve the website and our products.

Cookies. The website uses cookies that are needed for it to work: cart, sign-in to your account, payment and remembering your privacy choices. Some information kept by your browser is linked to your orders and your customer file: where your visit came from, described in the section “Visit measurement, order sources and videos”, and, only if you accept it, your browsing history on the site, described in the section “Consented browsing history”. No advertising cookie is set without your permission. You can review your choices at any time with the “Privacy preferences” link at the bottom of every page.

Social sharing. If you use a sharing link or visit our pages on a social network, the information you leave there is handled under that network’s privacy policy.

If we want to use your information for a purpose that is not described here, we will inform you first and ask for your consent where the law requires it.

Sharing of information

We share your personal information with service providers, only as far as their work requires:

hosting and protecting the website (Google Cloud, Cloudflare);
payment (PayPal);
delivery: the carrier, for example Canada Post, receives your name, address and phone number;
sending emails, the newsletter and text messages (including MailerLite and Postmark);
order and inventory management (Cin7);
processing chat messages through an artificial intelligence provider.

These providers only have access to the information they need and are bound by contract not to use it for any other purpose.

Some of them store or process information outside Québec, including elsewhere in Canada, in the United States and in Europe. Your information is then subject to the laws of those places and may be disclosed to the authorities that have jurisdiction there.

Apart from these providers and the cases described in the next section, we do not share your personal information with third parties without your consent.

Important exceptions

We may disclose personal information without your consent only in the cases provided by law, for example:

to a court or a body that has the power to compel us to do so;
to a body responsible for preventing, detecting or repressing crime or statutory offences;
in an emergency that threatens a person’s life, health or safety.

If the business or part of its assets is sold, merged or reorganized, the information needed for the transaction may be disclosed to the other party, which must undertake in writing to protect it and to use it only for the purposes set out in this policy.

Security

We apply technical, administrative and physical security measures suited to the sensitivity of the information we hold. Only the members of our team who need it for their work have access to it.

If a confidentiality incident presents a risk of serious injury, we notify the Commission d’accès à l’information du Québec and the people concerned, and we take the steps needed to reduce that risk.

You also help keep your information safe: keep your password to yourself and do not share it with anyone.

Data retention

We keep your personal information for as long as needed for the purposes for which it was collected, then we destroy it or make it anonymous:

orders and invoices: at least six years after the end of the year of the order, as required by tax laws;
customer account: as long as your account is open. You can ask us to close it at any time;
newsletter and text messages: until you unsubscribe. We then keep proof of your consent and of your unsubscription;
messages to customer service: as long as needed to follow up on your request and your customer file;
consented browsing history: 13 months after each visit.

If you ask us to delete your information, we do so, except for what the law requires us to keep, such as invoices.

Changes in our privacy policy

We update this policy when our practices or the law change. The date of the last update appears at the top of this page. If a change is significant, we announce it on the website before it takes effect and we ask for your consent again where the law requires it.

Access and accuracy

You can view and correct some of your information yourself in your account. For any other request for access, correction or deletion, contact our privacy officer, whose contact details and procedure appear in the section “Privacy officer and your rights” on this page. We reply in writing within 30 days.

Contact us

For any question about this policy or your personal information, use the Contact page and choose “Privacy and personal information”, or call us at 1 866 318-0390. The email and mailing addresses of the privacy officer appear in the section “Privacy officer and your rights” on this page.

Consented browsing history

If you accept it in the cookie banner at the bottom of the site, or with the “Privacy preferences” link, we record your visits to maisondherbes.com: the address of the pages and product pages you view, the time of each page view and the time spent on each, the site you came from or the campaign that brought you (newsletter, advertising), and the date of your consent, of your orders (with their number), of your sign-ins to your account and of your newsletter subscription. Your choice is recorded with its date, the screen where you made it, the version of this text and its language. Two cookies from our own domain are used for this: “mdh_consent” remembers your choice, and “mdh_vid”, which the page’s scripts cannot read, holds a random identifier that links these pages together. We never record your searches, what you type into a form, or your IP address.

When you place an order, sign in or subscribe to our newsletter, this history is linked to your email address and your customer file, with the date and how it was linked. A browser is linked to a single person: what is viewed in it, even without signing in, is linked to the first person who identifies themselves in this browser. If another email address or account identifies itself afterwards, we note that the device is shared and stop recording the pages viewed in this browser until the first person identifies themselves again (by signing in, or with their email address when ordering or subscribing to the newsletter); only the date and time of the last visit are still recorded. On a shared device, we recommend that you do not accept this tracking, or that you withdraw your consent. We use this history to understand which products interest you and to advise you better, in customer service and in our communications, and to know which campaigns lead to orders. It can be seen by the Maison d’Herbes team, in its management tool, and by the technical providers that host the data (Google Cloud, in the United States). Nothing is sold or passed on to advertising networks.

This tracking is off by default, and your choice applies to the browser where you make it. Each day of browsing history is automatically deleted 13 months after the visit. You can withdraw your consent at any time with the “Privacy preferences” link at the bottom of every page: tracking stops immediately in this browser, the history kept from it is deleted, and the identifier kept by this browser is removed from it. This withdrawal does not affect the visit source described in the “Visit measurement, order sources and videos” section: it stays in this browser, on your orders and in your customer file. If you accepted tracking in several browsers or on several devices, withdraw your consent in each of them, or ask us to delete all the history linked to your email by writing to us from the Contact page (maisondherbes.com/en/contact). We only keep a dated record of your choice for 13 months, with nothing that can identify you. You can also ask to access or correct your history the same way; deleting your customer account also deletes your history. The person in charge of the protection of personal information at Maison d’Herbes is the holder of the Compliance Officer position, who can be reached at [email protected] or from the Contact page (maisondherbes.com/en/contact).

Version 2026-10-v10 — effective 2026-10-02.

Visit measurement, order sources and videos

Whatever your cookie choices, we count visits anonymously and in aggregate (pages viewed per day, average time spent, where visits come from), with no identifier and no IP address.

Your browser also keeps, for up to 13 months (“mdh_attribution_v1”), where your visit came from: the referring site or the campaign that brought you (a direct visit does not replace the last known source), the landing page and the type of device (mobile or computer). It is noted on your order if you place one and stays with that order. It also appears in your customer file, order by order, along with the first and latest known sources. We use it to measure how well our campaigns work and to know where you came from before each of your orders. It can be seen by the Maison d’Herbes team, in its management tool, and by the technical providers that host the data (Google Cloud, in the United States). It does not depend on any cookie choice. You can delete it from this browser by clearing our site’s data in its settings; the source noted on an order stays with the order and in your customer file.

YouTube videos in some articles only load if you click to play them; YouTube may then store data on your device, under its own rules.

Advertising (Google and Meta)

If you accept it in the banner at the bottom of the site, or with the “Privacy preferences” link, tags from Google (Google Analytics and Google Ads) and Meta (Facebook and Instagram) load on maisondherbes.com. They send these companies the pages you view and how you browse them (scrolling, clicks to other sites, searches made on the site), the products you add to your cart, the start of your checkout and your purchases: amount, taxes, shipping, order number and items. They set their own cookies in your browser (“_ga” and “_gid” for Google, “_fbp” and “_fbc” for Meta), and, as with any site that loads them, these companies also receive your IP address and information about your browser. We do not send them your name, your email or your address.

We use this to measure how well our ads work (which ads lead to visits and purchases) and to show our ads to people interested in our products. Google LLC and Meta Platforms, Inc. are based in the United States: this information is therefore communicated outside Québec. Their cookies last up to two years at Google and 90 days at Meta; what they receive is kept and used under their own policies (policies.google.com/privacy and facebook.com/privacy/policy).

Without your permission, these tags do not load and nothing is sent to them: this is the default setting. You can withdraw your permission at any time with the “Privacy preferences” link at the bottom of every page: the tags immediately stop sending anything from this browser, and their cookies are deleted from it. Your choice applies to this browser; it is kept for 13 months in a cookie from our own domain, “mdh_pub”, and we keep no other record of it. It is independent of your choice about browsing history.

Version 2026-11-pub-v1.