Privacy policy

Five things at most, and the audience measurement only if you agreed to it. None of them come from a data broker or an ad network.

The contact form

Three fields are required: your name, your email address, and a description of what you are trying to fix — without the first two we cannot reply, without the third we would not know what to reply. Company, phone, how many people would use the tool, and budget range are optional: leave blank whatever doesn't suit you. The form sends its contents to us by email; it feeds no database and no contact-management tool.

Server logs

Like any web server, the one serving this site records incoming requests: IP address, timestamp, page requested, browser type. These logs exist for security and for diagnosing outages. They are not used to follow a person, nor cross-referenced with anything else.

The anti-spam check

The form is protected by Cloudflare Turnstile, which tells a person apart from a bot. To do that, Turnstile observes technical signals from your browser — IP address, headers, how the page is used. It never receives the contents of your message, sets no cookie, and does not follow you from site to site. The form also carries a hidden field, off-screen, that a person cannot fill in and a bot does: if it reaches us filled in, the submission is dropped. That field collects nothing about you.

Audience measurement — only with your agreement

If you accept, Google Analytics is loaded through Google Tag Manager and sets cookies on your device. It then records which pages you view, how long visits last, your device type, an approximate location derived from your IP address, and a random identifier tying your visits together. That serves one purpose — knowing which pages get read. No advertising, no cross-referencing with the contact form, no attempt to identify you by name. Until you accept, none of it is loaded and no data reaches Google.

Your cookie choice

One thing stays in your browser's local storage: your answer to the consent request — accepted or refused, with its date. It is never sent to us, contains no identifier, and disappears if you clear your browser data. It is what stops the question being asked again on every page.

The complete list runs to three lines, and until you accept the audience measurement it comes down to the last one — which is not a cookie but your answer, kept by your browser to itself.

Google Tag Manager sets no cookie of its own: all it does is load the audience measurement. Cloudflare Turnstile sets none either. There are no others — no advertising cookies, none from social networks. Withdrawing your agreement through the “Cookies” link at the foot of the page deletes the first two.

One tool sets cookies on this site: Google Analytics, loaded through Google Tag Manager, and only if you have agreed to it. Quebec law requires that a technology capable of identifying, locating or profiling you stay switched off until you switch it on yourself, and that is exactly what happens here. Before you agree, Google's script is not even loaded — so there is no request to Google at all, not even an “anonymous” one.

Google Tag Manager is the container that loads that tool: a script supplied by Google, which sets no cookie of its own and holds nothing here but the measurement tag. It is not neutral for all that — merely fetching it from Google's servers hands them your IP address. Which is exactly why it is not on the page until you have accepted: Google's “consent mode”, which lets the container load while asking it to store nothing, would not have prevented that first disclosure.

Refusing degrades nothing: the site works identically, and so does the form. You can change your mind either way at any time, through the “Cookies” link at the foot of every page. Withdrawing reloads the page without the measurement tool and deletes the cookies already set. You are asked again after a year.

The form's anti-spam check is the one thing that does not go through that request, because it is strictly necessary to the service you asked for: without it the form would be unusable. Cloudflare Turnstile was chosen precisely because it sets no cookie and builds no advertising profile, unlike reCAPTCHA-style services.

Beyond that there is no social-network pixel, no advertising network, no personalized advertising, no cross-referencing between the audience measurement and enquiries received through the form, and no decision concerning you made by automated means.

Information from the form serves one purpose: answering your enquiry and, if a project follows, discussing it with you. We do not use it for anything else without asking you first.

You provide it by writing to us — that is your consent. We send no newsletter and add you to no list. Your information is never sold, rented or traded, under any circumstances.

Audience measurement serves a different purpose: understanding which pages get read and how people reach them, so the site can be improved. That is not necessary to provide the site to you, and Quebec law recognizes no “legitimate interest” that would excuse us from asking — so it rests entirely on the consent you give, or withhold, in the banner.

This site addresses businesses and the people who represent them. It is neither designed for nor directed at children, and nothing on it is something a minor would have reason to use.

We do not knowingly collect information about anyone under 14 — the age at which Quebec law recognizes a person's own consent. Were we to find that we had received any, through the form or otherwise, we would destroy it without using it.

Internally, only the people handling your enquiry can see it, and only for that reason.

Externally, four suppliers are technically involved: the site's host, which runs the servers; SMTP2GO, which delivers the form's email; Cloudflare, whose Turnstile service checks that the form is being filled in by a person; and — only if you accepted the audience measurement — Google, which processes the visit data. They act on our behalf under agreements limiting their use of the information to that service; in Google's case, the Google Analytics data processing terms. No other third party receives your information unless the law requires it.

These suppliers may process or store data outside Quebec, including in the United States — which is the case for Google and the audience measurement, if you accepted it. Before entrusting anything to a supplier established outside Quebec, we look at what it collects, what its terms of service commit it to, and whether the resulting protection is enough for what we send it. What leaves here is deliberately thin: your name, your email, and whatever you chose to write.

Once hosted abroad, that information may become subject to the laws of the country concerned. That trade-off is inherent to using hosted services; we limit it by transmitting only what is strictly necessary.

Enquiries received through the form are kept for up to two years after the last exchange, so a conversation that resumes still has its thread. After that they are destroyed.

If an engagement follows, information tied to the file is kept for the periods that apply to business and tax records. Technical logs are kept by our hosts on their own short, automatic schedules; we do not copy them, and we consult them only for an outage or an incident. A deletion request is honoured sooner, unless the law requires us to keep the record.

Visit data is kept for two months in Google Analytics — the shortest period the tool allows — and after that only as totals that no longer attach to anyone. Your cookie choice stays on your device for a year, after which you are asked again.

The site is served entirely over HTTPS, email travels through an established provider, and inbox access is protected by unique passwords and two-factor authentication.

The basic principle remains not collecting what we don't need. No measure is foolproof, though — please don't send sensitive information through this form (social insurance number, banking details, medical records).

This site points to a few addresses we do not operate: the applications we have delivered to clients, the Commission d'accès à l'information's own site, those of the tools named here. The moment you follow one of those links, that site's policy applies, not this one.

Those links only go anywhere on a click of yours. No third-party content is embedded in our pages — no embedded video, no share button, no map — and the typefaces are served from this site rather than from a Google server.

Should an incident involving personal information occur, we would take reasonable steps to reduce its consequences and record the details in a register, as the law requires.

Where an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and every person concerned without delay.

The law asks that the way a business handles personal information be published in plain language. For a business our size it all comes down to four rules, and this page is where they are written: there is no longer version of them somewhere else.

One way in, the form. Only the people handling your enquiry can see it. What reaches the end of its retention period is destroyed rather than archived. And no tool is added to the site without first looking at what it collects and where it processes it from — which is what led to the choices described above.

The officer below answers questions about these rules, and is also where a complaint goes in the first instance.

This policy may change as the site does — a new tool, a new feature. The effective date at the top of the page tells you which version you are reading.

A significant change to how we handle your information will be flagged on this page before it takes effect.