Privacy policy
Privacy officer
Lucarne (Lucarne Conseil) is responsible for protecting personal information. Its designated privacy officer can be reached at confidentialite@lucarne.ca, in accordance with Law 25.
What we collect
- contact information you voluntarily provide through our forms, assessment or a purchase; Follow-up may include your business, exchanges, related tasks and projects, and the documented source and basis for commercial communications.
- your assessment and calculator answers, also used to calculate an internal score that helps us prioritize follow-up;
- your billing data, processed by Stripe;
- cookieless audience measurements with no individual profiling;
— your acquisition source (UTM parameters, referrer, landing page), associated with your file when you submit a form, and used only to measure our communication channels;
— booking information (name, email, chosen slot, optional notes).
— your sign-in address and a secure password hash, never your password in plain text. The client account hash is deleted with its contact record. Password setup and reset links expire after 15 minutes and follow the same cleanup schedule as sign-in links.
What we never do with it
- We never sell or rent your personal information.
- We do not use it for advertising profiles.
Where data lives
Database hosted by Supabase (United States); application processing in Montréal (Vercel). This transfer outside Québec is subject to the assessment required by Law 25 [TO BE VALIDATED by a lawyer].
Some subprocessors process data outside Québec when delivering services (emails through Resend, payments through Stripe, report generation through the Anthropic API — inputs and outputs are not used for training under its commercial terms). A Grok Bot (xAI) business assistant may access records needed for follow-up and preparing communications through dedicated, revocable permissions. It does not receive payment or database credentials. Commercial communications require a documented sending basis and remain subject to withdrawal rights.
Subprocessors
- Supabase
- Vercel
- Stripe
- Anthropic
- Resend
- xAI — Grok Bot
How long we keep it
- messages: 24 months;
- assessments: 24 months;
- audience measurements: 13 months;
- technical logs: 90 days;
- bookings: 24 months after closure; prospect records: 36 months after last activity, unless an operational relationship remains active; unsubscribed addresses are kept solely as a suppression list (CASL requirement). Portal messages and deliverables are kept for 24 months after their last update, except while a linked project is active or an action remains open. Login links expire after 15 minutes and sessions after 8 hours; their references are then erased after 7 days. The management activity log is kept for 13 months, completed tasks for 24 months and closed projects for 36 months. An unused paid consultation remains accessible until the matter is resolved. Billing records remain in Stripe under applicable requirements. A technical fingerprint of the payment reference, without contact details or access tokens, is retained after the personal record is erased to prevent reuse of the same payment.
Your rights
You may request access, correction, consent withdrawal or de-indexing of your information. Email confidentialite@lucarne.ca; we respond within 30 days.
Incidents
We keep a privacy incident register. We notify the Commission d'accès à l'information and affected individuals when an incident presents a risk of serious harm.