Privacy policy

1. Controller and privacy officer

The controller is RISS Canada Inc. (Montreal, Quebec). In accordance with Law 25 (s. 3.1), the person responsible for the protection of personal information is:

Olivier Guidici, President of RISS Canada Inc.
Email: [email protected] (subject "Personal information protection")
Address: RISS Canada Inc., Montreal, Quebec, Canada.

You may contact this person with any question about this policy or to exercise your rights (section 6).

2. Information collected and purposes

Processing	Data	Purpose	Retention
Contact form	Name, email, organization, need, message	Answering your request	12 months, then automatic deletion
Assessment (pre-analysis	Questionnaire answers, optional domain (processed in memory)	Computing your score and generating the AI summary at your request	No retention if you don't request your advice)only an anonymous counter is logged
Assessment : advice & newsletter (opt-in)	Email, timestamped consents, snapshot of your results	Unlocking and emailing your advice (double opt-in); RISS newsletter if you consent	Results: 30 days then deletion; newsletter: until you unsubscribe (link in every email)
Personalized white paper	First and last name, company, size, phone, email, job title	Generating your white paper and sales follow-up	24 months or until you unsubscribe
Site security	Hashed (irreversible) IP addresses, technical signals	Anti-abuse filtering, rate limiting	30 to 90 days depending on the log

3. Cookies

This site sets no advertising cookies and no analytics trackers. Only the Cloudflare Turnstile security mechanism runs on forms (strictly for security, consent-exempt), plus a session cookie limited to internal admin interfaces. That is why no consent banner is required.

4. Automated processing and AI

For transparency (Law 25, s. 12.1): messages submitted through the form undergo automated anti-abuse filtering (technical rules plus analysis by an AI model hosted on sovereign infrastructure in France) before delivery. A blocked message is quarantined for at most 90 days and can be reviewed by a human on request. The assessment summary is generated by AI at your initiative; your answers are not reused for model training. They are stored only if you request your advice (opt-in) at the end of the assessment (see section 2). The personalized white paper, also at your initiative, is written by an AI model hosted on sovereign infrastructure from your answers. If you provide your domain, we run a passive technical check (DNS: SPF/DMARC email configuration, reputation) to refine the analysis : no connection is made to your website.

5. Processors

Provider	Role	Location
Cloudflare	CDN, secure tunnel, Turnstile	International (contractual clauses)
Brevo	Email delivery	European Union
Sovereign AI proxy (myisi.fr)	Anti-abuse analysis and summaries	France

Application hosting is located in France. This communication outside Quebec is covered by a privacy impact assessment (PIA) under Law 25.

6. Your rights

You have the rights of access, rectification, consent withdrawal, deletion and (under GDPR) portability. Write to [email protected]; we reply within 30 days. You may also contact the Commission d'accès à l'information du Québec (CAI) or, in Europe, your supervisory authority.

7. Security and incidents

Measures in place: encryption in transit, network segmentation, application firewall, tamper-evident audit logging, automatic purges. Any confidentiality incident presenting a risk of serious injury is recorded in the incident register and notified to the CAI and to the persons concerned, as required by law.