Summary: While you're answering, your answers stay in your browser. When you reach the end of an assessment, its results are sent to our servers and retained — whether or not you provided an email address — to generate your report, let you return to it by link, and compute anonymous, aggregated sector statistics. No account is required for this.

1. Data Controller

StructureClerk is responsible for the processing of your personal data in accordance with Quebec Law 25 and the General Data Protection Regulation (GDPR).

Contact: info@structureclerk.ca

2. Data Collected

2.1 Questionnaire and Website Analysis Data

Website URL — To personalize the analysis, and sent to our infrastructure when you request a website analysis
Questionnaire answers and analysis results — Profile (name, company, sector, size), markets, assessed domains, answers, scores, website analysis findings
Email address — To send you the report (optional)

What stays local, and what is sent to our servers: While you're answering an assessment, your answers are processed in your browser (sessionStorage) and do not leave it. When you reach the end of an assessment — whether or not you provided an email address — all of the data above is sent to our servers and retained, to generate a report you can return to by link (/r/[id]), to send you a copy if you request one, and to compute anonymous, aggregated sector statistics (see §3). The URL of a site you request an analysis for is sent to our servers as soon as you make the request, since the analysis itself runs there.

2.2 AI Chatbot Data

Conversation messages — Processed by our AI to generate responses

AI conversations are processed by our infrastructure to generate responses. We recommend not sharing confidential information or sensitive personal data in your questions.

2.3 Voice Mode (Pro plan)

Microphone audio — Speech recognition uses your browser's API; depending on your browser (e.g. Chrome), audio may be processed by its vendor's servers (e.g. Google) for transcription. We never receive the audio.
Transcripts — The transcribed text is sent to our AI to interpret your answer, then kept in your browser with your results (and in your report if you export it).

2.4 API Usage Data

Request metadata — IP address, user-agent, timestamp for rate limiting
Request content — Processed to generate responses, not stored

2.5 Technical Data

IP address — For rate limiting and security
Navigation data — Essential technical cookies only

3. Purpose of Processing

Data	Purpose	Legal Basis
Website URL	Analysis personalization, running the requested website analysis	Consent
Questionnaire answers and results	Score calculation, generation of the shareable report (/r/[id])	Consent
Answers, results, sector and markets (de-identified)	Aggregated sector statistics, published only above a threshold of 5 sites (Observatory)	Legitimate interest
Email	Report delivery	Consent
AI messages	Assistant responses	Consent
IP address	Security and rate limiting	Legitimate interest

Aggregated statistics never identify a site: they are only computed and published once at least 5 sites contribute to the same segment (sector × market), and no URL or company name ever appears in them.

4. Data Retention

During the assessment: your in-progress answers stay in your browser (sessionStorage) and are deleted on tab close — nothing has been sent to our servers yet at this stage
Report (questionnaire or website analysis), once the assessment is complete: retained for 24 months from the assessment date, then automatically deleted (monthly purge)
Aggregated sector statistics: retained indefinitely, since they relate to no identifiable site
Email: Until consent withdrawal, or 24 months along with the rest of the report if no withdrawal occurs first
IP logs: 30 days maximum
AI conversations: Retained only if you are signed in and save the conversation; deletable at any time

You can request early deletion of your report before the 24-month deadline by writing to info@structureclerk.ca with that report's /r/[id] link; see your rights in §5.

5. Your Rights

Under Law 25 and the GDPR, you have the following rights:

Right of access — Obtain a copy of your data
Right to rectification — Correct inaccurate data
Right to erasure — Request deletion of your data
Right to portability — Receive your data in a structured format
Right to object — Object to processing
Right to withdraw consent — Withdraw your consent at any time

To exercise your rights, contact us at: info@structureclerk.ca

6. Hosting and Data Location

Data retained by StructureClerk is hosted in Canada. Data processing complies with Canadian and Quebec privacy laws.

7. Security

TLS 1.3 encryption for all communications
Rate limiting to prevent abuse
Client-side processing during the assessment, before anything is sent to our servers (§2.1)
No sensitive identifying data (password, social insurance number, financial data) is requested by the questionnaire or stored on our servers

8. Cookies

We use only essential technical cookies required for site functionality (Supabase authentication, session and language preferences). We do not use advertising or tracking cookies.

9. Changes

This policy may be updated. The last modification date is shown at the top. We encourage you to review it regularly.

10. Contact and Complaints

Questions: info@structureclerk.ca

Complaints: You may file a complaint with the Commission d'accès à l'information du Québec (CAI) at www.cai.gouv.qc.ca

Privacy Policy