In brief: we collect only what you give us so we can respond to your requests and serve you. The site uses no cookies, no audience measurement and no targeted advertising, and it saves nothing in your browser. We never sell your information. You can ask at any time to access, correct or delete it by writing to leo@citova.ca.
Who this policy applies to
This policy explains how Citova (“we”) collects, uses, discloses, retains and protects the personal information of people who visit the site https://citova.ca, contact us or do business with us. It aims to comply with Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Personal information is any information that relates to an individual and allows them to be identified, directly or indirectly (for example, a name, an email address, a phone number or an IP address).
Person in charge of personal information protection
Citova’s person in charge of personal information protection ensures this policy is followed and answers any question, request or complaint about it. You can reach them at leo@citova.ca, with “Personal information” in the subject line.
Information we collect
When you use the contact form
The form asks for your name, your business name and your email address (required) and, if you wish, your phone number, your city, the service you’re interested in and a message. For now, when you click “Send,” the form opens your own email software with a pre-filled message: nothing is transmitted until you send that email yourself. The message then reaches us in our Gmail inbox.
When you write or call us
We receive the information you choose to give us: your name, your contact details and the content of your exchanges with Léo.
When you use the visibility check
The tool asks for a business name, a trade and a city. This information relates to a business; however, it can constitute personal information if the business bears a person’s name. How the tool works is detailed below.
When you browse the site
As with any website, your browser automatically sends certain technical data (IP address, browser type, requested page, date and time) to our host and to Google Fonts, which provides the typefaces. We use no cookies, no audience measurement tools, no advertising pixels and no social media plugins, and the site saves nothing in your browser.
When you become a client
To deliver our services, we may also handle your billing details, our exchanges and the access you grant us to your website or other tools. The terms are set out in our terms of service.
We collect only the information needed for the purposes listed below. We don’t ask you for any sensitive information (health, personal finances, etc.), and we ask that you not include any in your messages.
Why we use it (purposes)
- to answer your questions and your requests for a quote or an audit;
- to provide our services and follow up on your file;
- to display the result of the visibility check you request;
- to bill for our services and keep our accounting records, as the law requires;
- to keep the site running and secure and to prevent abuse.
We don’t use your information for other purposes without your consent, unless the law permits or requires it. We neither sell nor rent your personal information, and we don’t use it for profiling or targeted advertising.
Your consent
By checking the box on the form and sending us your message, you consent to our using your information to respond to your request and follow up on it. By launching a visibility check, you consent to the processing described in the section devoted to it.
You can withdraw your consent at any time by writing to us. Doing so may, however, prevent us from responding to you or continuing our services.
Visibility check: what happens
- The business name, trade and city are sent to a function on our site, run on Netlify’s servers.
- This function asks AI assistants a question the way a customer would, for example “I’m looking for a [trade] in [city]. Which ones do you recommend?” Only the trade and the city are sent to the AI providers, through their application programming interfaces (APIs). The business name isn’t sent to them: we compare it ourselves against the answers received. Your IP address isn’t passed on to them.
- The providers that may be queried are OpenAI (ChatGPT), Google (Gemini), Anthropic (Claude), Perplexity AI (Perplexity) and xAI (Grok). They may search the web to answer. How these providers handle the question is governed by their own terms.
- To limit abuse, your IP address is held in temporary memory for up to one hour in order to count the number of checks. The result of a check is also held in temporary memory for up to one hour to avoid asking the same question again. This data isn’t saved in a database and isn’t used for anything else.
- The results are for information only. In demo mode, no AI provider is queried, and the results shown are fictitious and labelled as such.
Disclosure to third parties
We share your information only with the providers we need to operate the site and offer our services, and only to the extent necessary:
- Netlify, Inc. (United States), the site’s host: receives technical connection data, including the IP address, and runs the visibility check function.
- Google (Google Fonts): the typefaces are loaded from Google’s servers, which receive your IP address and technical information about your browser. This service sets no cookies.
- Google (Gmail): our email address is hosted by Gmail, so your emails and the messages coming from the form are stored on Google’s servers.
- AI providers (OpenAI, Google, Anthropic, Perplexity AI, xAI): only during a visibility check, and only the trade and the city, as described above.
These providers may use your information only for the intended purposes. We may also disclose information when the law requires or permits it (for example, at the request of a competent authority).
Disclosure outside Quebec
The providers named above are located mainly in the United States. Your information may therefore be processed or stored outside Quebec and Canada and be subject to the laws of those places. Before disclosing personal information outside Quebec, we carry out a privacy impact assessment, as the law requires, to verify that the information will receive adequate protection, notably with regard to generally recognized personal information protection principles.
Retention period and destruction
- Contact requests with no follow-up: up to 24 months after the last exchange, then deleted.
- Client files and billing documents: for the duration of the business relationship, then for the time required by applicable tax and accounting laws.
- Visibility check data: up to one hour in temporary memory, as described above.
- Technical connection data: according to the retention periods of our host and of Google Fonts.
Once the purpose has been fulfilled, we securely destroy the information or anonymize it, in accordance with the law.
Security
We take reasonable measures to protect your information against loss, theft, and unauthorized access or use, including a secure connection (HTTPS) for the site and access limited to those who need it. However, no method of transmission or storage is 100% secure.
Automated decisions and profiling
We make no decision based exclusively on automated processing of your personal information, and we use no technology that allows us to identify you, locate you or profile you. The visibility check result is calculated automatically, but it concerns a business’s presence in AI assistants’ answers and leads to no decision about you.
Minors
The site and our services are intended for businesses and adults. They’re not intended for children under 14, and we don’t knowingly collect information about them. If you believe a child has given us information, write to us and we’ll delete it.
Commercial communications
In accordance with Canada’s Anti-Spam Legislation, we won’t send you commercial electronic messages (newsletters, promotions) without your consent, except where the law permits it, for example to respond to your request. Every commercial message will identify us and include a simple way to unsubscribe, which will be processed without delay.
Your rights
You can, at any time:
- access the personal information we hold about you;
- have inaccurate, incomplete or ambiguous information corrected;
- withdraw your consent to the use or disclosure of your information;
- request that the dissemination of information about you cease, or that a hyperlink be de-indexed, where the law provides for it;
- obtain the computerized information you provided to us in a structured, commonly used technological format, or have it sent to a person you designate (portability), to the extent provided by law;
- be informed of how your information is used and to whom it’s disclosed.
To exercise these rights, write to the person in charge of personal information protection at leo@citova.ca. We may ask you to confirm your identity. We’ll respond in writing no later than 30 days after receiving your request. This service is free; reasonable fees may apply only to transcription, reproduction or transmission, and you’ll be informed of them in advance.
Complaints
If you believe your information hasn’t been handled in accordance with this policy or the law, first write to the person in charge of personal information protection at leo@citova.ca, describing the situation. We’ll acknowledge receipt of your complaint, review it and respond to you in writing within 30 days.
If our response doesn’t satisfy you, you can contact the Commission d’accès à l’information du Québec, the body responsible for overseeing the application of the law in Quebec. Where federal law applies, you can also contact the Office of the Privacy Commissioner of Canada.
Confidentiality incidents
A confidentiality incident is, for example, unauthorized access to personal information, its loss or its unauthorized disclosure. If such an incident occurs, we’ll promptly take reasonable measures to reduce its consequences and prevent it from happening again. If it presents a risk of serious injury, we’ll promptly notify the Commission d’accès à l’information and the people concerned. We keep a register of incidents, as the law requires.
Policy updates
We may update this policy to reflect changes to our practices or to the law. The current version is always published on this page, along with its update date. If there is a significant change, we will say so clearly on the site. If we ever add cookies or an analytics tool, we will do so only after updating this policy and asking for your consent first.