Privacy Policy / Politique de confidentialité

Last Updated / Dernière mise à jour: December 22, 2025

Solutions Monamotion inc., doing business as Privacy ELO ("we," "our," or "us"), provides compliance scanning services to help businesses assess their CCPA and GPC compliance. We are committed to protecting your personal information in accordance with applicable privacy laws, including Quebec's Law 25 (Act respecting the protection of personal information in the private sector).

1. Information We Collect

1.1 Information You Provide

Website URLs: URLs you submit for compliance scanning. Note: Our scanner only accesses public-facing code and does not penetrate restricted areas.
Contact Information: Email addresses and names provided for reports or account creation.
Payment Information: Processed securely by our payment processor (Stripe). We do not store full credit card details.

1.2 Automatically Collected Information

Technical Data: IP addresses, browser type, device info, and operating system.
Usage Data: Pages visited, time spent, and interaction with scan results.
Cookies: We use essential and functional cookies to maintain session state and preferences.

2. Usage & Lawful Basis

We process your information for the following specific purposes:

Service Delivery: To perform compliance scans and generate reports.
Improvement: To analyze scan accuracy and improve our detection algorithms.
Communication: To send you your scan results and critical service updates.
Security: To detect and prevent abuse of our scanning tools (e.g., bot attacks).

3. Data Retention Periods

We retain personal information only as long as necessary for the purposes described, or as required by law:

Data Type	Retention Period
Scan Results & Reports	90 days from scan date (or duration of active subscription)
Account Information	Until account deletion + 30 days
Payment Records	7 years (legal/tax requirements)
Technical/Usage Logs	12 months
Email Communications	3 years or until unsubscribe

After the retention period, data is securely deleted or anonymized. You may request earlier deletion (see Section 7).

4. Cookies & Consent

4.1 Types of Cookies

Strictly Necessary: Essential for website functionality (session management, security). No consent required.
Functional: Remember preferences (language, theme). Enabled by default, opt-out available.
Analytics: Understand usage patterns. Requires explicit consent before activation.

4.2 Your Consent Choices

Upon your first visit, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. You may change your preferences at any time through your browser settings or by contacting us.

5. Global Privacy Control (GPC) & Do Not Track

We honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request under applicable privacy laws (CCPA/CPRA).

Do Not Track (DNT): While there is no universal standard for DNT signals, we respect user privacy preferences. When DNT is enabled, we disable non-essential tracking.

6. Storage & International Transfers

Our operations are based in Quebec, Canada. However, we use third-party service providers (such as Vercel and AWS) that may process or store data in other jurisdictions, including the United States.

By using our Services, you acknowledge that your information may be transferred to and processed in jurisdictions with different data protection laws than your own. We ensure our providers adhere to strict security standards.

Third-Party Processors:

Vercel Inc. (USA) – Website hosting and edge functions
Amazon Web Services (USA) – Cloud infrastructure
Stripe, Inc. (USA) – Payment processing

7. Information Sharing

We do not sell your personal information. We share data only with:

Service Providers: Cloud hosting, analytics, and payment processors bound by confidentiality agreements.
Legal Obligations: Compliance with court orders or valid legal process.
Business Transfers: In the event of a merger, acquisition, or sale of assets.

8. Data Security

We employ industry-standard security measures (SSL/TLS encryption, secure infrastructure) to protect your data. However, no internet transmission is 100% secure. You provide information at your own risk.

9. Your Privacy Rights

Under Quebec Law 25 and other applicable laws, you have the right to:

Access: Request a copy of your personal information.
Rectification: Correction of inaccurate or incomplete data.
Deletion: Request erasure of your data ("Right to be Forgotten").
Portability: Receive your data in a structured, standard format.
Withdraw Consent: Stop future processing where consent is the basis.
Object to Automated Decisions: Request human review of automated decisions that significantly affect you.

To exercise these rights, contact our Privacy Officer (Section 11).

10. Automated Decision-Making

Our compliance scanning service uses automated analysis to generate reports. These outputs are informational only and do not result in decisions with legal or similarly significant effects on you.

If we ever implement automated decision-making that produces legal effects, we will: (i) provide meaningful information about the logic involved; (ii) ensure human intervention is available upon request; and (iii) allow you to contest the decision.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

If you are a parent or guardian and believe your child has provided us with personal information, please contact our Privacy Officer immediately. We will promptly delete such information.

12. Right to Lodge a Complaint

If you believe we have not handled your personal information in accordance with applicable laws, you have the right to lodge a complaint with the relevant supervisory authority:

Commission d'accès à l'information du Québec (CAI)

575, rue Saint-Amable, bureau 1.10

Québec (Québec) G1R 2G4

Tel: 1-888-528-7741

Website: www.cai.gouv.qc.ca

13. Privacy Officer Contact

For any privacy-related inquiries or to exercise your rights under Law 25, please contact our Privacy Officer:

Privacy Officer / Responsable de la protection des renseignements personnels

Solutions Monamotion inc.

Email: privacy@elo.fyi

Please include "Privacy Officer" in the subject line for expedited routing.

Response Time: We will acknowledge your request within 10 business days and respond within 30 days as required by Law 25.

Policy Updates

We may update this policy to reflect changes in our practices or laws. Significant changes will be notified via email or a prominent notice on our site at least 30 days before taking effect.