/PRIVACY

PRIVACY POLICY

Last updated: 2026-08-08

This site is a portfolio. It sells nothing, sets no tracker and follows you onto no other site. It collects personal information in two places only: the contact form, and its server logs — an aggregate reading of which is used to know which regions its visitors come from. This policy sets out exactly what is collected, why, how long it is kept and what you can require — in keeping with Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

01Person in charge of personal information

The responsible enterprise is ZEBRUX, registered with the Québec enterprise register under NEQ 2282411216.

The person in charge of the protection of personal information is Eric Valois, owner of the enterprise. You can reach them through this site's contact form.

02What this site collects

What you send us

When you submit the contact form, you send your first name, last name, email address, a subject and a message. Every one of those fields is required, and nothing else is asked of you. The content is delivered by email — it is never written to any database.

What is attached to your message automatically

So that abuse can be dealt with, three technical items are added to the email we receive, without you having to enter them:

  • Your IP address at the time of sending.
  • Your browser and system (the “User-Agent” header), truncated to 200 characters.
  • The date of sending and the display language of the site.

These items serve only to identify automated or abusive submissions. They are not combined with any other source and are never used for profiling.

What the server records

Like any web server, the one hosting this site keeps technical logs. Every request leaves a line there, whether or not you fill in the form:

  • your IP address;
  • the date and time, the address requested, the server's response code, the volume of data transferred and the processing time;
  • your browser and, if you arrived through a link, the referring page;
  • an approximate location derived from your IP address: country, province or region, city, and the name of your internet service provider.

These logs serve two purposes. First, running the site: checking that it responds, diagnosing failures, spotting intrusion attempts. Second, knowing where visitors come from — country, region, city — because the services presented here are aimed first at a local clientele. That second reading is done in aggregate: what is looked at are trends, not individual visitors.

These logs are cross-referenced neither with the messages received nor with any other source, are passed to no third party, and serve to build no advertising profile. They are kept for at most 90 days, then deleted.

The location is derived from your IP address using a geographic database: it is approximate and usually points to your internet service provider rather than to you. If you would rather it were not derived, simply mask your IP address — through a virtual private network, for instance. The site remains fully accessible either way.

What stays on your device

Two mechanisms keep data in your browser:

  • A draft of the form, under the key zebrux_contact_form_v1, so that an accidental close does not cost you a message. It expires after 12 hours and is never sent to the server. On a shared computer, clear your browser's site data if you would rather not leave it behind.
  • A session cookie set by the server, strictly necessary for the form to work: it carries the anti-forgery token, the anti-robot question and the counter that limits repeated submissions. It holds no advertising identifier, expires when you close your browser, and is readable neither by a script on the page nor by any third party. Its identifier is not recorded in the server logs.

Neither mechanism can track you from one site to another. That is why this site shows no consent banner: it has nothing to ask you to accept.

03What this site does not do

  • No third-party analytics tool, no tracking pixel, no measurement cookie: where visitors come from is read in the server logs described above, and nowhere else.
  • No advertising cookie, no individual profiling, no automated decision-making.
  • No resource loaded from a third party: fonts, styles, scripts and images all come from this server. No social media widget is embedded — the LinkedIn link is an ordinary link, and loads nothing until you click it.
  • No sale, rental or commercial disclosure of your information.

04Why this information is collected

Your contact details are used to read your message and reply to it. The technical items attached to your submission are used to keep the form secure. The server logs are used to run the site and to know where its visitors come from, as described above. There is no other purpose: you will not be added to any mailing list and will receive no solicitation.

05Consent and withdrawal

By submitting the form, you consent to this information being used to reply to you. You may withdraw that consent at any time by writing to the person named in section 01: your message and contact details will then be deleted, unless the law requires them to be kept.

06Retention period

Messages received are kept for at most 24 months from the last exchange, then destroyed. Where an exchange leads to an engagement, documents relating to that engagement follow the retention periods applicable to business and tax records.

The server's technical logs follow their own, shorter period: 90 days.

07Your rights

On request to the person in charge, you may:

  • obtain access to the information held about you;
  • request its correction if it is inaccurate, incomplete or equivocal;
  • request its deletion and withdraw your consent;
  • receive your information in a structured, commonly used technological format.

You will receive an answer within 30 days. If you disagree with it, you may file a complaint with the Commission d'accès à l'information du Québec.

08Security measures

  • The site is served over HTTPS only, with automatic redirection and HSTS.
  • A strict content security policy forbids the browser from loading any external resource.
  • The session cookie is flagged Secure, HttpOnly and SameSite.
  • The form is protected against request forgery, email header injection and automated submissions.
  • No database holds your information: in the event of an incident, the exposed surface is limited to the recipient mailbox and the server logs.

09Hosting and disclosure outside Québec

The site, its logs and the processing described above are hosted by Hébergement OVH inc., on a server located in Québec, Canada. The host acts as a service provider: it uses this information for no purpose other than providing the hosting.

Messages from the form, however, are delivered to a Proton Mail mailbox hosted in Switzerland. What you write in the form is therefore disclosed outside Québec. Switzerland has enacted a federal data protection act whose principles are comparable to those that apply here, and the provider encrypts messages at rest in such a way that it cannot read their content. This is the only disclosure outside Québec this site makes: neither the server logs nor any other data leave the province.

10Confidentiality incidents

Every confidentiality incident is entered in a register. Where an incident presents a risk of serious injury, the persons concerned and the Commission d'accès à l'information are notified promptly.

11Changes

This policy may change to reflect how the site evolves. The date it was last updated appears at the top of the page; earlier versions are kept in the site's source code history.

← Back to home