Data controller
The data controller for personal data collected via this website is:
Services eliss.io Inc.
Quebec enterprise number (NEQ) 1177995355
operating the eliss.io website
300-204, rue Saint-Sacrement
Montréal (Québec) H2Y 1W8, Canada
Founder and Chief Executive Officer
privacy@eliss.io
Data collected
When using this website, we only collect the following data:
| Data | Source | Nature |
|---|---|---|
| Name, company, email | Contact form | Voluntarily submitted |
| Subject & message | Contact form | Voluntarily submitted |
| Browsing data | Umami (if consent) | Pages viewed — path without query parameters or fragment, page title and website hostname |
| IP address — audience measurement | Umami (if consent) | Received to derive an approximate location and a pseudonymous identifier; the raw IP address is not stored in measurements |
| Approximate location | Derived from the IP address by Umami | Approximate country, region and city, where available |
| Browser characteristics | Umami (if consent) | Browser, operating system, device type, language and screen resolution |
| Application firewall counters | Amazon Web Services (application firewall) | A firewall filters requests sent to the contact form. It produces aggregated counters — the number of requests per country, per internet access organisation and per device type, both inferred from your request. No IP address is retained there, and these counters cannot identify you. |
| Technical error diagnostics | Self-hosted GlitchTip — errors.eliss.io | Only when an error occurs: filtered error message, JavaScript stack trace (file, line and column), known page path, website release and HTTP status for contact form failures. No form contents, browsing history, cookies, visitor identifier or session recording are attached. The service necessarily receives the IP address with the request and GlitchTip adds an anonymized version of that address to the report; the SDK does not attach the IP address itself. |
| Technical performance (with consent) | Self-hosted GlitchTip — errors.eliss.io | With your audience measurement consent, a 10% sample of page loads and navigations is measured: known page path, website release, start and end timestamps, page load and navigation durations, timing of public website resources and numeric rendering metrics (FCP, LCP, TTFB and CLS, when available). No form contents, URL parameters, fragments, referrer, DOM selector, click, visitor identifier or linked browsing history are attached. The service necessarily receives the IP address with the request; the SDK attaches no identity or browser characteristics. |
Note: We do not ask for any sensitive data in the contact form. Please do not enter information relating in particular to your health, origins, beliefs, sexual orientation or any other especially confidential matter. As the message field is free text, we cannot technically prevent such entries: if you do send us any, they are handled like the rest of your message and deleted at your request.
Purposes & legal basis
| Purpose | Legal basis (GDPR) | Justification (Quebec Private Sector Act) |
|---|---|---|
| Responding to contact requests | Legitimate interest (Art. 6.1.f) | Necessary to provide the service requested; information supplied voluntarily after being informed |
| Business relationship follow-up arising from your request | Legitimate interest (Art. 6.1.f) | Purpose stated before collection, directly related to your request; information supplied voluntarily after being informed |
| Audience measurement and site improvement | Freely given, specific, informed and unambiguous consent (Art. 6.1.a) via the cookie banner | Prior, clear, free and informed consent, given for that specific purpose |
| Abuse prevention and security | Legitimate interest (Art. 6.1.f) | Necessity; use expressly permitted to prevent or detect fraud and to assess or improve protection and security measures (s. 12) |
Cookies & trackers
This website sets no cookies and loads no third-party resources — fonts and website resources are self-hosted. Until you accept audience measurement, your browser makes no request to any third party and does not contact our Umami instance. Preferences and scroll position are stored in your browser; Umami’s technical token stays only in page memory: Technical diagnostics: independently of your audience measurement choice, website errors are reported to our GlitchTip instance at errors.eliss.io, self-hosted on Amazon Web Services in Montréal (ca-central-1). This monitoring sets no cookies and writes no identifier to your browser storage. Reports are limited to the diagnostic data listed in section 2; form input, URL parameters, fragments, referrer, browsing history and session recordings are excluded. Technical performance: with your audience measurement consent, GlitchTip also measures the durations described in section 2 for a 10% sample of page loads and navigations. This monitoring respects Do Not Track; withdrawing consent or its expiry blocks new transmissions, including a measurement in progress.
Strictly necessary trackers
These trackers are essential for the website to function and do not require consent. The first two remember your choice, including your refusal; the third serves browsing comfort alone. All stay on your device and are never sent to our servers.
| Tracker | Duration | Purpose |
|---|---|---|
| eliss_cookie_consent local storage | 6 months, or until you clear it | Remembers your acceptance or refusal choice |
| eliss_cookie_consent_date local storage | 6 months, or until you clear it | Timestamp of your choice, used to ask you again once the 6 months have elapsed |
| react-router-scroll-positions session storage | Cleared when the tab is closed | Remembers your scroll position so you are returned to it when you come back to a page |
Audience measurement trackers (subject to consent)
Umami is self-hosted by eliss.io in Canada on Amazon Web Services (region ca-central-1). Its script is only loaded if you click “Accept”. If you decline, no browsing data is collected and this script is not downloaded. Only pageviews and the characteristics described in section 2 are measured: your clicks, form content, scroll depth, time on page and page loading times are not recorded. Query parameters, fragments and referrers are excluded from transmissions. The IP address is received by the service but is not retained by this tool in its measurements.
| Tracker | Provider | Duration | Purpose |
|---|---|---|---|
| Technical session token page memory only | eliss.io (Umami) | Lost when the page is reloaded or closed; no analytics identifier is written to local or session storage | Groups visit measurements without assigning a personal identifier. The server computes a pseudonymous identifier from request characteristics. |
Your IP address is not retained by this tool in measurements: Umami uses it upon receipt to derive an approximate location and a pseudonymous identifier. Only pageviews and the characteristics described in section 2 are sent; session recording, click or input capture, scroll depth, time on page and page loading time measurement are disabled. Contact form submissions use the same content delivery network as the pages, which receives your IP address without retaining an access log.
Manage your preferences
You can change your choice at any time by clicking the button below. Your preference is kept in your browser for 6 months; after that it is cleared, measurement stops and you are asked to choose again. Withdrawing consent stops new transmissions, including in other tabs open on this website.
Data retention
| Data | Duration | Reason |
|---|---|---|
| Contact data (form) — record held by the receiving service | 3 years from the receipt of your message, then automatically deleted. A continuous backup allows our database to be restored as it stood up to 1 day earlier; should we need to use it, a message deleted within that interval would reappear, and we then replay the deletions requested before returning it to service. | Business relationship follow-up |
| Contact data (form) — copy delivered to our inbox | Deleted on request. No automatic deletion is currently in place for this copy. | Your message is emailed to us so that we can reply to it |
| Analytics data (self-hosted Umami) | Audience measurement data is retained for a maximum of 13 months in our self-hosted Umami instance. | Audience measurement and trend analysis |
| Technical logs of the function that processes the form — no IP address | 12 months, then deleted automatically | Diagnostics and abuse detection |
| Tracker preference | 6 months — you are then asked to choose again | Remembers your acceptance or refusal |
| Error reports and performance measurements (self-hosted GlitchTip) | Retention of errors, transactions and performance traces is configured to 30 days, with automatic cleanup by the GlitchTip worker. The setting and execution of the maintenance task were verified on 7 October 2026. Backups have a separate retention period; deleting an event from the active database does not immediately erase a backup copy. | Diagnostics, error resolution and website performance improvement |
You may request the deletion of the information concerning you by writing to privacy@eliss.io. What such a request reaches is not the same for every copy, and we would rather say so precisely.
Information from the contact form — the record held by the receiving service and the copy delivered to our inbox — is deleted on request. We have not yet established how long a deleted item then remains with our email provider; that period will be published here once we have measured it.
Audience measurements are retained in our self-hosted Umami instance. Withdrawing consent stops future transmissions; it does not delete measurements already received. No personal identifier is sent to Umami, so we cannot reliably link a measurement to a person requesting its deletion. We can delete data from this instance, but do not promise individual deletion that we could not correctly attribute.
Data sharing
Your data is neither sold, rented, nor transferred to third parties for commercial purposes. Until you accept audience measurement, the pages of this website load no third-party resources — no fonts, no scripts, no remote images: your browser communicates only with our own domains. If you accept, the measurement script is loaded from analytics.eliss.io and pageviews are sent to this same domain, operated by eliss.io with Umami self-hosted in Canada. The contact form is received by a service we operate ourselves, hosted in Canada, which it reaches without leaving this domain. This service stores your information and emails it to our inbox, and to no other recipient. Your data may be shared with the following processors, strictly within the scope of the contractually defined service: Technical diagnostics: independently of your audience measurement choice, website errors are reported to our GlitchTip instance at errors.eliss.io, self-hosted on Amazon Web Services in Montréal (ca-central-1). This monitoring sets no cookies and writes no identifier to your browser storage. Reports are limited to the diagnostic data listed in section 2; form input, URL parameters, fragments, referrer, browsing history and session recordings are excluded. Technical performance: with your audience measurement consent, GlitchTip also measures the durations described in section 2 for a 10% sample of page loads and navigations. This monitoring respects Do Not Track; withdrawing consent or its expiry blocks new transmissions, including a measurement in progress.
| Processor | Country | Role | Guarantees |
|---|---|---|---|
| Amazon Web Services | Canada — Montreal (ca-central-1) | Hosting the website, our Umami instance and our GlitchTip diagnostic instance, receiving and storing form messages, sending notification emails | Data at rest hosted in Canada; any technical operations or support access from outside the country is governed by the agreements entered into with the provider |
| Amazon CloudFront (Amazon Web Services) | Worldwide network of points of presence — your request is served from the point of presence closest to you | Content delivery network for the website's pages: TLS termination and request routing. As such, it receives your IP address. Contact form submissions also pass through it as of 7 September 2026: they use the same domain as the pages, rather than a separate address. | Access logging disabled — no request log is retained (established by direct inspection on 27 August 2026). Any technical operations or support access from outside the country is governed by the agreements entered into with the provider |
| Microsoft 365 (Exchange Online) | Canada — data geography of our tenant | Inbox receiving contact form messages (contact@eliss.io) | Microsoft Data Protection Addendum |
Important: In case of data transmission to authorities upon judicial request, we comply in accordance with applicable law and will inform you within legally permitted limits.
Transfers outside EU / Canada
New audience measurement data is hosted in Canada, in Montreal, in our Umami instance on Amazon Web Services (region ca-central-1). The script and measurements use only our domain analytics.eliss.io.
No audience measurement data is transmitted unless you accept the corresponding trackers, and you can change this choice at any time. Technical error reports described in section 2 are independent of this consent and sent to our errors.eliss.io instance, hosted in Canada (ca-central-1). Technical performance: with your audience measurement consent, GlitchTip also measures the durations described in section 2 for a 10% sample of page loads and navigations. This monitoring respects Do Not Track; withdrawing consent or its expiry blocks new transmissions, including a measurement in progress.
The website itself is hosted in Canada, in Montreal (Amazon Web Services, ca-central-1 region), as are the receipt, storage and receiving inbox of contact form messages: this data is kept in Canada. A Canadian hosting region establishes where data is held at rest, not where every access originates: we do not rule out technical operations or support access from outside the country, and such access is governed by the agreements entered into with these providers.
Your rights (GDPR)
The General Data Protection Regulation (GDPR) applies when you are located in the European Economic Area: to the audience measurement processing described in section 4, which amounts to monitoring of your behaviour within the meaning of Article 3(2)(b); and to the information you send us through the contact form, to the extent that we offer our services to persons in the Union within the meaning of Article 3(2)(a). You then have the following rights:
- Right of access — obtain a copy of data concerning you (Art. 15)
- Right to rectification — correct inaccurate data (Art. 16)
- Right to erasure — request deletion of your data (Art. 17)
- Right to restriction of processing — request that the use of your data be temporarily restricted, in the circumstances provided for (Art. 18)
- Right to portability — receive your data in a structured format (Art. 20)
- Right to object — object to processing based on legitimate interest (Art. 21)
- Right to withdraw consent — withdraw your consent at any time, without affecting the lawfulness of prior processing
- Right to lodge a complaint — file a complaint with the CNIL (cnil.fr) or your member state's supervisory authority
To exercise any of these rights, contact us at privacy@eliss.io. We respond within a maximum of 30 days.
Specific rights — Law 25 (Quebec)
Where Quebec law applies to the processing of your personal information, the Act respecting the protection of personal information in the private sector, as amended by Law 25, grants you additional rights:
- Right of access — consult personal information concerning you
- Right to rectification — have inaccurate or incomplete information corrected
- Right to de-indexation — request cessation of dissemination or re-indexation, under the conditions of Art. 28.1
- Right to portability — receive your information in a commonly used technological format (in effect since September 2024)
- Right to withdraw consent — withdraw your consent at any time for consent-based processing
The role of person responsible for the protection of personal information for Quebec is held by the Founder and Chief Executive Officer, reachable at privacy@eliss.io.
In the event of a privacy incident posing a serious risk of harm, we will inform you as soon as possible and notify the Commission d'accès à l'information (CAI) in accordance with Article 3.5 of Law 25.
Data security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction or alteration:
- Encrypted transmission via TLS/HTTPS
- Data access restricted to authorized personnel on a need-to-know basis
- Hosting in ISO 27001 certified data centres
- Application-level filtering and rate limiting on the contact form's receiving endpoint
Changes to this policy
Any modification to this policy is the subject of a separate notice published on this page. That notice states the date it was published, the nature of the modifications and the date they take effect.
Where a modification is liable to have a significant effect on your rights or on the use of your information, it is brought specifically to your attention before it takes effect, wherever that is possible.
The current version is always available at eliss.io/en/privacy-policy.
Notice of modification — published on 8 October 2026
Effective date: 8 October 2026. Audience measurement data in our self-hosted Umami instance is retained for a maximum of 13 months. Passages concerning the previous audience measurement and sales follow-up tools are removed from this policy. Consent arrangements and other processing remain unchanged. Addendum of 7 October 2026. Addition of technical performance measurements for a 10% sample of page loads and navigations, only after audience measurement consent and respecting Do Not Track. Durations, known paths and rendering metrics are described in section 2; no clicks, form contents or linked browsing history are transmitted. Transactions and traces are kept for 30 days. Notice of 7 October 2026. Addition of website error diagnostics using GlitchTip, self-hosted in Montréal (ca-central-1). This monitoring operates only when an error occurs, independently of consent to audience measurement. The technical data reported and exclusions are described in sections 2, 4, 5, 6 and 7. The SDK sends neither form contents, URL parameters, browsing history nor a visitor identifier; no cookie or session recording is added. Event retention is configured to 30 days, with automatic worker cleanup; backups have a separate retention period. Previous notice — 7 September 2026. Nature of the modifications: an application firewall now filters requests sent to the contact form, and rate limiting applies at its receiving endpoint. Section 10 states this measure; section 2 publishes what it produces. What we chose not to do: the most common way of protecting a form is to limit the rate per IP address, which requires the provider to retain the list of addresses concerned. We declined that. The firewall we selected retains no IP address. What it does produce, and what we publish: aggregated counters — the number of requests per country, per internet access organisation and per device type. These three items are inferred from your request, they cannot identify you, and they are associated with no other data. We publish them because the list of what we measure, in sections 2 and 4, is meant to be complete: a derived item missing from it would make it false. These modifications add a security measure and the information that accompanies it. They change neither the purposes nor the retention periods, and restrict none of your rights. Previous notice — 7 September 2026. Nature of the modifications: the contact form is now received by a service we operate ourselves and which it reaches without leaving this domain, whereas it was previously sent to a separate address. Three consequences, which this policy publishes. First, an improvement: the service that now receives your submissions retains neither your IP address nor your user agent. The line that published their 30-day retention is removed from sections 2 and 5 — not because we stop publishing it, but because that retention no longer takes place. Second, a less favourable clarification: your submission now passes through our content delivery network, which accordingly receives your IP address — which section 6 expressly stated was not the case. That section is corrected. No request log is kept there, as it also publishes. Third, a residual copy we had not yet published: a continuous backup of our database allows its state to be restored up to 1 day earlier. Should we need to use it, a message deleted within that interval would reappear; we keep a register of the deletions requested and replay them before returning it to service. On balance these modifications reduce the data retained: a 30-day retention disappears, a one-day residual copy is created and published. They change neither the data collected nor the purposes, and restrict none of your rights. Previous notice — 27 August 2026. Nature of the modifications: the retention period for contact form messages now runs, in the text as in the mechanism, from the receipt of the message rather than from the last interaction — which shortens it; the three copies of a message are distinguished (record held by the receiving service, copy in our inbox, optional sales record) and, for each, what triggers its deletion is stated; the website's content delivery network is named among the processors, together with the fact that it receives your IP address and that no access log is retained there. These modifications clarify the information published and do not restrict any of your rights.
Contact us
For any questions regarding this policy or to exercise your rights:
Services eliss.io Inc. — Data protection
300-204, rue Saint-Sacrement
Montréal (Québec) H2Y 1W8, Canada
France: cnil.fr
Quebec: cai.gouv.qc.ca