Privacy policy

Your privacy

This policy explains how ganolyk collects, uses, communicates, retains and protects personal information in connection with its website, its audits, its exchanges with you and its services, including hosting and email.

Personal information is any information that concerns a natural person and allows that person to be identified, directly or indirectly. Professional information and browsing identifiers can be personal information.

Who is responsible for your information?

Michael Valade
Person in charge of the protection of personal information — ganolyk
Email: info@ganolyk.ca
Phone: 514 972-1446
Montréal (Québec)

You can contact the person in charge with a question, a request concerning your information or a complaint. The address audit@ganolyk.ca is used to send audit reports; privacy requests must be sent to info@ganolyk.ca.

The information we collect

We collect the information needed for the following purposes:

Information requests, quotes and appointments: your name, your email, your phone number, your business name, the service you want, the content of your message and, when you ask for a call, your availability. This information is used to respond to you, prepare a proposal and organize the follow-up you requested.
Audits: your name, your business name, the address of the website to analyze, the email address where we send your report and your consent choices. They are used to carry out the audit, deliver the report and answer questions related to your request.
Services and billing: contact details, contract and billing information, and the technical information needed to provide and administer the agreed services.
Browsing, security and consent: the technical information described below and the information needed to record and respect your choices.

This information comes from your forms, your communications with us, your use of our services and, for the audit, the public pages of the submitted website.

Required fields are marked in the forms. Other fields are optional. If you do not provide information needed for a request, we may not be able to act on it. Declining advertising cookies or commercial follow-up does not prevent you from requesting an audit.

Do not send passwords, banking information or sensitive information through public forms. If technical access is needed for a mandate, we will agree with you on an appropriate way to provide it.

How the audit works

The audit analyzes the public pages of the website you provide. It does not require access to your administration account or your private areas.

The audit application, request records and reports are hosted on the server operated and administered by ganolyk in Montréal, Québec. ganolyk manages this hosting and access to the server.

Reports are sent from audit@ganolyk.ca through ganolyk’s email service connected to that server. A copy may be kept in ganolyk’s mailbox to process the request and its follow-up, according to the retention rules below.

For some technical checks, Google PageSpeed Insights receives the address of the page to analyze. The part of the audit that uses artificial intelligence goes through Perplexity. This service receives questions, the website address and the public excerpts useful for the analysis, for example the title, the description, the business activity and the region served.

We do not add the contact details entered in your request to the queries sent to Perplexity. However, the public pages analyzed may themselves contain names, contact details or other personal information. We limit what is sent to what the analysis needs.

Perplexity may involve its own technical or model providers depending on the service used. This external processing may take place outside Québec.

The analysis may automatically generate findings and recommendations about the website. You can contact us to ask for explanations or to point out an error in the report.

Requesting an audit does not sign you up for a newsletter. Consent to commercial follow-up is requested separately and is optional. You can withdraw it by writing to info@ganolyk.ca or by using the unsubscribe mechanism in the message concerned.

Hosting and email services provided to our clients

When you entrust us with hosting a website or email accounts, we may process the contact details of the account holder, support requests, configurations, technical logs, and the files, databases and emails needed to provide the service.

Content hosted for a client is processed on the client’s behalf, within the mandate and the instructions agreed upon, in particular for hosting, maintenance, security and support. We do not use it to build our advertising audiences.

ganolyk administers the hosting and email services. Access to hosted data is reserved for authorized persons and limited to the needs of the service, security or a legal obligation.

Each client remains responsible for the purposes for which it collects information on its own website and for the information it provides to the people concerned. ganolyk retains its own obligations as a service provider. This policy does not replace the privacy policy of a client’s website or the terms of the hosting contract.

How the website works and form protection

Our servers may process your IP address, the date and time of access, the pages requested, and information about your browser and device. This information is used to display the website, diagnose problems, protect the services and prevent abuse.

Cookies or technical mechanisms are used in particular to protect a form session and to remember your privacy preferences. Technical data and hashed network (IP) addresses may also be used temporarily to limit abusive submissions. These mechanisms are not used for advertising targeting.

When Cloudflare Turnstile protection is active, your browser communicates with Cloudflare. This service processes the technical information needed for verification, including information about the connection, the browser and the device, to distinguish legitimate visitors from automated submissions.

Google reviews and Google Maps content

Our home page shows the rating and reviews from our Google Business Profile. This content comes from Google Maps: its use is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.

Our server requests these reviews from Google without sending any information about you, and does not keep them. To show the profile photos of the people who left a review, your browser downloads them directly from Google’s servers, which then receive your IP address and technical information about your browser, as with any image hosted elsewhere. Our website sets no cookies for this feature.

Audience measurement and advertising

With your consent for the purposes concerned, we use the following tools:

Google Analytics: measure traffic, understand journeys and interactions on the website, and improve its content.
Google Ads: measure the results of our campaigns and, depending on your choice, personalize advertising and reach people who have shown an interest in our services.
Meta pixel, for Facebook and Instagram: measure interactions and conversions related to our ads and build advertising audiences.
TikTok pixel — planned addition: once installed and subject to your consent, measure visits and conversions coming from TikTok, improve campaigns and build advertising audiences. This pixel is not in service yet.

Depending on the tool and its configuration, the information processed may include the IP address, cookie or advertising identifiers, browser and device characteristics, an approximate location, the pages viewed, where a visit came from, the time, and the interactions performed, for example a click or a submitted request.

These tools may make it possible to recognize a browser, build an interest profile or link activity to an account with the provider concerned. The reports we view may be aggregated, which does not mean that all the data collected is anonymous.

We do not send the content of forms or audit reports to advertising tools. We do not send them the names, email addresses or phone numbers collected in forms for advertising matching purposes, including in hashed form.

We do not sell your personal information. The communications to measurement and advertising partners described here are nonetheless communications of data, subject to your consent choices.

Choosing and changing your consent

The Axeptio consent manager lets you accept or refuse optional tools and choose the purposes you consent to. Measurement and advertising functions remain disabled until you have given the corresponding consent. Closing the window or continuing to browse does not count as acceptance.

You can change or withdraw your consent at any time using the “” link at the bottom of the site. Withdrawal blocks the future collection concerned; it does not automatically erase information already collected. You can contact us to ask for its deletion where the law allows.

Axeptio and the consent mechanisms process the information needed to record your preferences and prove your choice, including the choices made, their date and a technical identifier. Mechanisms needed for the website to work, for its security and to keep your preferences may remain active.

Any new partner, such as TikTok, must be presented in the consent manager before any activation that requires your consent. Consent previously given to other partners does not automatically activate this new tool.

You can also delete cookies in your browser. Doing so may erase your saved preferences and trigger a new consent request.

Who may receive information, and where is it processed?

Michael Valade and the persons authorized by ganolyk may access the information needed for their duties. Our service providers may process the information needed for their services:

Google PageSpeed Insights: technical analysis of the public pages submitted for the audit.
Perplexity: processing of the queries and public excerpts needed for the AI part of the audit.
Cloudflare: form protection when Turnstile is active.
Axeptio: management and proof of privacy preferences.
Google (Google Maps): display of our profile’s rating and reviews, and of their authors’ profile photos.
Google, Meta and, once installed, TikTok: measurement and advertising according to the consents given.

Hosting the audit application in Montréal does not mean that all processing stays in Québec. Some providers, their subcontractors or the recipients’ email services may process or store information elsewhere in Canada or abroad. Different legal rules may then apply.

Before communicating personal information outside Québec or entrusting its processing to a provider located outside Québec, we conduct the required privacy impact assessment. The communication may take place only if this assessment shows adequate protection; it is governed by a written agreement that takes the results of the assessment into account. You can ask the person in charge for details about the relevant recipients and processing locations.

We may also communicate information when the law requires or permits it, limiting the communication to what is necessary.

External websites reached through a link from our website apply their own privacy policies.

How long do we keep information?

We limit retention to the time needed for the stated purposes and applicable legal obligations.

Audit application: request records are deleted automatically no later than 90 days after they are collected. Results and PDF reports are deleted no later than 90 days after they are created.
Technical copies of forms: the temporary copies kept on the server to process a request or retry a failed send are deleted no later than 90 days after the request is received.
Email and follow-up: emails and their attachments are kept while the request is processed and for the necessary follow-ups, then deleted when they are no longer useful, subject to legal obligations and justified needs related to a dispute. Purging the audit application does not automatically delete the copies in the mailbox.
Client files and billing: the necessary documents are kept for the duration of the business relationship, then according to the applicable legal periods and justified evidentiary needs.
Content hosted for clients: the retention, post-termination recovery and deletion periods are those of the applicable contract and instructions. The 90-day rule specific to audits does not apply to all hosted websites and mailboxes.
Security logs and consent records: they are kept for as long as needed for the security of the services, to respect choices and to show that we meet our obligations.

Our retention rule requires backup copies of audit application data to meet the same 90-day deadlines, calculated from the collection or creation of the data, not from a new backup. A restore must reapply the deletions that have come due before the data is put back into use. Other backups follow the rules of the service concerned.

Cookie durations and processing periods at providers vary depending on the service and the applicable settings. The 90-day period of our application is not a guarantee covering the processing of all external providers. You can ask the person in charge for the relevant details.

Protection and confidentiality incidents

We apply protection measures suited to the sensitivity of the information, its quantity, its use and its medium. We limit internal access to the people who need it and govern the information sent to the external services described in this policy.

The person in charge oversees the practices for collection, access, retention and destruction, as well as the handling of requests and complaints. Authorized persons must respect the confidentiality of the information they can access.

No method of transmission or storage offers absolute security. If an incident occurs, we take the necessary measures to reduce the risks and prevent it from happening again. We keep a register of incidents and notify the Commission d’accès à l’information du Québec and the people concerned when there is a risk of serious injury, as required by law.

To report an incident or suspicious use of your information, write to info@ganolyk.ca.

Your rights and how complaints are handled

Subject to the conditions and exceptions provided by law, you can:

ask whether we hold personal information about you and obtain access to it;
have inaccurate, incomplete or equivocal information corrected;
withdraw your consent to a use or communication that relies on it;
ask for the deletion of information where the law allows;
ask that computerized personal information collected from you be communicated in a structured, commonly used format, when the right to portability applies;
ask, in the situations provided by law, that we cease disseminating information about you or de-index it.

The right to portability does not cover information created or inferred by our analysis, or information obtained from third parties. Eligible information you provided to us remains covered, even if it appears in a report that also contains an analysis. The law sets certain limits on portability, including in cases of serious practical difficulties. Some legal obligations may also limit a deletion request. We will explain the applicable limits to you.

Send your written request to info@ganolyk.ca, specifying the right you wish to exercise and the information concerned. We may verify your identity in a proportionate way before giving access to information. We answer access, correction and portability requests in writing within 30 days of receipt, as required by law.

Withdrawing consent may prevent us from continuing a service that requires the information concerned; we will explain the consequences. Refusing an optional use, such as advertising, does not affect access to the service requested.

To file a complaint, write to the person in charge named above, describing the situation, the relevant dates and the correction you are asking for. The person in charge examines the facts, asks for the necessary details, determines the appropriate measures and informs you of the action taken on your complaint.

You can also contact the Commission d’accès à l’information du Québec to learn about your options for recourse: www.cai.gouv.qc.ca.

Changes to this policy

We update this policy when our practices or services change. The date of the new version is shown at the beginning of the document. Every change is announced in a notice available on the website; significant changes are flagged more visibly.

If a change requires new consent, we ask for it before starting the use or communication concerned. Publishing a new policy does not replace that consent.