Effective November 11, 2026
This policy is about visitors to hibouai.ca. It does not cover information I process on behalf of my clients as part of their systems. That is governed by a separate agreement with the client concerned.
I am subject to Quebec Law 25 (Act respecting the protection of personal information in the private sector, as amended) and to PIPEDA federally.
What follows, and nothing else.
When you book a discovery call, Agent Hibou receives your name, your email, your phone number if you enter it, your type of business, your answer to the optional question, the time you chose, the site language and how you want the call (phone or Google Meet), along with the exact wording of the consent line shown and the time you sent the form. This information is saved in a database in Canada. It is used to set up the call: create the appointment in Roger’s calendar, send you the confirmation and reminders by email, and note your request in the prospect log. The “change or cancel” link in your confirmation email lets you move or cancel the call yourself. To limit abuse, the site also keeps a scrambled fingerprint of your IP address (never the address itself) for 24 hours.
When you write to me I receive your name, your email, your phone number if you enter it, and your message. The form goes through my automation server (n8n), which emails it to me. I use it to reply to you. Nothing else.
When you ask Nyx to call you, I receive your name, your phone number, your company name if you enter it, your industry, your email if you enter it, and the exact wording of your consent with the time you gave it. I use it to place the demo call and to contact you about it, as you agreed. The call is placed by Vapi; it is recorded and transcribed.
When you talk to Nyx from the site, your voice is sent to Vapi, the voice service behind Nyx, through Daily, which carries the audio. The call is recorded and transcribed in Vapi, and I keep the recording and transcript for 24 months.
Both forms use Cloudflare Turnstile to block bots. Turnstile loads only when you open or come near a form, and it looks at signals from your browser, including your IP address, to confirm a person is filling in the form.
My host automatically generates logs containing your IP address, your browser, the page requested and the time. This is automatic and it is used for the security and operation of the site.
When you switch language with the FR/EN button, the site remembers your choice in your browser local storage. It is not a cookie, it never leaves your device, and I cannot see it. Clear site data in your browser and it is gone.
These providers touch site visitor information, each for the task shown.
Vercel Inc.
Hosts the site. Generates the server logs described above. Receives the booking form and passes it to the database.
United States
Google LLC
The site loads its typefaces from Google Fonts, so your IP address is sent to Google when the page loads.
United States
Cloudflare, Inc.
Bot check (Turnstile) on both forms.
United States
Vapi
Nyx’s voice service: the browser call and the demo call.
United States
Daily
Carries the audio of the browser call, on Vapi’s behalf.
United States
n8n (n8n.hibouai.ca), on an OVHcloud server
My automation server: receives both forms, checks Turnstile, logs requests and starts the call or the email. For discovery calls, creates the calendar appointment, sends the emails and writes the Airtable row.
Canada (Beauharnois, Quebec)
Airtable
Log of demo call requests and their consent. Also receives one row per discovery call booked.
United States
Zoho Mail
My mailbox, where contact form messages arrive. Also sends discovery-call confirmations and reminders.
Canada
Supabase
Database where discovery-call bookings are saved.
Canada
Google LLC (Calendar and Meet)
The discovery-call appointment is created in Roger’s Google Calendar, with your name, contact details and answers. If you choose Google Meet, the call runs on that service.
United States
Your personal information may therefore be stored and processed outside Quebec, including in the United States. Law 25 requires me to tell you this plainly, which is what I am doing here.
Under Law 25 this responsibility falls to the person with the highest authority in the business, unless it is delegated in writing.
At any time you can
To exercise any of these, email me at roger@hibouai.ca. I respond within the timelines the law sets.
The Commission d’accès à l’information du Québec handles complaints about the protection of personal information. You can go to them directly without going through me.
If I change something material, the new version is posted on this page with a new effective date.