Privacy policy
Last updated: January 2026.
The content of this page lives in the repository that serves this site. The repository history keeps the register of versions, and previous versions remain available there.
1. Who processes your information
The controller is 9558-3936 Québec inc., doing business as Ludolith, NEQ 1181697518, a corporation incorporated in Quebec, Canada.
In this document, "we" means that company, acting as the controller. Requests about personal information are handled under the responsibility of the person designated below. No sales department receives what you send us.
Privacy officer, in the sense of Quebec law.
- Designated person
- Responsable de la protection des renseignements personnels
- Position
- Personal Information Protection Officer
- Company
- 9558-3936 Québec inc.
[email protected]- Representative in the European Union
- No representative designated. Analysis note of 30 July 2026: the offering does not target the European market and no behavioural monitoring is carried out from the Union.
Article 27 of the General Data Protection Regulation.
2. What we collect, and how
We collect only what follows. There is no other channel.
What we never collect: phone number, postal address, file attachment, health data, biometric data, opinions, membership, precise location, information about a minor. The form has no field for any of it, and the "context" field carries this warning: do not write any personal data, any identifier or any extract of your production data here.
Your IP address is never stored in clear text. It is transformed by a keyed hash function whose key is changed every month. The resulting fingerprint is used only to limit abusive submissions. It is not used to locate you, to profile you, or to recognize you from one visit to the next.
3. Why, on what legal basis, and for how long
These durations are not declaratory. An automated task runs every day and actually deletes the rows that have reached their deadline. Its execution is logged (date, number of rows deleted, never their content) and that log is kept twelve months as evidence.
Nowhere does this page say your information is kept "as long as necessary". Every duration above is a number, and it matches what the code does.
4. Who else sees your information
Internal access: access to what you send is limited to the people who have to handle your request, under the responsibility of the person designated in section 1. No access is opened for prospecting purposes.
Providers that process information on our behalf. Each is named, with its role and its country. This list is produced from a single file in the source code: it cannot drift apart from the Security and Privacy pages without the site failing to compile. Email sent by this site, acknowledgements and notifications, is delivered through the mail infrastructure the publisher hosts itself, with no third party involved.
Anthropic is used for assisted drafting of this site's editorial content, under commercial terms providing that inputs and outputs are not used to train models. No information from the form, from an email you sent, or from a booking is ever passed to it.
What we do not do: we do not sell your information, we do not trade it, we do not share it for any targeted behavioral advertising purpose, and we use no advertising pixel, no ad network and no retargeting tool. No social network is embedded in this site.
Separation, and it is real: the list of people who use Minealyze and the QuestFable waiting list are never used to prospect for consulting work. Those are consents given for something else.
5. Where your information is processed
The information you send us is stored on servers located in Germany. It is accessed from Quebec (Canada), where the company is established.
If you reside in Quebec: your information is communicated outside Quebec, since it is hosted elsewhere and some providers are established abroad. Before each provider, a privacy impact assessment is produced and dated, and a written agreement is signed. Those assessments are not published, but they exist and can be produced.
If you reside in the European Economic Area: The information you enter on this site is collected directly from you by a company established in Quebec (Canada) and hosted in Germany. The providers named in section 4 that are established outside the European Union act under a data processing agreement carrying the European Commission's standard contractual clauses.
6. Your rights, and how to exercise them
You may request: access to your information, its correction, its deletion, portability of what you provided in a machine-readable format, restriction of or objection to its processing, withdrawal of your consent to the technical notes at any time with no effect on what has already been sent, and de-indexing or cessation of dissemination of information concerning you.
Response times. We answer within the shortest deadline applicable to you: 30 days if you reside in Quebec, one month under the European regulation, 45 days if you reside in a covered US state. If your request is complex, we write to you before the deadline to say why and by when.
Identity verification. It is asked for only if there is a reasonable doubt, it is asked once, and no identity document is kept after verification.
Cost: none.
If our answer does not satisfy you. You may complain to the Commission d'accès à l'information du Québec. If you reside in the European Economic Area, you may complain to the supervisory authority of your country of residence, for example the CNIL in France. If you reside in the United Kingdom, the Information Commissioner's Office. Going to an authority does not require writing to us first, but writing to us is almost always faster.
7. Automated decisions
There are none. Your request is not scored, ranked or sorted by a program. No artificial intelligence model reads your message. A person reads it and decides. That is slower than automated triage, and it is deliberate.
8. Minors
This site is aimed at organizations and server operators, not at players and not at consumers. We do not knowingly collect information about anyone under 16. If you find that such information has reached us, write to [email protected]: it is deleted.
9. How your information is protected
The site is served over HTTPS only, with a strict transport policy. The database is encrypted at rest by the host. Access secrets are stored as environment variables and never appear in the source code. The key used to hash IP addresses is changed every month. The form uses no third-party anti-robot test, therefore no external tracker. Abusive submissions are rate-limited server side.
What does not exist, and we would rather write it down
- No SOC 2 certification.
- No ISO certification.
- No third-party penetration test of this site.
- No continuous alerting.
- No backup restore exercise performed to date.
The Security and data page keeps that list current.
10. Incidents
We keep a confidentiality incident register. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned, and the competent European authority within 72 hours where the European regulation applies. The deadline we set ourselves to qualify an incident is 24 hours after becoming aware of it.
11. Changes to this policy
Each version carries its update date. Previous versions remain available at the bottom of this page. A change that alters a purpose, a duration or a recipient is flagged at the top of the page for 30 days.
Depending on where you reside
The three boxes below do not replace the eleven sections above. They state what your law of residence adds, and where to read it in this document.
Last updated: January 2026.
No previous version is served from this page.
This version is not available. The version in force is above.
A previous version will appear here the first time this policy is amended: it will then carry its update date and the date it was superseded.