Privacy Policy

1. Identification of the Person Responsible for the Protection of Personal Information

In accordance with section 3.2 of the Act respecting the protection of personal information in the private sector of Quebec (Loi 25), the person assuming the highest authority and legal responsibility for the protection of personal information is:

• Legal representative: William Guindon
• Status: Author and submitter of citizen communication SEM-26-003 (Commission de coopération environnementale / ACEUM (Canada–United States–Mexico Agreement))
• Location: Blainville, Province of Quebec, Canada
• Web portal: https://williamguindon.me/ ↗
• Secure direct contact channel: ACCEssible via the cryptographic button at the bottom of the page or via Client-Side Nostr Secure Messaging. ↗

2. Fundamentals of Processing and Zero Profiling

The site applies the cardinal principles of Privacy by Design and Privacy by Default:

• Absolute minimization: No personal data is collected without an explicit, legitimate and proportionate purpose.
• No commercialization: Personal information is never sold, rented, exchanged, monetized or transferred to third parties for advertising or commercial purposes.
• Absence of automated decision-making: No profiling, discriminatory automated decision-making or behavioral evaluation system is implemented on this site.

3. Data Collected and Processing Methods

3.1. General navigation and strict policy of no advertising cookies (Zero-Cookie Policy)

The site does not install any advertising cookies, any cross-site trackers, any invisible pixels or any commercial retargeting scripts.

• Local display preferences: The choice of display mode (dark or light theme) is stored exclusively in the local memory of your own web browser (localStorage). This purely technical information is kept on your device, is not associated with any personal identity and is never transmitted to our servers.
• Functional translation cookie (Google Translate): The Google translation module can place a functional cookie (googtrans) in order to memorize the language chosen during your browsing session. This cookie is not advertising and is not used for profiling purposes.
• Privacy-friendly audience measurement (Umami Analytics): The site uses the open-source statistical analysis solution Umami Analytics (hosted on cloud.umami.is). Unlike invasive analysis tools, Umami works without any connection cookies (cookieless), does not collect any data allowing the identification of an individual (PII), completely anonymizes IP addresses by daily cryptographic hashing with salt, and does not track any user from one site to another. This mechanism strictly complies with the directives of the CNIL, the Loi 25 and the GDPR and does not require any intrusive consent by banner.

3.2. Voluntary correspondence and contact form

When you voluntarily communicate with William Guindon (by email or secure form), the following data may be processed:

• First and last name (as provided);
• Email address;
• Purpose and content of your message, report, interview request or civic communication.

Exclusive purpose: Respond to your correspondence, ensure civic, scientific, media or documentary monitoring related to matters of public interest processed on this site.

3.3. Absence of commercial newsletter and monitoring by free syndication (RSS / Atom feed)

In order to preserve the complete independence of the citizen approach and to eliminate any risk of exposure of personal data, this site does not manage any email newsletters and does not maintain any subscriber contact database. No mass email subcontractor (such as Brevo) is active on the site.

• Open and decentralized distribution: All citizen news, official press releases and procedural updates relating to the CCE (Commission for Environmental Cooperation) SEM-26-003 file are publicly distributed via the standardized RSS / Atom feed (feed.xml). ↗
• Zero collection and zero profiling: RSS syndication is read directly by your own reader or news aggregator, without prior registration, without transmission of contact address and without connection cookies.
• Purge of previous data: No historical mailing lists are retained or used. If you had previously expressed your interest by email, your contact details have been purged from the automated modules.

4. Secure Messaging, Client-Side Encryption and Source Protection (Nostr / NIP-59 / NIP-44)

As part of the protection of journalistic sources, whistleblowers and engaged citizens, the site integrates a cutting-edge communication module based on the decentralized Nostr (Secure Messaging) protocol governed by the following technical guarantees: ↗

• Zero-Knowledge Architecture: All cryptographic operations are executed exclusively on the client side (in the RAM of your browser) via the standardized Web Crypto API. No private keys, no clear messages and no decryption keys pass through or are hosted on williamguindon.me servers.
• Triple Cryptographic Envelope (NIP-59 Gift Wrap & NIP-17): The initial message (*Rumor*, kind 14) is encrypted and sealed (*Seal*, kind 13), then inserted into a disposable wrapper (*Gift Wrap*, kind 1059) signed by a unique random ephemeral key. Decentralized network relays cannot technically know the identity of the sender, the recipient, or the actual transmission timestamp.
• NIP-44 v2 encryption and protection against traffic analysis: The encryption combines ECDH on secp256k1 curve, HKDF-SHA256, AES-GCM 256 bits and a geometric padding algorithm, preventing any spying by analyzing the size of network packets.
• Encrypted files and attachments: Any attached document or photograph is encrypted locally in RAM in AES-GCM 256 bits before distribution. The symmetric decryption key is sealed inside the encrypted envelope NIP-59.
• Ephemerality and irreversible purge (NIP-40): The user can assign a programmable self-destruction duration to his message, ordering its definitive deletion from all network relays.
• Right to immediate deletion on the device: A complete purge button (“Erase everything from this device”) allows the user to instantly destroy their local keys in RAM memory, their caches and any trace of session.
• Total absence of obligation and full discharge: Sending an encrypted message does not confer any mandate, establishes any professional or legal relationship, and in no way commits William Guindon to respond, publish, disclose or process the transmitted elements. The sender remains solely responsible for his transmissions and the safekeeping of his private keys.

4.1. Secure Transmission of Large Files and Voluminous Folders (SwissTransfer / Infomaniak)

For sending evidentiary documents, technical archives or recordings exceeding the limit of email attachments (up to 50 GB per transfer, free and without registration), the SwissTransfer service (operated by Infomaniak Network SA in Switzerland) is recommended under the following legal and technical guarantees:

• 1. Intellectual property and rights to data: Infomaniak does not grant itself any rights to your files. The content is never analyzed, never resold, and never used to train artificial intelligence models.
• 2. Ephemerality and permanent deletion: The files are stored strictly temporarily (up to 30 days maximum at the sender's choice) and are permanently and irreversibly deleted from the servers as soon as the link expires or after downloading.
• 3. Double encryption in transit and at rest: Transfers circulate via an encrypted HTTPS / AES-GCM protocol (secure anti-interception tunnel) and benefit from double hardware and software locking at rest (LUKS and AES 256 bits). The sender can also lock access with a personalized password.
• 4. Swiss sovereignty and protective legal framework: The infrastructure is 100% Swiss, operated in Infomaniak's proprietary data centers, without any subcontracting to American hyperscalers. The data is governed by the Federal Data Protection Act (Swiss DPA) and the European GDPR. In the absence of an American parent company, the infrastructure is not subject to direct extraterritorial injunction mechanisms such as the American CLOUD Act.
• Technical transparency: Encryption keys are managed server-side to enable direct web distribution without requiring the installation of third-party software at the recipient.

5. AI Virtual Assistance Module (Cloudflare Workers & Groq)

The site provides a citizen conversational assistant to facilitate access and understanding of public environmental documentation (folder CCE SEM-26-003). The processing is governed by the following rules:

• Secure Serverless Proxy (Cloudflare Workers): Requests to the helper are routed through a serverless function (Serverless Edge Worker) running on Cloudflare's edge network. This proxy completely isolates the inference secret key, filters requests, and enforces strict guardrails without ever storing content on a persistent server.
• Transient and anonymous processing: The questions asked and a contextual extract from the public documentation are transmitted in real time by the Worker to the Groq inference engine. No user account, cookie or personal identifier is required or transmitted.
• Persistent lack of logging: The site editor does not keep any logs of conversations, any chat history or any log of prompts submitted to the assistant.
• Non-use for training: The data from your queries is in no way used by the publisher to train or refine artificial intelligence models.
• Absence of automated decision (Loi 25, art. 12.1): The assistance module is a purely informative and documentary tool. It does not render any automated decision producing legal effects or affecting in any way the persons concerned.
• Technical retention of the Groq processor: Requests passing through the Groq Inc. API are processed in RAM. In accordance with Groq's corporate policy for its API inference services, data is retained for a maximum technical period of 30 days for security and abuse detection purposes only, with no reuse for model training.
• No Advice and Disclaimer: AI responses are generated probabilistically and automatically. They do not in any way constitute a promise, legal advice, expert advice or a formal position taken by the publisher.
• Caution: Users are strongly recommended not to enter any confidential or sensitive personal information into the AI ​​chat interface.

6. Duration of Retention of Personal Information

Personal information is kept only for the period necessary to fulfill the purposes for which it was collected, in accordance with legal requirements:

• Email correspondence and citizen requests: Kept for a maximum period of 24 months from the last exchange to ensure documentary monitoring and legal obligations, unless expressly requested for early deletion.
• Technical logs and navigation without profiling: The publisher does not carry out any individualized tracking or navigation profiling. No correlation of IP addresses with any identity is made. At the level of the network infrastructure (Cloudflare, GitHub Pages), IP addresses pass through and are processed in RAM for strict reasons of security, routing and attack mitigation (legitimate security interest, art. 6.1.f GDPR / Loi 25) according to the respective policies of these hosts.

7. Data Communication, Third Party Processors and Network Infrastructure

Your personal information is not communicated to any third party, with the strict exception of technical and infrastructure providers essential to the secure, resilient and efficient operation of the website:

• Cloudflare, Inc. (Proxy inverse, CDN, Sécurité réseau & Workers) :
  Le domaine williamguindon.me est protégé et distribué via le réseau mondial de Cloudflare. À ce titre, Cloudflare agit comme mandataire inverse (Reverse Proxy) et réseau de diffusion de contenu (CDN) :
  • Security and attack mitigation: Cloudflare transiently analyzes incoming HTTP/HTTPS requests to block distributed denial-of-service (DDoS) attacks, malicious requests, and illegitimate automated bots.
  • IP address processing: Les adresses IP des visiteurs sont traitées en mémoire vive aux points de présence périphériques (edge) uniquement pour acheminer le trafic et assurer la sécurité du réseau conformément à l'intérêt légitime de sécurité (art. 6.1.f RGPD / Loi 25), sans profilage commercial ni croisement de données publicitaires.
  • Cloudflare Zero Trust (Access) : Private administration and content management routes are secured by a Zero Trust gateway requiring strong authentication (email OTP) restricted to the administrator. No account or password is required from public visitors.
  • Sécurité et conformité : Cloudflare is ISO/IEC 27001 and SOC 2 Type II certified and applies strict security standards compliant with Quebec Law 25 and GDPR requirements.
• GitHub Pages / GitHub Inc.: Hosting of source code and public static files under SOC 1 / SOC 2 certified infrastructure.
• Google LLC (Google Translation — translate.google.com / translate.googleapis.com): Optional third-party multilingual automatic translation service activated at the visitor's request. Using the selector loads translation scripts hosted by Google and passes the text to be translated.
• Cal.com, Inc. ( app.cal.com ): Optionally integrated appointment scheduling platform (press area and media contact). When the visitor interacts with the calendar, Cal.com collects the entered contact information necessary to book the interview.
• unpkg.com (CDN Content Delivery Network): One-time loading of external sub-resources (including the third-party carbon badge script licensed under GPL-3.0 with SRI integrity checking, as well as the cmaps font mapping files needed to render PDF documents).
• Umami Analytics (cloud.umami.is): Open-source audience statistics solution, without individual tracker or persistent cookie, respecting privacy and Loi 25 / GDPR directives.
• Meta Platforms, Inc. (Official Facebook page) & Google LLC (YouTube channel via youtube-nocookie.com): The site includes official broadcast windows (iframes) from Meta Platforms (Facebook page) and Google LLC (YouTube channel via youtube-nocookie.com). These windows allow direct consultation of public declarations, documentary videos and citizen interventions. Although the site editor does not retain any data relating to this consultation, these third-party platforms may process network metrics (IP addresses) and cookies in accordance with their respective privacy policies when the user interacts with these components.
• ImageKit (ImageKit India Pvt. Ltd. / ik.imagekit.io): A media content delivery network (CDN) and image and video optimization engine used to accelerate the seamless delivery of field photographs, illustrations and documents without personally identifiable profiling, tracking cookies or data resale.
• Commission de coopération environnementale (CCE / cec.org): Documentary integration and live consultation of official data and documents from the public register SEM-26-003 hosted on the institutional servers of the CCE. The loading or consultation of these documents and feeds is carried out directly with the CCE infrastructure without intermediate processing or retention of personal data by the site publisher.
• Short.io (Short.cm Inc. — Domaine court officiel wg.s.gy) :
  William Guindon utilise le domaine personnalisé officiel https://wg.s.gy/ hébergé sur la plateforme Short.io (Short.cm Inc.) à des fins de raccourcissement technique des liens :
  • Création et contrôle exclusifs : Toutes les URL courtes générées sous le domaine wg.s.gy/* sont configurées manuellement et exclusivement par William Guindon dans l'unique but de faciliter le partage et la citation des liens longs (documents d'enquête, mémoires CCE SEM-26-003, communiqués, articles et archives certifiées) sur les réseaux sociaux, documents imprimés ou communications publiques.
  • Zero trackers and transparent redirection: Links under wg.s.gy contain no advertising trackers or individual profiling and redirect directly and immediately to legitimate, secure official URLs. Only aggregate, anonymized technical metrics (click count, approximate country of origin, device type) are retained by the infrastructure to ensure proper redirection.
  • Privacy Policy du fournisseur : Les modalités de traitement d'infrastructure de Short.io sont consultables sur leur registre officiel (politique de confidentialité de Short.io ↗).
• Legal Obligation: William Guindon will only disclose personal information if expressly required to do so by a valid court order, applicable law or court of competent jurisdiction, consistent with the legal privileges and protections afforded to citizen sources, whistleblowers and public interest correspondents.

8. Rights of Data Subjects (Loi 25, PIPEDA, GDPR)

Under the legislation applicable in Quebec and international data protection standards, you have the following fundamental rights:

• Right of access: Right to request confirmation that personal information concerning you is held and to obtain a clear and intelligible copy of it.
• Right of rectification: Right to demand the correction of any inaccurate, incomplete or ambiguous personal information.
• Right to erasure (“right to be forgotten”): Right to demand the permanent deletion of your personal information when its retention is no longer justified by law.
• Right to withdraw consent: Right to withdraw your consent to the processing of your data at any time for the future.
• Right to portability: Right to receive your computerized personal information in a structured and commonly used technological format.

How to exercise your rights

To exercise any of these rights, you may send a written request to the Privacy Officer (William Guindon) using the contact details below. A reasoned response will be provided to you free of charge within a maximum period of thirty (30) days following receipt of your request, in accordance with Loi 25.

If you believe that your rights have not been respected, you have the right to contact the competent supervisory authority: the Commission d'access à l'information du Québec (CAI) (www.cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (CPVP). ↗

9. Data Security and Protection Measures

Rigorous physical, organizational and technological security measures are deployed to preserve the integrity, confidentiality and availability of your data:

• Mandatory end-to-end TLS 1.3 / HTTPS encryption protocol with enhanced HSTS (HTTP Strict Transport Security) preload policy;
• Delivery via Cloudflare secure edge network with application firewall (WAF) and active DDoS protection;
• Restrictive Content Security Policy (CSP): whitelist of authorized domains, prohibition of embedded objects (object-src 'none'), prohibition of external framing (frame-ancestors) and script-src restricted to trusted domains. Dynamic code evaluation disabled on PDF reader side ( isEvalSupported: false );
• Protection against clickjacking via HTTP headers X-Frame-Options: DENY and frame-ancestors 'none' served at the edge;
• Partitioning of hardware permissions (default deactivation of the camera, microphone, geolocation and USB devices via Permissions-Policy);
• Zero Trust protection hermetically isolates administration interfaces without local storage of master passwords.

10. Protection of Children and Minors

The site is a free access civic and scientific information platform. No personal information relating to children or minors is knowingly collected without the required consent of those with parental authority. If you become aware that a minor has transmitted personal data without authorization, please notify us immediately for immediate deletion.

11. External Links

The site offers hyperlinks to third-party official platforms and registers (Commission de coopération environnementale, ministries, media, scientific libraries). The publisher has no control over the privacy policies of these third-party sites and declines all responsibility for their respective practices.

12. Communication of Personal Information Outside of Quebec (Loi 25, art. 17)

In accordance with article 17 of the Act respecting the protection of personal information in the private sector of Quebec (amended by Loi 25), William Guindon informs you that certain personal information or technical metadata may be communicated, hosted or processed outside Quebec (notably in the United States, Switzerland and the European Union) through its infrastructure providers and specialized partners:

• United States: Cloudflare, Inc. (broadcast network, security and inference workers), GitHub Inc. (hosting public static files), Cal.com, Inc. (appointment scheduling), Short.cm Inc. (technical redirection of wg.s.gy short links), and Groq Inc. (transient inference of AI queries without long-term retention).
• Switzerland: Infomaniak Network SA (SwissTransfer platform for the optional exchange of large files).
• European Union: Umami Cloud / hosting of anonymized cookieless statistics.

Privacy Impact Assessment (PIA): In accordance with the strict requirements of section 17 of the Loi 25, a privacy impact assessment was conducted prior to the communication of information outside Quebec. This evaluation concluded that the information benefits from a level of protection equivalent to the principles enshrined in Quebec legislation, having regard to:

• The very limited sensitivity of the information processed (public browsing, ephemeral network metrics, voluntary correspondence);
• For limited and proportionate technical purposes (anti-DDoS security, rapid web distribution, document integrity);
• Contractual guarantees and proven cryptographic security measures deployed by service providers (end-to-end TLS 1.3 encryption, SOC 2 / ISO 27001 certifications, no commercial profiling policy);
• To the legal protection framework of the jurisdictions concerned.

13. Modification of the Policy

This Privacy Policy may be modified periodically to reflect legal, jurisprudential or technological developments. Any changes will be effective immediately upon posting online with an updated revision date.

14. Contact the Data Protection Officer

For any questions, requests for clarification or exercise of your legal rights: