Privacy policy

Warden Labs is a brand of Merc.Camp, a Québec business registered under NEQ 1175748467.

The person responsible for the protection of personal information is Michael Doyon. Write to [email protected] with any question or request about this policy.

This policy covers the wardenlabs.ca site and the client portal at portail.wardenlabs.ca.

wardenlabs.ca has no forms. The only way to reach us from the site is a link that opens your own mail client.

When you write to us we receive your email address and whatever you chose to write. We use it to answer you, and to keep the file if an engagement follows. We do not sell it and we do not use it for bulk solicitation.

The site uses Google Analytics to count how many people visit and which pages they read. The tool sets cookies in your browser.

What it collects: pages viewed, where the visit came from, device and browser type, language, and an approximate location derived from your IP address. We see statistics only. We do not try to identify you, and we never combine this data with the client portal's.

We show no consent banner. Measurement starts when the page loads, and this policy is how we tell you.

To refuse it: Google's Analytics opt-out add-on, at tools.google.com/dlpage/gaoptout, blocks the tool on every site. Blocking third-party cookies or using a private browsing window has a comparable effect.

Google processes this data outside Québec, including in the United States. Retention is whatever is configured in Google Analytics, currently fourteen months.

The portal at portail.wardenlabs.ca is for our clients. Access is by invitation: we add your email address ourselves, there is no open signup.

• Identity: your name, your email address, and the identifier our authentication provider assigns you. This is what signs you in.
• Account: the sites we host for you, the resources allocated to them, and the plan you subscribe to.
• Billing: your name, your billing address, and your invoice history, held by our payment provider.

We never see your card number. It is entered on a payment page hosted by Stripe and held by Stripe. We receive the payment confirmation, the last four digits, and the expiry date.

We do not sell or rent your information. We entrust it to providers, each for a single function.

• Auth0, by Okta, authenticates sign-ins to the portal.
• Stripe processes payments and issues invoices.
• Google Analytics measures the public site's audience.

Our servers are our own. The sites we host and the portal's database run on our own infrastructure, in Québec.

These providers are established outside Québec and process part of the data there, including in the United States and Ireland. We will explain on request what each one receives.

• Emails: while the business relationship is active, then as our accounting obligations require.
• Portal account: while you are a client. When an engagement ends we close the access and delete the account.
• Invoices and accounting records: six years, as tax law requires.

Québec law gives you rights over the information we hold about you. Write to [email protected] and we answer within thirty days.

• Access: obtain a copy of the information we hold about you.
• Correction: have inaccurate, incomplete, or ambiguous information corrected.
• Withdrawal of consent: end a use you had consented to.
• Portability: receive your computerized information in a structured, commonly used technological format.
• De-indexing: have information stopped from being disseminated, or a hyperlink to it removed, in the cases the law provides.

If our answer does not satisfy you, you may complain to the Commission d'accès à l'information du Québec.

The site and the portal are served over HTTPS. The portal is closed behind authentication, and the list of authorized people is maintained by hand on our side. Passwords are handled by our authentication provider: we do not hold them and cannot read them.

No system is immune. If a confidentiality incident presented a risk of serious injury, we would tell you and notify the Commission d'accès à l'information, as the law requires.

We will update this policy when our tools or our practices change. The date at the top of the page is the last revision. A material change will be emailed to anyone who has a portal account.