Privacy Policy
Exactly what we collect, why, for how long, and who we share it with. No jargon, no fine-print tricks.
1. Who is responsible
The site Taverne AI is operated by David Cyr, as a sole proprietor, from Montréal, Quebec, Canada.
Postal address: 2803 rue Chartres, Mascouche (Québec) J7K 4E8, Canada.
2. Privacy Officer (RPRP)
Under section 3.1 of Quebec's Act respecting the protection of personal information in the private sector (Loi 25), Taverne AI has designated a Privacy Officer.
- Privacy Officer: David Cyr
- Email: david_cyr@hotmail.fr
- Committed response delay: 30 days, in line with Loi 25
To exercise your rights or ask a privacy question, use the dedicated form: /en/contact-dpo/.
3. Categories of data collected
| Category | Data | Source |
|---|---|---|
| Identification | Email address, first name (optional) | Newsletter form, lead magnet, contact |
| Identification | Email, first name, last name, billing address | Store purchase (via Stripe) |
| Behavioural | IP address, user agent, pageviews, session duration | Google Analytics 4 (with your consent) |
| Behavioural | Affiliate link clicks | Masked links /go/ |
| Network ID | Instagram or Facebook ID, public first name | DM bot (ManyChat) if you initiate the conversation |
| Cookies | Session IDs, consent state | The site itself (essential cookies) |
4. Purposes of collection
- Direct communication: send you the newsletter, respond to your queries, deliver a free magnet you requested.
- Audience analytics: understand which pages get read, which don't, and improve content accordingly.
- Billing: process payments, issue receipts, meet accounting and tax obligations.
- Attribution: know which articles drive purchases via affiliate links, to decide which topics to expand.
- Ad retargeting (only with your explicit consent): serve relevant ads on Meta and other networks.
5. Legal basis
- Consent: analytics, marketing, newsletter signup, and any non-strictly-necessary processing.
- Contract execution: process an order, deliver a product or service you bought.
- Legal obligation: keep invoices for 6 years (Income Tax Act).
- Legitimate interest: site security, fraud prevention.
6. Recipients (data processors)
Taverne AI relies on data processors who may handle your data for the purposes described above. Each is contractually bound to respect the confidentiality of your information.
| Processor | Purpose | Country |
|---|---|---|
| Google Analytics 4 | Analytics web | États-Unis |
| Google Tag Manager | Gestion de balises | États-Unis |
| Vercel | Hébergement du site | États-Unis |
| Cloudflare | DNS et email routing | États-Unis |
| Stripe | Traitement des paiements | États-Unis |
| ConvertKit (Kit) | Infolettre et automatisations email | États-Unis |
| Supabase | Base de données et authentification | États-Unis |
| ManyChat | Bot DM Instagram et Facebook | États-Unis |
| Anthropic | Génération de contenu et chatbot | États-Unis |
7. Transfers outside Quebec
Most of our processors are based in the United States. Per section 17 of Loi 25, we have assessed that these transfers provide protection equivalent to Quebec's, notably through standard contractual clauses and each processor's confidentiality commitments.
Questions about this assessment? Email david_cyr@hotmail.fr.
8. Retention
| Data | Duration |
|---|---|
| Newsletter email | Until unsubscribe, then 12 months max |
| Analytics (GA4) | 14 months (reduced default) |
| Stripe billing data | 6 years (legal accounting obligation) |
| ManyChat IDs | 24 months after last interaction |
| Affiliate clicks | 24 months |
| Cookie consent state | 12 months |
9. Your rights
Loi 25 grants you the following rights over your personal information:
- Right of access: get a copy of the data we hold on you.
- Right of rectification: correct inaccurate data.
- Right to erasure ("right to be forgotten"): request deletion of your data.
- Right to portability: receive your data in a structured, machine-readable format.
- Right to object: refuse a specific processing.
- Right to withdraw consent: anytime, no justification needed.
10. How to exercise your rights
One door: /en/contact-dpo/. The form lets you specify the request type. We may ask for identity verification via email exchange to make sure we don't release your data to someone else.
Committed response delay: 30 days.
11. Recourse with the Quebec authority
If you believe Taverne AI fails to meet its obligations, you can file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca.
12. Changes
This policy may be updated as our stack or practices evolve. The last-updated date is shown at the bottom. For substantive changes, we'll notify newsletter subscribers by email.
Last updated · May 2, 2026