Privacy Policy
Effective June 5, 2026
SatoLab takes the protection of your personal information seriously. This policy explains what information we collect, why, and how we protect it, in accordance with Québec's Act respecting the protection of personal information in the private sector (as amended by "Law 25").
1. Person in charge of protecting personal information
This policy is established by SatoLab. The person responsible for the protection of personal information is Erwan Jonchères, lawyer. For any question or to exercise your rights, write to us at contact@satolab.ai or at the following address: 3509 Durocher Street, Montréal, Québec.
2. Information we collect
We keep collection to a strict minimum: • Contact and resource-download forms: name, email address, company (optional), nature of your request and the content of your message. • Client data and files: the information and documents you send us as part of an engagement. • Booking: the information you enter when booking a call through the Clio Grow tool. We do not collect any information without your knowledge and do not purchase third-party lists.
3. Purposes of collection
Your information is used solely to: respond to your requests; provide our AI advisory and governance services; manage the client relationship; and meet our legal and professional obligations. Whether each item is optional or required is indicated in our forms; a refusal may prevent us from acting on your request.
4. Consent
By sending us your information, you consent to its use for the purposes described in this policy. You may withdraw your consent at any time, subject to processing already carried out and to our legal obligations.
5. Cookies and trackers
The satolab.ai site uses no advertising cookies and no advertising. To understand site traffic, we use Matomo, an audience-measurement tool hosted on our own infrastructure and configured without cookies: nothing is stored on your device, your IP address is anonymized and traffic data is shared with no third party. Only a session cookie strictly necessary for the internal administration area is used; it does not track you.
6. Disclosure to third parties
We do not sell or rent your information. We rely on a small number of providers acting on our behalf: • Clio Grow — appointment booking; • Resend — sending notification emails; • our host — secure hosting of the site and data. These providers are bound by confidentiality and security commitments and may only use your information for the intended purposes.
7. Hosting and transfers outside Québec
Your information is hosted on dedicated infrastructure located in Europe, protected by a firewall, a reverse proxy and communication encryption (TLS). Your information is therefore processed outside Québec; some providers (notably Resend, for sending emails) may also process it elsewhere, possibly in the United States. Where the law requires it, we first carry out a privacy impact assessment to ensure that the information receives adequate protection, in accordance with Law 25.
8. Retention
We keep your information for as long as necessary for the stated purposes, then for the period required by our legal and professional obligations — in particular the rules of the Québec Bar applicable to legal files. At the end of these periods, the information is securely destroyed or anonymized.
9. Security
We put in place security measures appropriate to the sensitivity of the information: communication encryption, firewall, access restricted to authorized personnel, secure credential management and logging. As no measure is infallible, we cannot guarantee absolute security, but we strive to protect your information at all times.
10. Your rights
Under Québec law, you have the right to: access the information we hold about you; have it corrected if it is inaccurate, incomplete or ambiguous; withdraw your consent; and, where applicable, receive a copy in a structured, commonly used technological format (portability). To exercise these rights, write to contact@satolab.ai with proof of identity. We will respond within a reasonable time, generally within 30 days.
11. Automated decisions
We do not make any decision concerning you based exclusively on the automated processing of your personal information.
12. Confidentiality incident
In the event of a confidentiality incident presenting a risk of serious injury, we will take reasonable measures to reduce its consequences and will notify the affected individuals as well as the Commission d'accès à l'information, in accordance with the law.
13. European Union residents
If you reside in the European Union, the General Data Protection Regulation (GDPR) may apply to certain processing. You then have the rights provided by that regulation; write to us to exercise them.
14. Complaint
If you believe we have not respected your rights, you may file a complaint with Québec's Commission d'accès à l'information (cai.gouv.qc.ca).
15. Changes
We may amend this policy to reflect changes in our practices or in the law. The current version is always published on this page.
This document provides general information and does not constitute legal advice.