Privacy notice

1. Who is responsible

The site is operated by 16555985 Canada Inc. (the operator), as a personal project offered free of charge. The person who answers for the protection of personal information holds the title "Person in charge of the protection of personal information". For any question, or to see, correct or delete information: hello@circulairesquebec.com. A written answer is given within 30 days.

2. What is collected, and why

Visiting the site

Every page opened is counted: the page path (without its parameters), the response code, the language, the kind of device, the site the visit came from, the utm_source parameter, the country (supplied by Cloudflare) and whether the person is signed in. A tag computed from the IP address, the browser, the day and a secret makes it possible to count the visitors of one day; it changes every day and cannot be used to follow a person from one day to the next. The IP address itself is not saved in these counts. Purpose: to know what is used and to fix errors. The server's technical log (errors and refused access) may contain a page path, without its parameters, and no IP address; it is kept 30 days. Google Analytics also receives information about each visit (see "Who receives the information").

Having an account

The email, the password (kept as an encrypted fingerprint, never in clear), the name (optional), the version of the terms of use accepted and the date of acceptance, the day of the last visit (once a day at most), the preferred stores (up to 20), the postal code (the full code that was entered), the dietary preferences (vegetarian, vegan, lactose-free, gluten-free, keto, halal) and the dates the account was created and updated. Dietary preferences can reveal a religious belief or a health condition: they are used only to suggest recipe ideas, are saved only if the person chooses them, and can be removed at any time. The meal preferences (number of adults and children, suppers per week, longest cooking time, budget per serving and words to avoid, such as “peanuts”) are saved only if the person gives them and can be removed at any time; the words to avoid can reveal a health condition and are used only to choose the recipes of a meal plan. Purpose: to run the account and to find the list again on several devices. A Circulaires Québec account also works on Samoto (samoto.app): it is the same account, with the same email and password, and the list, the products followed and the recipes follow the person from one site to the other. These sites all belong to 16555985 Canada Inc., which keeps this information in a single database.

Using the list, followed products and recipes

The shopping list (in the browser and, with an account, on the server), the history of actions on the list (additions, removals), the recipes opened, the followed products, the postponed suggestions and the origin reports (the account's email and a free text of at most 500 characters). Without an account, the same history is tied to an anonymous identifier kept in the browser. The list's suggestions rely on the person's own actions on their list over the last 12 weeks; they cannot be turned off for now. History copied from other devices stays tied to those devices' anonymous identifier.

Planning my meals

The week's plan is saved with the account: the suppers placed on each day, with a copy of each recipe as it was when it was chosen (title, ingredients, prices), the recipes the person removed and the cost summary. The 8 most recent weeks are kept; older ones are removed when a new plan is made. The plan is chosen from the recipes on the site, with no AI provider. Only the "A recipe written for me" choice (under Replace or Add a supper) has a recipe written by DeepSeek, an artificial-intelligence service (see "Who receives the information"): the request contains the deals of the plan's store, the number of portions, the dietary preferences, the words to avoid (which may reveal a health condition), the longest cooking time and the titles of the plan's other suppers, never the email, the name or the postal code. The written recipe is kept in the plan, like the other suppers; the AI-call ledger keeps neither its text nor the account, and a counter without text limits how many recipes are written per week. A recipe written by AI can contain errors. Purpose: to find the plan again from one week to the next and to send its ingredients to the list.

Scanning a receipt

A signed-in person can photograph a grocery receipt; the photo is sent to DeepSeek, which reads it (or, when DeepSeek does not answer, read on the operator's computer), then deleted: the site does not keep it. During the pilot, the operator's and the review team's own photos are kept for 30 days to improve the reader. When the receipt is saved, the site keeps what it says (the store, the date, the lines, the totals and the text read, without card or loyalty numbers) and uses it to improve its prices, its suggestions and the site itself. The text of the product lines is also sent to DeepSeek to recognise the products (see "Who receives the information"). A receipt or a line can be deleted at any time from the "My receipts" page. The dictionary that links the texts printed on receipts to products holds no account identifier (it keeps the text, the product and the number of accounts that agree), so it stays after an account is erased.

Using the chat (Le Commis)

The text typed is sent to DeepSeek, an artificial-intelligence service, to get an answer (see "Who receives the information"). The site does not save that text, unless the person presses 👍/👎 (the question, up to 2,000 characters, and the answer, up to 4,000, are then kept) or Share (the conversation, up to 60 messages, becomes a public page available at its link). Counters without text and a tag that changes every day (derived from the IP address, without allowing it to be recovered) are kept. A photo or PDF of a recipe is read on the operator's computer (text recognition), the file is deleted at once, and only the text read is then sent as a chat message. It is advisable not to write personal information in the chat; answers are generated by AI and can contain errors.

3. Cookies and browser storage

The site sets the following cookies. Cloudflare may also set its own technical security cookies.

The site also writes to the browser's storage (it stays on the device and is sent to the site only where this notice says so):

4. Who receives the information

No information is sold. The site relies on outside providers. They process some information for the site under their own terms, which the site does not control; the site remains responsible for the information it entrusts to them. Some are outside Québec, and DeepSeek is in China.

• Cloudflare (can be outside Québec) — All of the site's traffic goes through its network: IP address, cookies, form and chat contents, in transit.
• Google Analytics (can be outside Québec) — Every page opened (full address, including the area part of the postal code or the words searched for when they are in the address), the IP address and browser as Google sees them, and these actions: viewing a product, adding to the list (product, store, price), sharing, clicking a link, searching the recipe library (the text searched for is sent). No choice is offered; Google applies its own rules.
• DeepSeek (can be outside Québec) — The text typed in the chat (up to 6,000 characters), the last 20 exchanges, the text of a recipe pasted or read from a link or file, and search results. No account, account email or IP address. Emails, postal codes, phone numbers and long numbers written in the message are removed before it is sent (names and the rest of the text are not). Its servers are in China; its policy says the text may be used to improve its models, with no fixed retention period, and may be given to authorities. When a person scans a receipt, the photo of the receipt is also sent to it to be read, then the receipt's product lines as text (what was bought and the price paid) and the name of the banner, to be matched with known products; card, loyalty and phone numbers, emails and postal codes are removed from that text first.
• Flipp, Loblaw, Metro, Open Food Facts… (can be outside Québec) — Product photos come from these sites: the person's IP address and browser are visible to them when a photo is shown.
• Hébergement — The site runs on a computer of the operator, behind Cloudflare. Database backup copies are kept by the operator, on its own disks or on a development server shared with a partner.
• Resend (can be outside Québec) — When a person asks for a new password, the account's email and the single-use link are passed to this email-sending service, in the United States, which sends the message.
• Courrier (can be outside Québec) — The provider of the contact address's mailbox receives what a person writes to that address.
• Outils d'IA de l'exploitant (can be outside Québec) — The operator uses artificial-intelligence tools to maintain the site; these tools can read logs and extracts of the database, including account information.

5. How long information is kept

• Page counts are deleted after 30 days.
• Recipe openings (with the day tag) are deleted after 90 days.
• A request for a new password (when, and a fingerprint of the link sent, never the link itself) is deleted after 1 day. The link works once, for one hour.
• A recipe the AI could not write for an account (a failed attempt) is deleted after 7 days. A recipe that was written is kept in "My recipes" until the person removes it; it is then deleted too.
• Meal plans are kept while the account exists, for 8 weeks at most; the oldest are removed when a new plan is made.
• Receipts scanned and saved in "My receipts" (the store, the date, the lines, the totals and the text read, without the photo) are kept while the account exists. The person can delete a line or a receipt at any time; they are also deleted with the account.
• During the "My receipts" pilot, the receipt photos of the operator and of the review team (never anyone else's) are kept for 30 days on the operator's computer, outside the database, then deleted by the Thursday morning clean-up.
• Chat counters (without the text) and AI call records (without the text) are deleted after 90 days.
• The assistant's usage counters (messages, recipes, plans and receipts scanned per day and per week, and their estimated cost, without any text) are deleted 90 days after the last use.
• A shared conversation stays available at its link for 365 days, then is deleted.
• Chat records carry a tag that changes every day (computed from the IP address, the browser, the day and a secret): it cannot be used to recover the address or to follow a person from one day to the next.
• No stable fingerprint of an IP address is kept in the chat.
• The text of a conversation is not saved. For 30 minutes the server's memory keeps the most recent exchanges so the operator can fix an error; nothing is written to disk, and a restart erases them.
• A question and answer sent with 👍/👎 are deleted after 90 days.
• The account and everything it owns are kept while the account exists. On written request to the address above, they are deleted (the operator erases them by hand, within 30 days at the latest).
• The "Profile" page also lets a person download a copy of the data or delete the account at once, with no delay.
• An account with no visit for 12 months is deleted. The site sends no email: no warning is possible.
• Rows of the list history without an account (tied to the browser's anonymous identifier) are deleted when they are more than 6 months old (cleaned every Thursday morning).
• The email and text of an origin report are removed once it is handled, or after 12 months.
• The operator makes backup copies of the database. They are replaced over time; the aim is not to keep them more than 30 days.
• The server's technical log (errors) is kept 30 days; it no longer contains address parameters or IP addresses.
• When an account is deleted, its internal identifier (a code with no email or name) is kept 60 days, so that restoring a backup copy does not bring the account back.
• The review team's trail (who answered, merged or corrected) is kept while the person works on the site. On request, their email in it is replaced by a pseudonym.

6. Rights and how to use them

Anyone can ask to see the information kept about them, to get a copy in a structured format, to have it corrected or deleted, and to withdraw a consent given. The name, postal code, dietary preferences and stores are corrected on the "Profile" page. A copy of the data (a JSON file) and immediate deletion of the account are also done on that page; the password is asked, and the site team's accounts are deleted by email. The rest is requested in writing at hello@circulairesquebec.com, from the account's email address (this is how identity is confirmed: the site does not verify addresses at sign-up). A forgotten password is changed with "Forgot your password?" on the sign-in page: a link, valid for one hour and only once, is sent to the account's email. A written answer is given within 30 days. A person who is not satisfied can contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

7. Security and incidents

Passwords are kept as an encrypted fingerprint. The sign-in cookie cannot be read by the page's scripts, and the site is served only over a secure connection (HTTPS). In a confidentiality incident, the operator assesses the risk; if there is a risk of serious injury, it notifies the Commission d'accès à l'information and the persons concerned (by email, by hand, from the contact address) and records the incident in a register kept for 5 years.

8. Review team

A few people help check the site's data. Their email is kept with what they answered, merged or corrected, so the work can be traced. These people have the same rights as anyone else, at the same address.

9. Children under 14

The site is not meant for children under 14. A person under 14 should not create an account without the agreement of a parent or guardian.

10. Changes to this notice

The version in force is the one on this page, with its date. It describes what the site really does: a rule that is planned but not yet applied does not appear here as if it were.