Privacy governance policy
The rules we follow for the personal information Phidox holds, from the day it is collected to the day it is destroyed. The privacy policy says what we collect; this page says how we look after it.
Roles and responsibilities
- Jay Khelifi, person in charge of the protection of personal information, is accountable for compliance with Quebec's privacy law. They approve this policy, answer requests and complaints, keep the incident register and lead any privacy impact assessment. Contact: privacy@phidox.com.
- The operators are the only people with administrative access to user data. They use it only to run the service, check answer quality and prevent abuse, and they read only what a given task needs.
- Service providers listed in the privacy policy process data only to provide their service to us, under their contractual terms.
Collection
We collect only information needed for a purpose stated in the privacy policy, and we decide that purpose before collecting. Any new kind of collection, new purpose or new provider is added to the privacy policy before it starts.
Privacy impact assessments
Before we start a project that acquires, develops or overhauls a system involving personal information, and before personal information is communicated outside Quebec, we assess the privacy impact: the sensitivity of the information, the purpose, the safeguards, and, for transfers, the legal framework where the information will be held. The scale of the assessment matches the sensitivity and volume of the information involved.
Access and security
- Data is reachable only through server code; browsers have no direct database access.
- Administrative views are limited to the operators and require signing in.
- Passwords are handled by Firebase Authentication and are never visible to us.
- API keys are encrypted with a managed key service.
- Data is encrypted in transit and at rest.
Retention and destruction
Each kind of information has a retention period, published in the privacy policy. When it ends — or when you delete the information or your account — it is destroyed, not kept in an “anonymized” form. Usage logs and page visits are kept until the account they belong to is deleted, or until you ask us to delete them. Records of confidentiality incidents are kept for at least five years, as the law requires.
Requests
Requests to access, correct, delete, port or stop disseminating personal information go to privacy@phidox.com. We confirm the requester's identity, then answer in writing within 30 days. A refusal gives its reasons and explains how to bring the matter to the Commission d'accès à l'information.
Complaints
Anyone may complain about how Phidox handles personal information by writing to privacy@phidox.com. The person in charge acknowledges the complaint, looks into it, and replies in writing within 30 days with the outcome and any corrective step taken. If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec.
Confidentiality incidents
If personal information is accessed, used, communicated or lost without authorization, we act promptly to reduce the risk of harm and prevent it from happening again. We record every incident in a register. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people affected promptly.
Training and review
Everyone with access to user data knows this policy. We review it at least once a year, and whenever the service changes in a way that affects personal information.
Last updated 11 October 2026.