Privacy Policy

Last updated : May 8, 2026

This Service is operated from the Province of Quebec, Canada. This Policy is governed by the Act respecting the protection of personal information in the private sector (Loi 25, S.Q. 2021, c. 25). For users outside Quebec, equivalents under PIPEDA, GDPR, and the CCPA are summarized in section 7.

Moelleux is operated by Horizon-Cumulus (9322-8310 Québec inc.), a Quebec corporation based in Joliette. This Policy informs you of the Personal Information we collect about you when you use the Service at https://moelleux.ca, the purposes for which we process it, the subprocessors with whom we share it, and the rights you may exercise.

This Policy applies to administrator-users of the Service (PME and agency operators subscribed to Moelleux). Visitors to our customers' websites are covered by each customer's own privacy policy; with respect to those visitors, Moelleux acts as a processor within the meaning of Section 18 of Loi 25.

1. Controller Identity

The controller of Personal Information collected through :app_name is Horizon-Cumulus, operated by 9322-8310 Québec inc., a corporation incorporated under the Quebec Business Corporations Act, with its head office in Joliette, Québec, Canada.

Horizon-Cumulus is subject to Loi 25. For any question relating to this Policy or to exercise your rights, you may write to the Privacy Officer at confidentialite@horizon-cumulus.com.

2. Personal Information We Collect

We apply the data minimization principle set out in Article 12 of Loi 25 — we collect only the information strictly necessary to provide the Service. The list below is exhaustive.

Categories of information processed:

Account information: email address (mandatory for authentication and transactional communications), name (optional, used for WHMCS billing), irreversibly hashed password — we never see it in plain text. Language preference and last login timestamp.
Information related to the websites you entrust to us: site URL, subscription plan, technical identifiers (site key, WHMCS service ID), automated scan results (third-party scripts and cookies detected).
Questionnaire responses: industry sector, the types of collection your website performs (newsletter, e-commerce, HR), the name of the person you designate as responsible, legal company name.
Aggregated consent logs: as a processor for your visitors, we retain consent logs in which the IP address is partially anonymized (last IPv4 octet removed) and an opaque session hash prevents duplicates without enabling re-identification. No visitor is identified by name.
Transactional and support communications: emails exchanged with our team (verification, billing, support), support ticket identifiers. No automatic marketing list — you are added to a newsletter only with your explicit opt-in.
Billing information: WHMCS client identifier and active plan only. No credit card information is processed by Moelleux — Moneris (subprocessor) tokenizes payments and we only see the transaction reference.

What we do NOT collect

As a Loi 25 compliance provider, we apply to ourselves the same data minimization we recommend to our clients. This section explicitly lists what falls outside our processing scope.

No personally identifiable information about the visitors of our clients' websites. The consent logs (`consent_logs`) are anonymized at write time: only the truncated IP address (last IPv4 octet removed) is retained for regional aggregation, and an opaque session hash prevents duplicates without enabling re-identification. We act as a sub-processor within the meaning of Section 18 of Loi 25 for these logs.
No sensitive-category information (health, biometric, genetic, religion, political opinions, sexual life, ethnic origin). Our Service is not designed to handle these categories and no feature invites their entry.
No advertising cookies or behavioural tracking on https://moelleux.ca. No integration with third-party audience measurement tools (Meta Pixel, TikTok Pixel, Hotjar, LinkedIn Insight Tag, or equivalent). Our site applies to itself the standards it helps its customers meet.
No sale, rental, or exchange of your personal information with third parties, for any commercial purpose whatsoever. Period. The only communications to third parties are those strictly necessary to provide the Service, listed in section 4 (subprocessors).

3. Purposes of Processing

Your Personal Information is processed exclusively for the following purposes:

To provide and maintain the Service: account creation and management, automated generation of privacy policies for your own visitors, hosting of the embedded consent banner on your websites.
To process your subscription and issue corresponding invoices through our WHMCS billing portal and our payment processor Moneris.
To provide technical support, respond to your requests, and send you essential service notices (incidents, major changes, subscription expiry).
To detect, prevent, and resolve security incidents, abuse, and fraud; to ensure legal compliance and legal defence where required.
To produce aggregated statistics on Service usage in order to improve it. No individual data is used for profiling.

4. Third Parties and Subprocessors

In accordance with Section 18 of Loi 25, we share certain Personal Information with subprocessors that help us provide the Service. Each subprocessor is bound by contract and held to confidentiality obligations at least equivalent to ours.

Subprocessor	Role	Location
Anthropic, PBC	Automated generation of privacy policies via artificial intelligence (Claude models)	United States
BunnyCDN (BunnyWay d.o.o.)	Content delivery network and file storage (published policies, CSV exports)	Slovenia (head office) with servers in the United States and Europe
Moneris Solutions	Credit card payment processing, through the WHMCS portal	Canada
OVH (OVH Hosting Inc.)	Primary hosting of the database, application servers, and Service email	Beauharnois, Québec, Canada
WHMCS via Horizon-Cumulus	Customer portal, billing management, and single sign-on (SSO) into the Service	Canada
Crisp Chat (Crisp IM SAS)	Customer support chat service, when enabled on the Service	France

The Crisp chat service is activated only when you interact with it. If you prefer not to use it, write to us instead at confidentialite@horizon-cumulus.com.

We perform due diligence on each subprocessor and update this list when our supplier composition changes.

5. Cross-border Transfers (Article 17)

In accordance with Article 17 of Loi 25, we inform you that certain Personal Information is transferred outside Quebec. These transfers are subject to contractual safeguards and limited to what is necessary for the provision of the Service.

Anthropic, PBC (United States) receives the questionnaire content and the normalized scan result of your website in order to generate the privacy policy. The transfer is governed by Anthropic's terms of service, which prohibit the training of models on customer data. You may write to us to obtain a copy of the relevant commitments.

BunnyCDN (BunnyWay d.o.o., Slovenia, with servers in Europe and the United States) receives public files (published policies, banner scripts) in order to accelerate their delivery. No account information is transmitted to BunnyCDN. The transfer is governed by contractual safeguards under BunnyWay d.o.o.'s terms of service.

Before onboarding any new subprocessor outside Quebec, we assess the sensitivity of the information shared and the robustness of the contractual commitments offered. You may write to the Privacy Officer to obtain a summary of this assessment.

6. Retention Periods

We retain your Personal Information only for the time necessary to fulfil the purposes described in section 3, plus any applicable legal retention periods.

Account information: retained as long as your subscription is active. Deleted or anonymized within 90 days of termination, unless a legal obligation requires longer retention.
Billing information: retained for seven (7) years from the last transaction, in accordance with Canadian tax obligations.
Consent logs: retained for thirteen (13) months (consent validity period). The IP address is anonymized at log write time (last IPv4 octet removed).
Support communications: retained for twenty-four (24) months to ensure service continuity.
Technical logs (access, errors, security): retained for at most ninety (90) days, unless an incident investigation requires otherwise.

7. Your Rights

Loi 25 grants you several rights with respect to your Personal Information. You may exercise these rights at any time by writing to the Privacy Officer.

Right of access: obtain a copy of the Personal Information we hold about you.
Right of rectification: have inaccurate, incomplete, or ambiguous information corrected.
Right to withdraw consent: withdraw at any time consent previously given.
Right to de-indexation: request the cessation of dissemination or the de-indexation of a hyperlink providing access to information about you, under the conditions provided by Loi 25.
Right to data portability: receive, in a structured and commonly used technological format, the computerized information you have provided to us.
Right to object: object to the processing of your Personal Information when processing is not required to perform the contract.

If you reside elsewhere in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) grants you equivalent rights and allows you to file a complaint with the Office of the Privacy Commissioner of Canada.

If you reside in the European Economic Area, the General Data Protection Regulation (GDPR) grants you equivalent rights (access, rectification, erasure, restriction, portability, objection) and allows you to lodge a complaint with the supervisory authority of your country of residence.

If you reside in California, the California Consumer Privacy Act (CCPA / CPRA) grants you, in particular, the rights to know, delete, correct, and refuse the sale or sharing of your Personal Information.

To exercise a right, write to confidentialite@horizon-cumulus.com specifying the nature of your request. We will respond within thirty (30) days. We may ask you to confirm your identity before processing the request.

If you believe we have not properly responded to your request, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) by visiting cai.gouv.qc.ca.

8. Designated Privacy Officer

In accordance with Section 3.1 of Loi 25, Horizon-Cumulus has designated a Privacy Officer (Responsable de la protection des renseignements personnels — RPRP). You may reach the Privacy Officer by email at confidentialite@horizon-cumulus.com or by mail at Horizon-Cumulus, Attn: Privacy Officer, Joliette, Québec, Canada.

The Privacy Officer ensures the application of this Policy, handles requests to exercise rights, oversees privacy impact assessments, and coordinates the response to confidentiality incidents.

9. Effective Date and Versioning

This Policy takes effect on the date indicated at the top of the document. We may update it to reflect changes to the Service, our subprocessors, or the applicable legal framework.

Any material change will be announced by email to the address associated with your account at least thirty (30) days before its effective date. Prior versions are retained and may be obtained on request from the Privacy Officer.

Cookies

Moelleux uses cookies strictly necessary for the operation of the Service (session authentication, interface preferences, anti-CSRF token). No third-party analytics cookies, nor advertising tools, are placed on https://moelleux.ca.

For your own websites, Moelleux provides a consent banner that your visitors can configure. Cookies placed on our customers' websites are governed by each customer's own privacy policy.

Protection of Minors

The Service is not directed to persons under the age of 14 years. In accordance with Section 4.1 of Loi 25, consent to the collection, use, and communication of Personal Information of a minor under 14 years must be given by the holder of parental authority or by the tutor. If you believe that a minor under 14 years has provided us with Personal Information without such authorization, write to us at confidentialite@horizon-cumulus.com and we will proceed with deletion of the data concerned.

Security

We implement reasonable technical and organizational measures to protect your Personal Information against loss, unauthorized access, disclosure, alteration, or destruction.

These measures include in particular TLS encryption of communications in transit, the principle of least privilege for system access, logging of administrator access, environment separation, regular updates of software components, and daily data backups. No system is entirely infallible; in the event of an incident likely to cause serious harm, we will inform you and notify the Commission d'accès à l'information in accordance with Loi 25.

Contact — Privacy Officer

For any question, complaint, or request to exercise rights, write to the Horizon-Cumulus Privacy Officer at confidentialite@horizon-cumulus.com. You may also write to us by mail at: Horizon-Cumulus, Attn: Privacy Officer, Joliette, Québec, Canada.

Commission d'accès à l'information du Québec

The competent supervisory authority for Quebec is the Commission d'accès à l'information (CAI). You may consult its resources and file a complaint on its official website: cai.gouv.qc.ca.