Levier · ASGO
Privacy policy
In force since: September 6, 2026. Last updated: September 15, 2026.
The version in force is the one published at this address; every change is dated here. This English page is a translation: the French version is the original, and it prevails in case of discrepancy.
1. Who is responsible
Levier is operated by BORÉAL.IA inc. (ASGO brand), whose head office is in Quebec City.
The person responsible for the protection of personal information can be reached at confidentialite@asgo-ia.ca.
2. What is collected
The principle is minimization: an account is an email address.
- Business profile (registration date, city, industry, revenue, headcount, answers to the scan questions): evaluated by our servers on every request, never kept by them. It stays in your browser, so that the radar can pick up where your last scan left off. You can erase it by clearing the site's data.
- Contact details: the email address, at sign-in or at checkout.
- Subscription: the customer identifier and the state of the subscription at Stripe, the plan, the period dates. No card is kept by us.
- Technical data: the open sessions; an irreversible fingerprint of the IP address, used for quotas (abuse protection) and erased after 7 days; a log of account actions (sign-in, payment, deletion).
- Our own audience measurement. We count the people who arrive, those who run the scan, those who hit a locked card, those who look at the plans and those who open the checkout — that is all. Technically: a pseudonym derived from your network address (hashed with a secret key, then truncated), which cannot be turned back into the address and does not survive the day — two days from the same address produce two pseudonyms that cannot be linked, not even by us. The referral is reduced to the NAME of the originating site, never the full address of the page, which may carry personal information. The content of the scan never enters this measurement: we count that a scan happened, never what it said. These rows are erased automatically after 90 days. No third-party analytics — no Google Analytics, no advertising pixel.
- The button that led to the payment, attached to the subscription itself, so we know what makes people subscribe. It is an attribute of the contract, not a browsing profile: nothing is written on your device, and whoever does not pay leaves nothing behind.
- If you have an account, two more things, and they are attached to the account — not to a pseudonym. First, the channel the account came from (the name of the channel and, where applicable, the code of the post): written once, at creation, never rewritten, and kept for as long as the account — it is what tells us which channel keeps the product alive. Second, for a subscribed account, the days on which it used the product: the date alone, never the time of day, never the page visited, never what was searched for — erased after 90 days. That figure answers one question only: a subscription that goes unused will not be renewed, and we would rather see it before the renewal date than in a cancellation email.
3. Purposes
- Assess the business's eligibility for the public funding programs listed.
- Open and hold the user's session (single-use sign-in code, good for 10 minutes).
- Manage the subscription, including billing and renewal.
- Send, with express consent, the alerts tied to the programs being followed (coming).
4. Consent and communications
Service emails (sign-in code, welcome after payment, invoices) follow from the contractual relationship. Anything else — a scan summary, program alerts — rests on express consent, in keeping with Canada's anti-spam legislation, with the ability to unsubscribe at any time through the link in every email or by writing to the address above.
5. Retention
| Information | Kept for |
|---|
| Email address and account | As long as the account exists — see section 8 for what deletion erases, and what it leaves |
| Business profile | Not kept by our servers |
| Sign-in code | 10 minutes, single use |
| Session | 30 days, or until you sign out |
| IP address fingerprint (quotas) | 7 days |
| Audience measurement rows (pseudonym of the day, arrival channel, step reached) | 90 days, then erased automatically |
| First-visit origin cookie | 90 days, in your browser |
| Days on which a subscribed account used the product (the date alone) | 90 days, then erased automatically |
| Channel an account came from (written at creation, never rewritten) | For as long as the account |
| Subscription and billing records | The legal retention period for accounting records, even after the account is deleted |
6. Hosting
The servers that process and store the information are hosted at OVH, in Quebec (Beauharnois), and operated by BORÉAL.IA inc.
7. Subprocessors
Five subprocessors are involved, each for one precise task:
- Stripe — processing payments and billing the subscription (the email address, the card and the billing address are given to it at checkout; Stripe handles them under its own policy, outside Quebec).
- Resend — sending transactional emails (sign-in code, welcome). The email address and the content of the message pass through its servers, located outside Quebec.
- Google and Microsoft — only if you choose “Continue with Google” or “Continue with Microsoft” on the sign-in page. The provider confirms your email address and a stable identifier for your account with it; we receive neither a password nor any content from your account, and we send it nothing from your profile. These services are operated outside Quebec, under their own policies.
- OVH — hosting of the servers, in Quebec.
No third-party audience analytics, no ad network, no typeface or library loaded from an outside server — with one exception: the sign-in page loads Google's sign-in button, from Google's servers, when that door is offered.
8. Your rights
Anyone may ask for access to their personal information, for it to be corrected, withdrawn or ported, by writing to the person responsible named above. Deleting the account takes no request at all: it is done from the account page.
What that deletion does, exactly: access stops at once, open sessions are revoked and pending sign-in codes are erased. What it leaves, and why: your email address stays attached to the closed account, because the subscription's accounting records refer to it and tax law requires keeping them; the account's arrival channel also remains. To have these erased, write to the person responsible named above — ASGO acts within 30 days, except for accounting records the law requires us to keep.
9. Privacy incident
Any incident that presents a risk of serious injury to a person concerned is handled in keeping with Quebec's Law 25: entry in the register of incidents, notice to the Commission d'accès à l'information du Québec and to the persons concerned where required.
10. Cookies
Three cookies, all set by us, all first-party, none for advertising, none tracking you from one site to another:
- The session, which keeps you signed in. Unreadable by scripts, erased when you sign out.
- The first-visit origin, set for 90 days. It remembers which channel brought you here — the name of the channel and, where applicable, the code of the post that sent you (an identifier of the post, never of you) — so that our audience measurement credits visits to the right place. It carries NO visitor identifier: its value is shared by thousands of people, and it makes it possible neither to recognize you nor to follow you elsewhere. It is never rewritten: it is your FIRST visit that counts.
- A security cookie, short-lived, set during a sign-in with Google or Microsoft to check that the answer received matches the request that left this page.
The display theme and the scan profile are kept in your browser's local storage, never read by our servers.
You can block or erase these cookies in your browser's settings: the site keeps working without them — only signing in to an account needs the session cookie. The audience measurement simply fails in silence and blocks nothing.
BORÉAL.IA inc. — ASGO brand.