Privacy policy

The essentials

The site collects personal information only if you fill out one of its forms. Contact requests and requests to receive the mini-audit result by email are sent by email, are used to reply to you, and are not stored in any database. The guides subscription keeps only your email address, to write to you when a new guide comes out, until you unsubscribe. There are no tracking cookies, and no accounts outside the client area, which is reserved for clients the studio invites. Site traffic is not measured. On the public site, the cookies set remember the price currency and your answer to the offer to switch country.

The contact form

It asks for your name and email address, and lets you add your company, phone number, region, needs, a budget, a timeline and your message. When you submit it, two emails go out: one to our inbox, hello@spherix.fr, with everything you entered; the other to yours, an acknowledgment of receipt that repeats your message. Nothing else is done with it: this information is used to reply to you, not to solicit you.

The mini-audit

The sector and tasks you choose stay in your browser: the estimate is calculated on the spot, and everything disappears when you reload or leave the page. Nothing reaches us unless you ask for the result by email.

If you ask for it, the site sends your first name, your email address and your choices. The server recalculates the estimate from those choices alone, then two emails go out: the result to your inbox, and a copy to ours, so that we can follow up with you about it if you reply. You are not added to any mailing list.

The guides subscription

The “Get new guides” form asks only for your email address, and a checkbox to consent to receiving our guides. Your email address is then saved in the contact list of Resend, the provider that sends our emails, based in the United States, and an email confirms your subscription. We use it only to announce new guides: no advertising, no resale, no sharing.

Your email address is kept until you unsubscribe. To withdraw your consent, reply “unsubscribe” to any of our emails or write to privacy@spherix.ca: we will remove your address from the list. If someone subscribed you without your consent, the same reply is enough.

How these emails are routed

To send these emails, the site relies on two providers based in the United States: Vercel, which runs the site’s code, and Resend, which sends the email. Your data therefore passes through servers located outside the European Union while it is being sent. It is limited to what you enter, is kept by these providers only for the time of transmission and of their technical logs, and is protected by their contractual confidentiality commitments. Vercel and Resend are certified under the EU–U.S. Data Privacy Framework, and their data processing agreements include the European Commission’s standard contractual clauses (see “Transfers outside the European Union” below). You can always choose to write to us directly at hello@spherix.fr. For the guides subscription, however, your email address is kept by Resend, in the United States, until you unsubscribe.

We keep the emails received in our inbox for the duration of the exchange and, if you become a client, for the duration of the business relationship and the legal obligations arising from it.

What the server keeps, and for how long

To curb automated submissions, the server counts the recent submissions from each connection: no more than five per ten-minute window. It does not keep your IP address, only its hash (a string of characters calculated from it, from which it cannot be recovered), in memory and for ten minutes at most. Nothing is written to disk.

Each submission also leaves a line in the server log: the form used, the time, and whether the submission succeeded. Neither your name, nor your email address, nor your message appears in it.

Two cookies, both functional

The site sets a first cookie, named currency_choice, which contains three letters: “CAD” or “EUR”. It is used to display prices in Canadian dollars or in euros. It is set only if you switch currency with the CAD / EUR toggle in the “Language and currency” menu of the navigation bar; without it, prices are shown in the currency of the site you are visiting. This cookie is purely functional: it contains no identifier, cannot be used to recognize you from one visit to the next, and is not shared with any third party. It expires after one year. The law does not require consent for this type of cookie, which is why the site does not display a banner.

A second cookie, named market_prompt, remembers for 30 days that you answered the offer to switch country (Canadian or French site), so it is not shown again. It is set in your browser for this domain only, holds no personal data and is not used for tracking; the offer relies on your browser’s time zone and language, never on your IP address.

Previewing an unpublished page, opened from the client area’s editor by the studio staff who edit the site, sets two more cookies, __prerender_bypass and cms_preview: they live only inside the editor, no script can read them, and they expire with the preview link, at most one day after it was created. For visitors, the two cookies above are the only ones.

The site otherwise uses neither local storage nor session identifiers, except in the client area described below.

No audience measurement

The site loads no analytics tool: we do not count your visits, the pages you read or the buttons you click. To see how the site appears in Google’s results, we use Google Search Console, whose figures come from searches made on Google, not from your visit here: the site loads no Google script.

What still leaves your browser

Even without a form, some technical data leaves your browser, as on any website:

• The host’s logs. The site is hosted by Vercel, which records the technical requests needed to serve the pages: IP address, page requested, date, browser. These logs fall under Vercel and its own privacy policy. We do not use them to track you.
• Images in case studies and guides. They are served by Supabase, the service that stores the site’s content: displaying them sends it the technical data of the request (IP address, image requested, browser).
• Pages prepared for a client. The presentation pages reserved for a client, under spherix.ca/clients/ and excluded from search engines, load their fonts from Google Fonts (Google, based in the United States) and their videos or visuals from cdn.spherix.ca, served by Cloudflare, based in the United States: each receives the technical data of the request.

Everything else, fonts and other images included, is served from our own domain.

Links that lead elsewhere

The call booking button and the email link take you off the site. From that point, the terms and policy of the service concerned apply, not these.

If you write to us directly

An email sent to hello@spherix.fr arrives in our inbox and stays there for the duration of the exchange, like any email. We do not add its sender to the guides list and do not pass it on to anyone.

The client area

The studio’s clients have a private area at app.spherix.ca. Only people the studio invites can sign in: nobody signs up on their own. Signing in works through a link sent by email, with no password.

For each invited person, the area keeps their email address, the name they choose to display, the organization they belong to and their role in it, and how often they want to be told about updates. Each update (post to approve, comment, decision, message, document, report, account renewal date) leaves a record used to put together these notification emails; it is erased 90 days after it is created. Supabase, the service that handles sign-ins, also keeps a log of them (date, time, IP address) for account security.

The post approval module also keeps a record of what you do there: your comments, and each decision (approval or change request) with its date, its time and your display name (or, failing that, your email address). These decisions are the proof of approval: they appear in the statement that the studio and your organization can print, and your name stays there after your account is deleted.

Exchanges, documents and reports keep what each person puts there (messages, attachments, files) along with the sender’s name and the date. Files only open through a temporary link, valid for one minute, given to members of the organization alone. The access registry lists the organization’s accounts (service, username, person in charge, renewal date), never a password: the area refuses anything that looks like one.

The author of a message can correct or delete it for 15 minutes, not after. The area does not keep the earlier version, but a notification email already sent keeps the original text. A deleted message shows as “Message supprimé” (Message deleted) and its attachments are erased, immediately or, failing that, by the area’s daily clean-up.

Any member of the organization, like the studio, can file a message’s attachment in Documents (“Classer dans Documents”), including one sent by someone else. The file is then copied: the copy becomes a document in its own right, in the name of the person who filed it, and keeps the link to the original message. It survives the deletion of the message, and therefore the removal of the attachment by its author: only the person who filed it and the studio can remove it. A message can also cite documents already in the area: a citation is a simple reference, with no copy of the file, and the notification email gives the title of the cited document. Deleting the message erases its citations; removing a document leaves the words “Document retiré” (Document removed), with no link, in the messages that cited it. Messages, attachments, documents and citations are visible only to the organization’s members and the studio. The file of a removed document is erased in the same way; the rest follows the retention period described below.

Your organization can also keep a list of its own clients there, who have no account: name, company, email addresses, phone number, language, billing address, tax numbers and, for those who agreed to receive its commercial messages, the proof of that consent (date, source, text accepted) and the date of any withdrawal. Only the organization’s members see this list, including studio staff who belong to it; the platform’s administrators have no access to it. For this data, your organization decides how it is used, and the studio only hosts it on its behalf: its clients exercise their rights with the organization.

Each organization also has a visual identity: the images of its brand (logos, QR codes, icons, photos, patterns, maps) with their name, their category and the account that uploaded them. The studio and the organization’s owner add, replace and remove the files; all members can see them, and the logo marked as official appears in the area in place of the organization’s initials. SVG files are cleaned of any script when uploaded. These images are kept in public storage at Supabase: anyone who knows the address of one of these files can open it, without signing in. Put nothing there that you would not publish.

The Studio Kit, the area’s communication materials tool, keeps for your organization its brand guidelines (colors, fonts, logos, footer notices) and each visual: its name, the text you enter in it, its status (draft, approved, published) and the files generated. It uses the visual identity’s images without copying them; a member who uses it can add a logo or a QR code, which then joins that identity. The files are produced on Vercel, in Montreal, by a browser cut off from the network: nothing goes to any other service while they are produced. The API keys that let a tool use the kit are kept only as a hash: a key is shown only once, when it is created, and only the studio sees the list of keys.

The visuals generated by the Studio Kit are stored with Cloudflare (its R2 service), based in the United States, and served from cdn.spherix.ca: like the visual identity’s images, anyone who knows their address can open them.

If the studio builds your organization’s website with the area’s content management tool, the area keeps the site’s content (pages, blocks, published versions, settings), its images and, for each case study, the client’s name, the testimonial with its author’s name and position, and the proof of their consent (status and date): without it, the case study cannot be published. Each change records the account that made it. Only the studio uploads the images, into public storage at Supabase: anyone who knows their address can open them. Published content is public by nature; drafts, the author of changes and the proof of consent are not. The tool records no form responses.

Finally, the area keeps a log of the changes that matter: decisions on posts, documents and their citations, the access registry, members and roles, the organization’s modules and settings, its clients’ consent, the visual identity, the Studio Kit, website content, exports of its data. Each entry states who acted (display name, or failing that email address, and role), what, when, and what the fields concerned were before and after; never the content of a message or a file, nor a client’s contact details. It serves the area’s security and settles who did what in case of disagreement. Only the platform’s administrators, at the studio, and your organization’s owner, for their own organization, can read it; no one can change it. Each entry is erased 365 days after it is created, and not before: your name stays there until then, even after your account or the organization is deleted.

Your organization’s owner can download a complete copy of it at any time, from the “Mon compte” (My account) page: a .zip archive readable without the area (each list in JSON and CSV, files under their original names), contacts and log included. The studio can prepare the same archive to hand it over to you, without your clients’ contacts, and without the log outside a verified administrator session. The archive is kept nowhere: it is built on request and goes straight to the person who asked for it. Each export leaves an entry (who, when, which parts) that the owner and the studio can see, and that the log keeps.

Once you are signed in, a session cookie (whose name starts with sb-) keeps you signed in. It is sent only on the area’s pages, no script can read it, and signing out erases it. Strictly necessary for the service, it is used for nothing else.

This data is kept by Supabase, in its Montreal region, in Canada; the service is provided by Supabase Pte. Ltd., a company based in Singapore. The area’s code runs on Vercel, and its emails (sign-in links, notifications) go out through Resend, like the site’s.

It is kept for as long as your access is open. When access ends (end of the partnership, someone leaving), we delete the account within 30 days; you can also ask for this at any time at privacy@spherix.ca. Posts, comments, decisions, messages, documents, reports, contacts, the access registry, the visual identity, the Studio Kit and website content, files included, belong to the organization: they stay in its area for as long as the partnership lasts, and are deleted within 30 days after it ends, once the archive of its data and the approval statement have been handed over.

Agents

The studio’s clients can switch on agents: automations, some of them built on artificial intelligence, that handle a repetitive task inside their tools. An agent only processes the data its task needs: inquiries received through the client’s website form, their Google Business Profile (reviews, mentions, public information), their calendar, and the contacts the client provides, limited to people who have consented to receive their messages.

This data is hosted in the European Union, and the client’s contract lists the services an agent relies on. Access to the tools (Google Business Profile, calendar, inbox) is set up in the client’s name, never the studio’s.

Every message sent on the client’s behalf (review reply, follow-up, win-back, first contact) starts as a draft that a person approves before it goes out. No agent does automated outreach in Canada, and none ever contacts patients.

The client can switch an agent off at any time and receive a full export of their data. For this data, the client decides how it is used, and the studio only processes it on their behalf: the client’s own customers contact the client to exercise their rights.

Transfers outside the European Union

The studio is established in Quebec, outside the European Union, as are several of its service providers. Each transfer of your data to one of them relies on a safeguard provided for by the GDPR:

• Vercel (hosting of the site and the client area) and Resend (sending emails, the guides mailing list), based in the United States: certification under the EU–U.S. Data Privacy Framework, which the European Commission recognized as adequate on 10 July 2023, and the Commission’s standard contractual clauses in their data processing agreements.
• Cloudflare (files served from cdn.spherix.ca, including Studio Kit visuals) and Google (fonts of the pages prepared for a client), based in the United States: certification under the same framework.
• Supabase (client area data, the site’s content and its images, in its Montreal region), a service provided by Supabase Pte. Ltd., based in Singapore: the European Commission’s standard contractual clauses, in its data processing agreement.

To obtain a copy of these safeguards, write to privacy@spherix.ca. The list of certified companies is public, on dataprivacyframework.gov.

Your rights and the person in charge

The European General Data Protection Regulation (GDPR), which applies in France and the French Caribbean, and, in Quebec, where the studio is established, Law 25 give you the right to access the data held about you, to have it corrected, to have it deleted, to receive a copy of it in a structured, commonly used format, to object to its processing or ask for it to be restricted, and to withdraw your consent. In practice, we hold none other than the emails exchanged with you, forms included, what the client area keeps if you have access to it, and, if you have subscribed to the guides, your email address in the mailing list.

The data controller is Studio Spherix inc., represented by Swann Suffrin. To exercise your rights or ask a question about your data, write to privacy@spherix.ca. For any other request: hello@spherix.fr or 07 69 99 12 92. You may also file a complaint with the CNIL, the French data protection authority (cnil.fr) or, in Quebec, with the Commission d’accès à l’information (cai.gouv.qc.ca).

This page will change if the site changes

It describes the site as it is today. Any new collection (additional fields, a new list, a new tool) would make it inaccurate: it will be rewritten before the new feature goes live.