Contact stays limited
Only information entered in the form is used, for no more than 30 days, to process the request.
Privacy · Kourseo
Your data is part of the product.
This page explains the information used by the public site today, then the rules planned for the application. Every use must have a clear reason and retention period.
Read the document Last updated: August 27, 2026
Key points
The essentials, before the detail.
Every item needs a reason
Purposes, choices and retention periods must remain separate and readable.
Deletion must be verified
A request is complete only after every relevant storage system has been checked.
Scope and responsible organisation
This policy covers the current public site and the governance planned for the Kourseo application. The company is intended to be incorporated in Canada and registered in Quebec. It does not yet exist, so its legal name and privacy officer cannot be invented.
The organisation’s identity, address, privacy contact and relevant regulator will be added before production collection begins.
What the current public site does
Collection is limited to the contact form
- no user account;
- contact requests and contact details kept for no more than 30 days;
- no waiting list;
- no personal space or learning data collected on this site;
- no Kourseo advertising or analytics cookie.
The form transmits only the information you enter. It is used to process your request and does not create an account.
Data planned for the application
Account and identity
Email, authentication method, interface language and account status.
Goals and availability
Language, intended use, exam, deadline and time available.
Learning profile
Preferences, accessibility needs, evidence, errors, strategies and progress.
Voice and content
Temporary raw audio, transcripts and learning information extracted from them.
Choices and rights
Purpose-specific consent, notices seen and access or deletion requests.
Security and operation
Versions, security events, latency and minimised technical metrics.
Purposes and legal bases
Planned processing supports the course, progress measurement, continuity, security and rights requests. Product improvement and communication remain optional where consent is required.
The final policy will link every purpose to its exact legal basis under PIPEDA and Quebec’s private-sector privacy law.
Consent and AI transparency
Core learning, progress analysis, product improvement and marketing are separate choices. Optional consent can be withdrawn without changing past lawful processing.
The notice that a user is interacting with AI is required information, not a consent request. It is versioned and shown again when it changes.
Minimisation and separation
Data is classified by sensitivity. Personal, learning and sensitive information must not appear in clear text in application logs or general analytics.
Infrastructure metrics remain technical and anonymous. Secrets and cryptographic material stay in dedicated services.
Planned retention
Raw audioNo more than 7 days
Contact requestNo more than 30 days
Data export30 days after availability
Internal technical metricsUp to 400 days under the current policy
Account and learning memoryDuring service, then verified deletion on request
Service providers and transfers
Reference application data is planned for Montreal. Any communication or storage outside Quebec requires a privacy impact assessment and written agreement.
Contact requests are routed through Mailtrap, whose data is currently processed in the United States. This transfer must be assessed and contractually covered before the public form is enabled.
AI providers receive only what the task needs. The final version will name selected providers and minimisation measures.
Your rights
Depending on applicable Canadian and Quebec law, you may request information, access, correction, deletion or de-indexing, structured portability where required, withdrawal of optional consent, and access to or reset of your learning memory.
Deletion is complete only after every relevant storage location has been checked. Anonymous evidence may remain where legally required.
Official references: PIPEDA and Quebec’s Act respecting the protection of personal information in the private sector.
Security
Kourseo plans separated environments, least-privilege access, encryption, logs without clear personal data, privacy impact assessments and verified deletion. No measure removes all risk; confirmed incidents are assessed, recorded and reported as required.
Adults only
The planned service is for adults aged 18 or older. A product for children would require a separate policy, governance and safeguards.
Contact, recourse and updates
The Contact page records requests. The privacy officer’s real contact details will be published before the form is enabled publicly.
The final policy will identify the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada where relevant. Important changes will be versioned and announced.
Still have a question?