DRAFT — not yet reviewed by counsel. The technical measures described here are implemented in the code. The legal wording still needs review under the GDPR, Quebec Law 25, PIPEDA and the CCPA/CPRA.
Privacy notice
Controller: Quantum Simulations Inc. · Person responsible for the protection of personal information: Thierry Warin, PhD, privacy@mondo.international
That address reaches a person, not a queue. Requests to export, correct or delete your data can go straight to it, and the tools on the rights page do the same job without waiting for a reply.
What we collect, and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Email, password hash | Account and sign-in | Contract | Until you delete the account |
| Name, organisation, country (optional) | Attribution and applying the right privacy regime | Contract | Until you delete the account |
| Declared use type | Deciding which licences you may accept | Legal obligation and legitimate interest | Kept with the acceptance record |
| Licence acceptances | Proving lawful distribution of provider data | Legal obligation | Kept after account deletion, unlinked from your identity |
| API key metadata and call counts | Quotas, abuse prevention | Contract, legitimate interest | Rolling 30-day counters |
| Hashed IP and user agent | Security and audit | Legitimate interest | 730 days |
| Page ratings | Knowing which answers land and which do not | Legitimate interest | Kept as counts; the daily identifier is not retained in usable form |
| Consent records | Showing what you agreed to and when | Legal obligation | Kept as evidence of consent |
What we deliberately do not do
- We do not store raw IP addresses or user agents. Both are kept only as keyed hashes, which cannot be reversed into an address.
- We set no analytics or advertising cookie unless you switch it on. There is no third-party tracker on this site.
- We do not sell or share personal information, in the CCPA/CPRA sense of those words.
- We do not profile you and we make no automated decisions about you.
- The rating buttons at the foot of an answer take no account and offer no comment box. What is stored is the verdict, optionally which part of the page helped, and the language you read it in.
- To stop one person voting forty times, a rating is stamped with a keyed hash of your address salted with both the page and the date. Because the salt changes daily and differs per page, two ratings cannot be joined into one reader — not by us, and not by anyone holding the whole table.
Cookies
One essential cookie keeps you signed in. Preference and analytics cookies are optional, off by default, and controlled from the cookie settings page. Your choice is stored with a version number, so if the policy changes we ask again rather than assuming.
Your rights
Wherever you are, you can use the same tools: export everything we hold about you as JSON, correct it, or delete your account. Under the GDPR and Quebec Law 25 you also have rights to restriction, objection and portability, and the right to complain to a supervisory authority — the CAI in Quebec, your national authority in the EU. California residents have the rights to know, delete, correct and opt out of sale or sharing; we do not sell or share, so there is nothing to opt out of.
Erasure keeps one thing: the record that some account accepted a given licence version on a given date, with your identity removed. We are obliged to be able to show that data left the platform lawfully.
Exercise a right Export my data
Where the data is held
The servers are in Montreal, Quebec, and the platform is hosted at CIRANO. Personal data collected here — your account, your licence acceptances, the hashed IP in the audit log — is stored in Quebec and is not moved out of it for hosting, backup or administration.