Privacy policy

Published: July 19, 2026 · Last updated: August 5, 2026.

1. Scope of this policy

This policy applies to the public Aplomb website, to the contact form it offers and to the emails you choose to send us. The website remains an informational site: there is no account creation, no payment, no audience analytics tool and no marketing cookie. The contact form is a voluntary channel that you use only if you decide to reach out to us.

2. Privacy Officer

The person who holds this role at Aplomb is designated as the “Privacy Officer”. Any privacy request — a question, an access or correction request, or a complaint — must be sent to contact@aplombcx.com.

3. Information processed

When you visit the website, Cloudflare Pages, our hosting provider, may process technical data required for hosting, security and delivery, including the IP address, the date and time of the request, the requested resource and technical information about the browser.

When you use the contact form, we collect the information you enter in it: your name (required), your email address (required), the reason for your inquiry (required), your message (required) and, optionally, your organization’s name. The form does not ask for a role, phone number, website or attachment. Your submission is received by Cloudflare, checked against abuse by Cloudflare Turnstile, written to a Cloudflare D1 database controlled by Aplomb before any email is sent, then delivered to our primary mailbox and copied privately to a distinct backup mailbox through an email-sending service (see sections 6 and 7). The backup copy keeps an inquiry visible to Aplomb even if the primary mailbox server technically accepts the message without placing it in the inbox. The D1 record exists so an inquiry confirmed on screen does not disappear if the email is refused afterwards. It holds the fields you filled in, the page language, the site hostname, a request identifier and the send status as reported by the email service; it holds no IP address, no cookie and no anti-robot token. Do not include confidential or sensitive information in the message field.

When you write to us, an email sent to contact@aplombcx.com may contain your name, your email address, your company, your role, the content of your message and any attachments you voluntarily provide. We ask that you do not send sensitive information, or information that is not necessary for your inquiry.

4. Cookies

The website itself sets no marketing cookie and no advertising tracker. Cloudflare may nevertheless use cookies that are strictly necessary for security, depending on the service configuration or during a security challenge. We do not claim that no technical cookie can ever be used by the hosting infrastructure.

The contact form is protected by Cloudflare Turnstile, an anti-robot mechanism that may process browser signals, technical data and the IP address in order to tell people apart from bots. This data is used only for abuse protection and not for advertising tracking.

5. Purposes

We use the information described above to respond to inquiries, understand the professional context of an exchange, ensure the security and operation of the website, comply with legal obligations and manage exploratory business exchanges. It is not used for behavioural advertising. We also use it to assess whether an exploratory conversation is appropriate. None of this information is used for marketing or a newsletter without your separate consent.

6. Service providers and processing outside Québec

We rely on service providers: Cloudflare (website hosting, form reception, Turnstile anti-robot protection and the Cloudflare D1 database in which received inquiries are recorded, through Cloudflare Pages), Resend (an email-sending service that delivers form submissions), Apple iCloud Mail (primary mailbox reception and email processing) and Google Gmail (a backup mailbox that receives a private copy of every submission). The email-sending service and both mailbox providers may process the message content, the sending and receiving addresses, the subject and delivery metadata. Resend’s primary processing operations are located in the United States. Depending on their infrastructure, information may be processed or stored outside Québec, including elsewhere in Canada or in the United States. These providers’ terms, infrastructure and processing locations may change over time; we periodically reassess them and will update this policy accordingly.

7. Retention and deletion

Emails and the information associated with them are retained for no more than 12 months after the last meaningful exchange, then securely deleted, unless longer retention is reasonably necessary to comply with a legal obligation, manage a dispute, ensure security or maintain business records. Technical logs follow the retention periods configured or imposed by Cloudflare; we do not control the provider’s internal backups and logs. As of this policy’s last update, Resend advertises retention of roughly 30 days for email data processed under its common plans; this duration is governed by the provider’s own terms, may change without notice to Aplomb, and is not guaranteed by Aplomb. We will reassess this policy if the provider’s terms change.

Inquiries submitted through the contact form are additionally recorded in the Cloudflare D1 database described in section 3, for a bounded operational recovery window of 30 days from reception. Each record carries its own expiry date. This copy exists only to find and process an inquiry whose email failed; it does not replace the email received in our mailbox, which follows the 12-month period described above. Expired records are removed by a purge operation run by Aplomb: as of today that purge is not automated, and we do not claim otherwise.

8. Safeguards

We apply measures proportionate to the limited nature of the information processed: restricted access to the hosting and email accounts, strong passwords, multi-factor authentication where available, encryption in transit and security updates. No method of transmission or storage can, however, provide absolute security.

9. Your rights and remedies

Subject to applicable law, you may request access to the personal information we hold about you, request its correction or withdraw your consent where that right applies. You may also file a complaint with the Commission d’accès à l’information du Québec. To exercise these rights, write to contact@aplombcx.com.

10. Updates to this policy

We may amend this policy to reflect changes in our practices or obligations. The last-updated date shown at the top of this page will then be revised.