Privacy Policy · APIgoat

01 Who is responsible

APIgoat is a solutions consulting practice based in Quebec City, Quebec, Canada. APIgoat operates this website and decides what personal information is collected here and why.

The person responsible for the protection of personal information, as required by Law 25, can be reached at privacy@apigoat.com. For anything that is not a privacy matter, write to hello@apigoat.com instead.

02 What is collected, and why

Nothing on this site requires an account, and there is no profiling and no advertising pixel. Personal information is collected in these places only:

contact form: Your name, email address, the scope you pick and the brief you write. It is emailed straight to me so I can answer you and scope the work — it is not stored in a website database, and it is never used for marketing. Submitting the form is how you consent to that.
spam protection: The contact form runs Google reCAPTCHA v3, loaded only once you start filling the form in. From that point Google receives your IP address and signals about how you interacted with the page, and returns a score telling me whether you are likely a bot. It is used for that and nothing else. If you never touch the form, nothing is sent. Google processes this under its own privacy policy and terms.
chatbot demo: If you use the chatbot widget, what you type is sent to my APIchatbot service to produce an answer, and the exchange may be logged there to debug and improve answers. Please do not type confidential information or anyone's personal details into it. Your IP address is used to count requests for rate limiting — held in a short-lived server-side counter, not in a profile.
analytics: Google Analytics 4 (measurement ID G-S0MSSD822E) records page views, approximate location from IP, device and browser, and how you arrived. It loads only if you accept it in the banner shown on your first visit — refuse, or ignore the banner, and it is never loaded. It tells me which pages are worth keeping; it is not used to identify you or to build an advertising audience.
article updates: If you subscribe to article updates, I store your email address, your name if you give one, your language, the page you subscribed from, your IP address and browser string, and the fact that you consented — so I can send you the next article and prove the consent. One click in any of those emails removes you.

When you send the contact form, subscribe to article updates or leave your details with the chatbot, I also receive how you reached the site: the campaign tags on the link you followed, the site that referred you, and the first page you opened. While you browse, that note lives only in your browser's session storage — no cookie is set, and it is gone when you close the tab. Once you send one of those forms, the note travels with it and is kept with that message, subscription or request for as long as the record itself is kept.

My web host also keeps standard server logs — IP address, the page requested, browser and timestamp — which are used to keep the site up and to investigate attacks or abuse.

03 Cookies and similar technologies

apigoat_lang: Remembers whether you chose English or French, for 12 months. Strictly a preference — it holds a language code and nothing else.
apigoat_consent: Records whether you accepted or refused analytics, for 12 months, so you are asked once. Set only when you answer the banner.
_ga, _ga_*: Set by Google Analytics to tell visits apart, up to 2 years. Only present if you accepted.
reCAPTCHA storage: Google sets its own cookies and browser storage once you start filling in the contact form, for bot detection.
wordpress_*, wp-settings-*: Only set if you log in to the site's administration — that is me, not visitors.

You can block or delete cookies in your browser settings. The site works without them; you will simply be asked to pick a language again.

Analytics is opt-in: nothing from Google Analytics is loaded until you accept it in the banner. Refusing loads nothing at all — there is no "essential analytics" exception hiding behind that button. You can change your mind at any time through the "cookies" link in the footer, and Google also offers a browser add-on that opts you out of Analytics everywhere.

04 Who else sees it

Your information is never sold, rented or traded. It is shared only with the suppliers needed to run the site, and only for that purpose:

Google — Analytics and reCAPTCHA (United States).
My hosting and email providers — to serve the site and deliver the contact form to my inbox.
APIchatbot — my own service, which answers chatbot messages.

Some of those suppliers store or process information outside Quebec, mainly in the United States, where local authorities may have legal access rights that differ from Canada's. Before using them I assessed that the information involved here — a name, an email address, a brief, an IP address — carries a low risk of serious injury, and I use their standard contractual protections. Information is otherwise disclosed only where the law requires it.

05 How long it is kept

contact briefs: Kept while we are in contact and for as long as the resulting business relationship lasts. Briefs that lead nowhere are deleted within 24 months.
client and billing records: Kept as long as tax and commercial law requires — generally six years after the last transaction.
analytics: Retained by Google under the property's retention setting, then deleted automatically.
chatbot exchanges: Kept only as long as needed to debug and improve answers, then deleted.
rate-limit counters: Minutes.
server logs: Weeks, unless a log is retained for a security investigation.
article updates: Kept until you unsubscribe or ask me to delete the record.
how you reached the site: In your browser, until you close the tab. Once sent with a form, for as long as that message, subscription or request is kept.

06 Your rights

Under Law 25 and PIPEDA you can ask me to:

tell you what personal information I hold about you, and give you a copy;
correct anything inaccurate, incomplete or out of date;
delete information I no longer have a reason to keep;
stop disseminating information, or de-index a link, where it causes you serious injury;
hand over the information you gave me in a structured, commonly used technical format, or send it to someone else;
withdraw your consent at any time, which stops future processing but does not undo what was already done.

Write to privacy@apigoat.com. I answer within 30 days. There is no automated decision-making on this site — no profile decides anything about you.

If my answer does not satisfy you, you can complain to the Commission d'accès à l'information du Québec or, for matters under federal law, the Office of the Privacy Commissioner of Canada.

07 Security and incidents

The site is served over TLS, kept patched, hardened against the common attack paths, and access to the inbox and servers is limited to me and protected by strong authentication. No system is perfectly secure, and I will not pretend otherwise.

If a confidentiality incident occurs and it presents a risk of serious injury, I will notify the Commission d'accès à l'information and the people affected promptly, and record it in the register Law 25 requires.

08 Children

This is a business-to-business site and it is not directed at children. I do not knowingly collect information from a child under 14 without the consent of a person having parental authority. If that happened, write to me and it will be deleted.

09 Smarties and other APIgoat products

This policy covers the apigoat.com website only. Data processed by the Smarties service, including data from Google accounts that users connect to it, is covered by the Smarties privacy policy.

APIgoat's use and transfer of information received from Google APIs to any app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10 Changes to this policy

When the site changes what it collects, this page changes with it and the date at the top moves. Material changes will be described here rather than slipped in quietly. Questions about any of it: privacy@apigoat.com.