Privacy Policy

01 Who is responsible

APIgoat is a solutions consulting practice based in Quebec City, Quebec, Canada. APIgoat operates this website and decides what personal information is collected here and why.

The person responsible for the protection of personal information, as required by Law 25, can be reached at privacy@apigoat.com. For anything that is not a privacy matter, write to hello@apigoat.com instead.

02 What is collected, and why

Nothing on this site requires an account, and there is no newsletter, no profiling and no advertising pixel. Personal information is collected in four places only:

contact form

Your name, email address, the scope you pick and the brief you write. It is emailed straight to me so I can answer you and scope the work — it is not stored in a website database, and it is never used for marketing. Submitting the form is how you consent to that.

spam protection

The contact form runs Google reCAPTCHA v3, loaded only once you start filling the form in. From that point Google receives your IP address and signals about how you interacted with the page, and returns a score telling me whether you are likely a bot. It is used for that and nothing else. If you never touch the form, nothing is sent. Google processes this under its own privacy policy and terms.

chatbot demo

If you use the chatbot widget, what you type is sent to my APIchatbot service to produce an answer, and the exchange may be logged there to debug and improve answers. Please do not type confidential information or anyone's personal details into it. Your IP address is used to count requests for rate limiting — held in a short-lived server-side counter, not in a profile.

analytics

Google Analytics 4 (measurement ID G-S0MSSD822E) records page views, approximate location from IP, device and browser, and how you arrived. It loads only if you accept it in the banner shown on your first visit — refuse, or ignore the banner, and it is never loaded. It tells me which pages are worth keeping; it is not used to identify you or to build an advertising audience.

My web host also keeps standard server logs — IP address, the page requested, browser and timestamp — which are used to keep the site up and to investigate attacks or abuse.

03 Cookies and similar technologies

apigoat_lang

Remembers whether you chose English or French, for 12 months. Strictly a preference — it holds a language code and nothing else.

apigoat_consent

Records whether you accepted or refused analytics, for 12 months, so you are asked once. Set only when you answer the banner.

_ga, _ga_*

Set by Google Analytics to tell visits apart, up to 2 years. Only present if you accepted.

reCAPTCHA storage

Google sets its own cookies and browser storage once you start filling in the contact form, for bot detection.

wordpress_*, wp-settings-*

Only set if you log in to the site's administration — that is me, not visitors.

You can block or delete cookies in your browser settings. The site works without them; you will simply be asked to pick a language again.

Analytics is opt-in: nothing from Google Analytics is loaded until you accept it in the banner. Refusing loads nothing at all — there is no "essential analytics" exception hiding behind that button. You can change your mind at any time through the "cookies" link in the footer, and Google also offers a browser add-on that opts you out of Analytics everywhere.

04 Who else sees it

Your information is never sold, rented or traded. It is shared only with the suppliers needed to run the site, and only for that purpose:

• Google — Analytics and reCAPTCHA (United States).
• My hosting and email providers — to serve the site and deliver the contact form to my inbox.
• APIchatbot — my own service, which answers chatbot messages.

Some of those suppliers store or process information outside Quebec, mainly in the United States, where local authorities may have legal access rights that differ from Canada's. Before using them I assessed that the information involved here — a name, an email address, a brief, an IP address — carries a low risk of serious injury, and I use their standard contractual protections. Information is otherwise disclosed only where the law requires it.

05 How long it is kept

contact briefs

Kept while we are in contact and for as long as the resulting business relationship lasts. Briefs that lead nowhere are deleted within 24 months.

client and billing records

Kept as long as tax and commercial law requires — generally six years after the last transaction.

analytics

Retained by Google under the property's retention setting, then deleted automatically.

chatbot exchanges

Kept only as long as needed to debug and improve answers, then deleted.

rate-limit counters

Minutes.

server logs

Weeks, unless a log is retained for a security investigation.

06 Your rights

Under Law 25 and PIPEDA you can ask me to:

• tell you what personal information I hold about you, and give you a copy;
• correct anything inaccurate, incomplete or out of date;
• delete information I no longer have a reason to keep;
• stop disseminating information, or de-index a link, where it causes you serious injury;
• hand over the information you gave me in a structured, commonly used technical format, or send it to someone else;
• withdraw your consent at any time, which stops future processing but does not undo what was already done.

Write to privacy@apigoat.com. I answer within 30 days. There is no automated decision-making on this site — no profile decides anything about you.

If my answer does not satisfy you, you can complain to the Commission d'accès à l'information du Québec or, for matters under federal law, the Office of the Privacy Commissioner of Canada.

07 Security and incidents

The site is served over TLS, kept patched, hardened against the common attack paths, and access to the inbox and servers is limited to me and protected by strong authentication. No system is perfectly secure, and I will not pretend otherwise.

If a confidentiality incident occurs and it presents a risk of serious injury, I will notify the Commission d'accès à l'information and the people affected promptly, and record it in the register Law 25 requires.

08 Children

This is a business-to-business site and it is not directed at children. I do not knowingly collect information from a child under 14 without the consent of a person having parental authority. If that happened, write to me and it will be deleted.

09 Changes to this policy

When the site changes what it collects, this page changes with it and the date at the top moves. Material changes will be described here rather than slipped in quietly. Questions about any of it: privacy@apigoat.com.