Solutions technologiques Adjulo inc. (“Adjulo”) provides a public procurement intelligence service designed with respect for your personal information. This policy explains what information we collect, why we collect it, how we protect it and what your rights are.
It applies to the adjulo.ca website, the client portal, and Adjulo's API and MCP server, as well as to the communications we send you.
Adjulo is a company based in Québec City. It is subject to the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25, and, where applicable, to the Personal Information Protection and Electronic Documents Act (PIPEDA). The contact information of our privacy officer appears in the Privacy officer section.
Table of contents
1. Our guiding principles
Our approach to protecting personal information is built on the guiding principles of the Private Sector Act. Here, at a glance, are the commitments that guide every decision — detailed in the sections below.
Transparency
Clear information on what we collect, why and how.
Free and informed consent
Collected for specific purposes and withdrawable at any time.
Data minimization
Only the information necessary to provide the service.
Purpose limitation
Used only for stated purposes; never sold.
Privacy by default
The most protective settings are enabled out of the box.
Security
TLS encryption, SHA-256 hashing, restricted access, encrypted backups.
Access and correction
View, correct, delete and export your data.
Accountability
A designated privacy officer is responsible.
2. Scope and acceptance
By using Adjulo's services — website, API, client portal — you acknowledge that you have read this policy. If you do not agree with its terms, please do not use our services.
This policy covers personal information as defined by the Private Sector Act, that is, any information that can identify a natural person, directly or indirectly.
3. Information we collect
We limit collection to what is strictly necessary to provide the service:
- Account data: name, email address, password (stored hashed), company and subscription plan.
- Billing data: processed by our payment provider; we never store your card numbers. Your card is kept by this provider for your subscription and for one-click purchases in the portal (for example an analysis pack): we only know its brand, last four digits and expiry date, shown before the purchase. You can replace it at any time from the Billing page.
- API usage data: API keys (stored SHA-256 hashed), request counts and timestamps, for quota and security purposes.
- Targeting profiles: criteria you configure (sectors, regions, keywords, Québec enterprise number) to receive relevant alerts.
- Technical data: anonymous, aggregated traffic statistics (see analytics section).
- Communications: the content of support tickets and emails you send us.
4. How we use information
- Provide, maintain and improve the monitoring service and API;
- Authenticate your access and enforce your plan's quotas;
- Send you the alerts and notifications you have configured;
- Process billing and manage your subscription;
- Respond to your support requests;
- Ensure security, prevent fraud and abuse;
- Comply with our legal obligations.
5. Legal basis and consent
We process your information where necessary to perform our contract (providing the service), where required by law, or based on your consent (for example, for optional communications). You may withdraw your consent at any time, subject to processing that is necessary to provide the service.
Newsletter
If you subscribe to the monthly newsletter, we collect your email address and language, along with the dates of your subscription, of its confirmation and, where applicable, of your unsubscription, together with the version of the consent wording you accepted: this is the proof of consent the law requires us to keep.
- Consent: nothing is sent to you before you confirm your subscription with the link received by email. Without confirmation, your address is erased 30 days later.
- Withdrawal: every newsletter contains an unsubscribe link, and withdrawal takes effect immediately. You may also write to [email protected].
- Sending: it is entrusted to a provider located outside Québec. It receives the content of each newsletter and keeps a copy of the address of confirmed subscribers, nothing else: neither your language nor the history of your consent, which stay with us. Your unsubscription is passed on to it, and the erasure you request removes your address from that copy.
- No tracking: we measure neither newsletter opens nor clicks on its links.
- Retention: after you unsubscribe, we keep your address and these dates for three years, as proof of your consent and of its withdrawal, then erase them.
6. Public procurement data
Adjulo indexes tenders and contracts from official open data sources: SEAO (via donneesquebec.ca, Creative Commons CC BY 4.0 licence) and CanadaBuys. This data is public and published by government bodies; it is not personal information we collect about you. We do not simply redistribute it: we normalize it across sources, classify it and enrich it with our own indicators, while keeping each notice tied to its official source and carrying the attribution its licence requires.
7. Sharing with third parties
We share your information only with trusted processors, strictly to operate the service:
- Payment: secure subscription processing and billing;
- Transactional email delivery: confirmations, alerts, password resets;
- Newsletter delivery: only to subscribers who confirmed it (see section 5);
- Hosting and network: hosting infrastructure and network protection (firewall, TLS).
These providers are bound by confidentiality commitments and use your data only for the services they provide to us. We may also disclose information where required by law.
8. Cookies and analytics
We use two audience-measurement tools, Google Analytics 4 (Google LLC) and Cloudflare Web Analytics (Cloudflare, Inc.), to measure traffic on our public pages. Neither is loaded before you consent (“Accept all” button); declining does not affect how the site works. They are never loaded on the client portal, the demo, or the sign-in and sign-up pages.
Purpose: to learn which pages are viewed and how visitors move from discovering Adjulo to signing up, in order to improve the site. Besides page views, we measure a few actions: starting a sign-up and the plan chosen, choosing a plan on the Pricing page, clicking a call to action or a public procurement counter, switching language, subscribing to the newsletter and sending the contact form. No personal information (name, email, message content) is sent with these measurements.
Information processed: a pseudonymous identifier stored in cookies (_ga, _ga_*), the pages viewed and the actions above, device and browser type, and an approximate location derived from the IP address, which is not stored. Google signals and ad personalization are disabled; no data is used for advertising.
Transfer outside Québec: this information is processed by Google LLC in the United States. Retention: 14 months for measurement data tied to the identifier, after which only anonymous totals remain. Withdrawal: you can withdraw your consent at any time through “Cookie settings”; measurement stops immediately and the _ga cookies are deleted from your browser.
Cookies strictly necessary for operation (such as keeping your session when logged in) may also be used. This processing is governed by the Act respecting the protection of personal information in the private sector and PIPEDA.
You can change or withdraw your choice at any time.
9. Data retention
We keep your information for as long as your account is active or as needed to provide the service. After your account is closed, we delete or anonymize your personal information within a reasonable period, unless a legal retention obligation applies (for example, for tax purposes). When you request the deletion of your account (Account page of the portal), your information is erased 30 days after the end of the paid period; only invoices are kept, for six years, for tax purposes. Encrypted backups are purged on a rotation schedule of at most twelve months and are never restored for a deleted account.
10. Security
We implement appropriate technical and organizational measures: TLS encryption in transit, hashing of passwords and API keys (SHA-256), network firewall, database access restricted to internal services, and encrypted backups. As no system is infallible, we cannot guarantee absolute security, but we are committed to notifying you promptly of any confidentiality incident presenting a serious risk of harm, in accordance with the Private Sector Act.
11. Your rights
In accordance with the Private Sector Act, you have the right to:
- Access the personal information we hold about you;
- Correct inaccurate, incomplete or ambiguous information;
- Request deletion of your account and information;
- Withdraw consent to optional processing;
- Obtain portability of the computerized information you provided to us;
- File a complaint with the Commission d'accès à l'information du Québec.
To exercise these rights, write to us at [email protected]. We will respond within the timeframes provided by law.
12. Hosting and transfers
Our primary infrastructure is hosted in Québec. Some processors (payment, email delivery, content delivery network) may process data outside Québec; in that case, we ensure they provide adequate protection, as required by the Private Sector Act.
13. Privacy officer
The person responsible for the protection of personal information at Adjulo is Joey Scavone, President. You may contact this person for any question regarding this policy or your personal information: [email protected].
14. Changes to this policy
We may update this policy to reflect changes in our practices or legal requirements. The last updated date appears at the top of the page. In the event of a significant change, we will inform you by a reasonable means.