Privacy policy

Boursify operates this website from Montreal, Quebec. You can reach us at info@boursify.io.

The person responsible for the protection of personal information at Boursify is François Lévesque. Any question or request on that subject — access, correction, deletion or withdrawal of consent — should be sent to info@boursify.io.

This site has two forms: the one to write to us and the one to request a demo. When you submit either, we keep exactly the fields it asks you for:

• your first and last name;
• your email address;
• your phone number and the country code you picked, if you filled them in;
• your organization, if you filled it in;
• the solution you selected, where applicable;
• your message, on the contact form only;
• which form you used, your browsing language, and the date and time.

That is the whole of what you typed. Two things are filed with it: the campaign parameters of the link you arrived through, if it carried any, and a link to the visit you sent it from, which lets us see the pages you read before writing to us. Both are described under "Analytics and advertising" below. Your IP address and your browser identifier are not columns of the submission itself; they belong to the visit it points at.

We use this to reply to you and to arrange a simulation with you. Submissions are readable by our team in a password-protected admin area.

Two checks run on every submission to block automated spam. Neither keeps anything about you:

• a hidden field no person ever sees: if it is filled in, the submission is treated as spam;
• an encrypted timestamp of when the form was displayed. A submission completed in under three seconds is treated as spam.

Submissions are also rate-limited to ten per minute. That count is kept per IP address and held briefly in our own database. It is a counter, not a log: it holds nothing of what the form contained.

The contact and demo request pages additionally load Google reCAPTCHA Enterprise, a Google script that runs in your browser. This check is switched on: on every submission we send Google the reCAPTCHA token, your IP address, your browser identifier, and the address of the page you submitted from. Google returns a score we use to judge whether the submission is genuine.

Four cookies come from the site itself:

• a session cookie, needed for the forms to work and to protect them against forgery. It is encrypted, unreadable by scripts in your browser, and expires after two hours of inactivity;
• a security cookie alongside it, used to verify that a submission genuinely came from this site;
• a cookie remembering that you dismissed the notice at the bottom of the page, kept for a year, so it is not shown to you again;
• on the live site only, a measurement cookie that carries a random identifier and nothing else, kept about 13 months. It is what lets our own audience statistics recognize a returning browser as the same one. It is unreadable by scripts in your browser, and it is never sent to anyone else.

For as long as you have a session, our server records alongside it your IP address, your browser identifier and the time you were last active. This is ordinary session handling: it applies to every visitor, not only to people who fill in a form.

The measurement and advertising tools described below set their own cookies, under their own names. We do not create those.

Our fonts are served by this site rather than by a third party, so simply viewing a page does not hand your IP address to a font provider.

On the live site, and only there, these tools load on every page:

• Google Analytics 4, loaded directly from Google. It records the pages you view and, when you complete a form, the fact that a submission happened: which form it was and an internal reference number. Your name, email address and message are never sent to Google Analytics.
• The Meta pixel, loaded from Meta (Facebook, Instagram). It records the pages you view and, on a form submission, that a lead was generated. This script sets its own cookies in your browser.

Neither runs in our development or staging environments.

On the live site we also keep our own audience statistics, on our own server rather than through a third party. Each page you view is recorded with its address, the time, your IP address, your browser identifier and the site that referred you. Those hits are grouped into visits, and the measurement cookie described above ties your visits together over time. If a link brought you in with campaign parameters, they are recorded too — and if you then submit a form, the submission is filed against that same visitor, so we can see the path that led to it.

None of this leaves our server: no third party receives it, and it is not used for advertising. It is not deleted automatically either — we keep it until we decide otherwise. You can ask us to erase what concerns you; see "Your rights" below.

Traffic we recognize as our own team, and traffic from search-engine and other robots, is flagged and left out of these statistics.

Our server does not send your submissions to Meta on its own side. The pixel running in your browser is the only link between this site and Meta. Were that to change, this page would be updated before any such transmission began.

Every page loads Crisp, a live chat tool provided by a third party. If you open the chat window and write to us, Crisp handles the conversation and everything you type into it, under its own terms and its own retention periods.

Our code does nothing more than load Crisp's script: what Crisp records on its side — transcripts, visitor identifiers, its own cookies — is governed by its privacy policy, which you can read at crisp.chat/en/privacy.

When a form is submitted, its contents are emailed to our team, with your address set as the reply-to so we can answer you. That delivery goes through our transactional email provider.

The same contents are also posted to our internal Slack workspace, so the team sees the request without delay: your name, your email address, your phone number and its country code, your organization, the solution you selected, your browsing language and your message. That is your whole submission, apart from the date and time.

In total, the third parties that may receive information about you through this site are: Google (Analytics, and reCAPTCHA on the form pages), Meta (the pixel), Crisp (chat), Slack (internal submission notice) and our email provider.

We run no other advertising or measurement integration on this site. The audience statistics we keep on our own side, described above, are shared with no one.

This site and its database are hosted in Canada, in Toronto, Ontario, with DigitalOcean. Your form submissions therefore stay in the country.

The third parties named above — Google, Meta, Crisp, Slack and our email provider — are foreign companies, and the information they receive is processed outside Quebec, under their own terms. The information concerned is what the sections above describe, and nothing else.

Quebec law lets you ask for access to the personal information we hold about you, ask for it to be corrected, ask for it to be deleted, and withdraw consent you previously gave.

Write to info@boursify.io. We may ask you to confirm your identity, so that we do not disclose your information to someone else, and we will then respond within the 30-day period the law provides.

If our response does not satisfy you, you can take the matter to the Commission d'accès à l'information du Québec.

If a confidentiality incident affecting your personal information occurred, we would record it in our incident register. Where such an incident presents a risk of serious injury, the law requires us to notify the Commission d'accès à l'information and the people concerned promptly, and we would do so.

If this policy changes, the current version is published on this page, with its update date.

For any question about the above: info@boursify.io.