Privacy Policy — invitation-only Canadian pilot

DRAFT — NOT IN EFFECT. Working version 2026-10-15.draft-v2, prepared for review by the operator and by a lawyer licensed in Quebec. This document is not legal advice and is not a published policy. The pilot is closed: this text cannot be used to obtain consent. Items marked [TO CONFIRM] are facts or choices that have not been validated yet.

1. Who we are

The service is operated by Cleiton Wiggers Werncke, as an individual (no business has been incorporated yet), at 205 Rue Guillaume Barrette, La Prairie, QC J5R 6L7, Canada. Business name and registration, if any: [TO CONFIRM — P01]. “mneme-ca” is a provisional technical name; the public brand and the service domain have not been decided [TO CONFIRM — P02].

The service helps a family preserve a person’s memories as a book. During the pilot:

participation is assisted and by invitation only;
the organizer and the narrator have separate roles and separate access;
memories are collected on the Web, by audio recording or by text;
email and SMS are used only for notices (invitations, access, reminders, story ready); they are never used to collect stories;
artificial intelligence (AI) is used in a controlled way, with human review, and does not conduct autonomous interviews;
no real sale takes place: any payment page shown runs in Stripe test mode, in Canadian dollars, and no card is charged.

This policy applies to narrators, organizers, people mentioned in stories and visitors to the public website.

2. Person in charge of the protection of personal information

As the person with the highest authority in the operation, Cleiton Wiggers Werncke acts personally as the person in charge of the protection of personal information.

Email: cleitonwi@gmail.com
Mailing address: 205 Rue Guillaume Barrette, La Prairie, QC J5R 6L7, Canada

The person in charge ensures compliance with this policy, approves privacy impact assessments, answers requests and complaints and keeps the register of confidentiality incidents. You can contact the person in charge directly, without an account, without going through the organizer and without the organizer’s permission. If this role is delegated in writing or a business is incorporated, this policy will be updated before the change.

3. Information we collect and why

We collect only the information needed for the purposes set out below. We do not use it for other purposes without your consent, except where the law allows.

3.1 Organizers

Information provided: name, contact details, language, project settings (book language, questions chosen from the question bank, sending pace, style, gift details), prompt photos the organizer chooses to attach to a question, and editorial edits and approvals.
Purposes: creating and managing the project, communicating about the service, and enabling review and approval of the book.

3.2 Narrators

Information provided by the organizer before the invitation: name, contact details (email, mobile number or both), language and time zone. The organizer must be authorized to share them with us. They are used only to send the invitation, then private access if you accept. We tell you this at first contact.
Information you provide: audio recordings, text, corrections, consent choices and notification preferences.
Information produced by the service: transcripts, written stories, editorial titles, the prologue, successive versions and the book layout.

Your memories may reveal intimate information, for example about health, beliefs, family life or relationships. We treat all of your responses as sensitive information and ask for your express consent before collecting them.

3.3 People mentioned in stories

A story may mention relatives or other people. We ask narrators to avoid unnecessary intimate details about others and to use pseudonyms where appropriate. A person who is mentioned may write to us directly (section 11), without an account, about information concerning them.

Version, language and digital fingerprint of the documents presented, choices made and timestamps. Purpose: demonstrating and honouring your choices. We avoid keeping full IP addresses or detailed device identification unless a need is demonstrated.

3.5 Technical and security information

Limited connection logs, session identifiers and security events. Purposes: protecting access, diagnosing failures, preventing abuse and handling requests. Stories, audio content and private links must not appear in general logs.

3.6 Test-mode payments

On the demonstration purchase page, our server receives only the chosen language and a random identifier. Fields completed in the preview (name, contact details, information about the narrator) are not sent to us or to Stripe. The payment page hosted by Stripe collects what you enter there, under Stripe’s policy; we receive only the test session status, amount, currency and opaque references. No card is charged. Do not enter real card details.

3.7 What we do not do

We do not sell personal information. We do not build advertising profiles. We do not use voiceprints, voice cloning, geolocation, audience measurement or session replay. We do not use your stories to train AI models, and we prohibit our service providers from doing so. We do not obtain information from data brokers.

Narrators consent for themselves. An organizer cannot consent on behalf of another adult.

Before any collection, we present separately, in clear and simple terms:

acceptance of the terms of use;
express consent to the collection of your memories, to their transcription and AI-assisted writing, and then to their sharing with the designated organizer after submission;
the choice of each notice channel (email, SMS), independent of each other.

No box is pre-checked. No optional purpose (promotion, tracking, model training) is a condition of participation. Allowing microphone use in your browser is a technical permission: it does not replace this consent.

You may skip ordinary questions and leave out any detail you do not wish to provide. The five opening questions are used to write the prologue and follow one another; you may nevertheless stop participating or withdraw your consent rather than answer them.

Any new purpose or new recipient that requires it will be subject to new consent; a change to this policy is not enough to authorize it.

5. Privacy by default

The service’s settings provide the highest level of confidentiality by default, without any action on your part:

your drafts stay private: the organizer cannot see them, and they are neither transcribed nor processed by AI until you choose “Send response”;
no notice is sent on a channel you have not chosen;
the book is never published publicly;
private access links expire after 30 days and can be revoked;
no technology that allows you to be identified, located or profiled is used. If such a function were ever considered, it would be off by default, announced in advance and turned on only at your request.

“Private drafts” do not stay only on your device: they may be uploaded to protected server storage before submission. Only authorized people and hosting or security providers may access them, when necessary to operate or protect the service.

6. Artificial intelligence and automated decisions

After a response is submitted, AI:

transcribes the recordings;
helps write a readable story (removing hesitations, first- or third-person narration according to the chosen style);
suggests an editorial title, the prologue based on the five opening responses, and a cover title.

The question asked stays visible, separate from the editorial title. A person reviews the result: you can correct the text, and the organizer approves the book before it is closed. Original recordings are kept as submitted; a response is never silently truncated. AI can make mistakes; please report any error.

AI does not conduct interviews, does not choose the questions (they come from a bank of prepared questions and are selected by the organizer) and does not make any decision about you based exclusively on automated processing. If such a decision were ever made, we would inform you no later than when the decision is made, tell you on request the information and the main factors used, and give you the opportunity to submit observations to a person able to review it.

AI and transcription provider: none has been approved yet [TO CONFIRM — P09]. Before any use, its contract must prohibit training on your content, limit retention and uses, and state the processing locations; it will be added to the register in section 8.

7. Disclosure of information

Organizer: only after submission, the organizer can listen to your recordings and read the transcript and the story. The organizer cannot see your drafts or obtain your private access link. Creating the project gives the organizer no rights over your personal information.
Authorized staff: the operator and, where applicable, the authorized editorial team [TO CONFIRM — P03], bound by confidentiality and limited to what is necessary.
Service providers: see section 8. They act on our behalf, under a written contract, and may not use the information for their own purposes.
Legal obligations: where the law requires or permits it, for example in response to a court order.
Change of operator: if a business is incorporated to take over the service, information will be disclosed to it only under the conditions set by law, and we will inform you in advance.

We do not sell, rent or trade any personal information.

8. Register of service providers and processing locations

This register is provisional. No service provider will receive real information before the assessment, contract and verification described in section 9.

Railway — application hosting, database and processing queue. All service information. Database observed in Virginia (United States); contractual regions, backups and subprocessors [TO CONFIRM — P04].
Cloudflare (R2) — storage of recordings and files. Region shown in the interface: Eastern North America; jurisdiction and subprocessors [TO CONFIRM — P05].
Resend — sending notice emails. Name, email address and notice content, without stories. Processing locations and retention [TO CONFIRM — P06].
Telnyx — sending notice SMS messages to Canadian numbers. Mobile number and notice content, without stories. A Canada data-locality option does not prove that all processing occurs in Canada; locations and retention [TO CONFIRM — P07].
Stripe — hosted payment page, in test mode only. Information entered on Stripe’s page; Stripe may process it outside Canada, including in the United States. Contracting entity and locations [TO CONFIRM — P08].
AI and transcription provider — none approved [TO CONFIRM — P09].
Printer and carrier — only if paid access ever opens; delivery name and address and the book file [TO CONFIRM — P10].

No audience-measurement, session-replay, advertising or instant-messaging tool is used.

9. Disclosure outside Quebec and Canada

Several service providers are located, or process information, outside Quebec and outside Canada, including in the United States. Before disclosing information outside Quebec, we conduct a privacy impact assessment that considers its sensitivity, the purpose, the protection measures (including contractual ones) and the legal framework of the state concerned. The disclosure takes place only if the assessment concludes that the protection is adequate and a written agreement governs it. Elsewhere in Canada, we require a comparable level of protection by contract.

Information processed abroad may be accessible to the courts and authorities of that country under its laws. We do not claim that your information stays in Canada. You may ask the person in charge for details about processing countries and purposes.

10. Retention and destruction

We keep information only as long as needed for the stated purposes or as required by law. The schedule below is a proposal to be validated [TO CONFIRM — P11]; no real collection will take place before it is approved and implemented.

Invitations not accepted: tokens and contact details deleted no later than 30 days after the invitation expires.
Private drafts on the server: expire after 30 days without activity, then deleted within 30 days.
Drafts on your device: cleared on submission or when discarded, where possible; see the cookie policy.
Submitted recordings, transcripts, stories and versions: while the project is active, reviewed every 12 months. After 12 months without activity, 30 days’ notice, then deletion within the following 30 days, unless you ask otherwise or the law requires retention.
Temporary AI and transcription copies: deleted no later than 7 days after the result; 30 days at most at the provider.
Content of email and SMS notices: 7 days after delivery; sending metadata: 90 days.
Technical and security logs: 30 days, except when investigating an incident.
Records of consent and request files: up to 3 years after the project ends, limited to the minimum needed.
Backups: rotation of 90 days at most; deletions are reapplied before any restore.
Register of confidentiality incidents: at least 5 years.
Test-mode payment data: deleted at the end of the pilot [TO CONFIRM — P11].

Information used to make a decision about you is kept at least as long as the law requires after that decision. Once the purpose is achieved, we destroy the information. We do not claim that a story with names removed is anonymous: anonymization would be carried out only according to the regulatory criteria.

11. Your rights

Depending on the applicable law, you may:

access your information and learn how it is used and to whom it has been disclosed;
have corrected information that is inaccurate, incomplete or equivocal;
obtain a copy of the computerized information you provided to us, in a structured, commonly used technological format, or have it sent to an authorized person or body [TO CONFIRM — P12: format];
withdraw your consent (section 12);
request deletion of your information, subject to legal retention obligations;
request that we stop disseminating information or de-index a hyperlink attached to your name, where the legal conditions are met. The service does not publish stories on the Web;
obtain explanations about any decision based exclusively on automated processing (section 6);
complain to the person in charge and to the supervisory authorities.

The right of access is broader than the copy described in the third point: it also covers information produced about you. The book PDF is not a complete copy of your personal information.

How to make a request: write to the person in charge, by email or by mail (section 2). No account and no permission from the organizer are needed. We verify your identity in a proportionate way. Requests are handled free of charge [TO CONFIRM — P13].

Response times: in Quebec, we respond in writing within 30 days. Under federal law, the response is given within 30 days, with only the permitted extensions, which we will announce to you with the reasons. If a provincial law of Alberta or British Columbia applies, we follow its time limits. Any refusal gives reasons and states your recourses. Some legal exceptions, in particular to protect other people’s information, may require redaction.

Supervisory authorities: Commission d’accès à l’information du Québec (cai.gouv.qc.ca); Office of the Privacy Commissioner of Canada (priv.gc.ca); Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca); Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

These are three separate actions:

Withdrawing your consent stops collection and new AI processing. Pending results are discarded. An operation already sent to a provider cannot always be cancelled in practice; its result will not be used.
Stopping notices (for example by replying STOP or ARRÊT to an SMS, or by using the unsubscribe link in an email) stops that channel only. It does not withdraw your consent to collection and does not delete any content.
Requesting deletion covers recordings, transcripts, stories, versions, derived files and copies held by providers. We confirm the result and explain any retention required by law.

Copies already downloaded or delivered outside the service, such as a printed book or a shared PDF, may be impossible to recover. Deletion on the server does not erase an offline browser.

13. Security

Planned measures include access control by role and by project, time-limited and revocable private links, protected storage, reduced staff privileges, contracts with service providers and tested deletion procedures. The detailed list of measures will be published once verified [TO CONFIRM — P18]. No system offers perfect security. Keep your links private and report any loss immediately so they can be revoked.

14. Confidentiality incidents

A confidentiality incident is unauthorized access to, use or disclosure of personal information, or its loss. If an incident occurs, we promptly take measures to reduce the risk of injury and prevent it from happening again. We assess the risk:

if the incident presents a risk of serious injury, we promptly notify the Commission d’accès à l’information and the people concerned;
if there is a real risk of significant harm under federal law, we report to the Office of the Privacy Commissioner of Canada and notify the people concerned as soon as feasible;
other applicable notices, including in Alberta, are also given.

We may notify other organizations that can reduce the harm. All incidents are recorded in a register, including those that do not require notice.

15. Age and capacity

The service is reserved for people who have reached the age of majority in their province or territory of residence and who are able to consent for themselves. It is not intended for children. If we learn that a minor has taken part, we will suspend collection and delete their information, subject to the law. If a narrator no longer appears able to consent, collection is suspended until the situation is clarified [TO CONFIRM — Q21].

16. Cookies and storage on your device

We use only the cookies and storage needed for language, access, drafts and the test-mode payment page. No advertising or analytics cookie is used. See the cookie policy.

17. Governance and complaints

Our rules cover staff roles and responsibilities, the retention and destruction of information, and complaint handling. To complain, write to the person in charge. We acknowledge receipt of the complaint [TO CONFIRM — P14: time frame], review it and respond in writing within 30 days. If the response does not satisfy you, you may contact the competent supervisory authority (section 11).

18. Changes

Each version is dated. Significant changes are communicated to you before they take effect. The French and English versions have the same content and remain available. This draft has no effective date [TO CONFIRM — P16].

19. Legal framework

Depending on the situation, the following laws govern these activities: Quebec’s Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25 (S.Q. 2021, c. 25); the Personal Information Protection and Electronic Documents Act (PIPEDA); the personal information protection acts of Alberta and British Columbia; and Canada’s Anti-Spam Legislation for notices. The rights the law grants you apply regardless of the text of this policy.