Privacy and data handling

Rigueur is a service operated in Quebec by Abderrahmane Gourragui, who also serves as the person responsible for the protection of personal information.

For any privacy question, request, or complaint, write to [email protected].

• Account data: name, email address, authentication identifiers, and session information needed for invitation-only access.
• Documents and results: selected PDF or image files, filenames, statement contents, extracted data, and the verification report produced during processing.
• Technical data: request identifier, file count and size, document type, processing time, processing-service usage, and error category. Logs contain neither the documents nor extracted results.
• Preferences and cookies: a language cookie retained for one year and essential cookies required for authentication and account security.

We use this information only to:

• authenticate invited users and protect their accounts;
• read the statement, extract its transactions, recalculate its arithmetic, and return the result;
• operate, secure, and troubleshoot the service without logging financial content;
• remember the selected language.

Rigueur does not sell personal information or use it for advertising or profiling.

Rigueur uses cloud hosting, authentication, and automated document-processing providers. They receive only the information needed for their function. These providers may process information outside Quebec and Canada, where different laws may apply.

For document analysis, Rigueur uses only paid services configured for zero data retention. Uploaded content is not used to train general-purpose models. Any replacement provider must meet the same requirements.

• Documents and results: they exist on the server only during the request. Rigueur does not retain a copy after sending the response. The result remains temporarily in browser memory until the page is left or reset.
• Account data: it is retained while the account is active. After a verified deletion request, Rigueur deletes data under its control within 30 days, except where limited retention is required by law or necessary for security.
• Operational metadata: it is retained for a limited period, only as long as needed to diagnose failures, protect the service, and meet legal obligations. The current period is available by writing to the address below.
• Requests and incidents: communications needed to handle a request are retained for as long as required to answer it. The privacy incident register is retained for at least five years where required by law.

Rigueur limits access to people and providers that need the information to deliver the service. Communications use encrypted connections, uploads are limited to invited accounts, file types are verified, and logs exclude statement content and results.

No safeguard removes every risk. If an incident creates a risk of serious harm, Rigueur will provide the notices and take the measures required by law.

A statement may contain personal information about a client or another person. The person uploading it must be authorized to provide it and request its processing. Rigueur then processes the document only under that instruction and to produce the requested result.

You may request access to personal information held about you, ask that it be corrected or deleted, withdraw an applicable consent, or make a complaint. We may verify your identity before responding so information is not disclosed to the wrong person.

Send your request to [email protected]. You may also contact the Commission d'accès à l'information du Québec.

Rigueur may update this policy when the service or its practices change. The effective date will be updated, and any material change will be brought to the attention of affected people through an appropriate channel.