Privacy Policy

This policy explains how Agreely, a service of Ophelios Studio, handles personal information when you use the Agreely service and the agreely.ca website.

Last updated: October 21, 2026

Version: 1.2

1. Who we are

Agreely is a consent-accountability service operated by Ophelios Studio ("Agreely", "we", "us"). Agreely helps organizations issue, verify, revoke and prove consent, with an honest cryptographic record. This policy covers the personal information Agreely processes about its own account holders, prospects and website visitors. It does not, on its own, govern the personal information that a customer organization processes about its own data subjects using Agreely (see "Our role as an accountability layer" below).

Person in charge of the protection of personal information

The person in charge of the protection of personal information, as Quebec's Law 25 requires, is David Tucker, Ophelios Studio. You can reach the person in charge of the protection of personal information at david.tucker@ophelios.com.

2. What we collect

We aim to collect only what we need to provide and operate the service:

• Account and company data you provide when you sign up: your name, work email, organization name, role, and the configuration you set up in the app.
• Authentication data: credentials and session information needed to sign you in and keep your account secure.
• Billing data: your plan, billing contact, and subscription status. Card payments are handled by Stripe; we do not store full card numbers on our servers.
• Usage and technical data: log data, IP address, device and browser information, and feature usage, used to operate, secure and improve the service.
• Communications: messages you send us (support, sales, email) and our replies.

3. Why we use it (purposes)

• To provide, maintain and secure the Agreely service and your account.
• To process billing and manage your subscription.
• To provide support and respond to your requests.
• To detect, prevent and address abuse, fraud and security incidents.
• To improve the service and understand how it is used, in aggregate.
• To meet our legal and regulatory obligations.

We do not sell your personal information.

4. Our role as an accountability layer

For the consent records that customer organizations manage through Agreely, the customer is the organization that decides why and how those records are handled; Agreely acts as a processor and accountability layer on the customer's behalf. The product is built around data minimization:

• A data subject's identifiers held for a customer are kept pseudonymous and are designed to be unlinkable across customers; Agreely does not build a cross-customer profile of individuals.
• What is anchored on the public Base blockchain is limited to cryptographic hashes and opaque commitments. No personal information, and no readable consent claim, is written on-chain.
• We design for honesty, not for overstatement. Where a boundary exists (for example what survives an erasure, see section 6), we describe it plainly rather than claiming more than the system delivers.

If you are an individual whose consent a company manages with Agreely, the company is your first point of contact for your rights; we will support that company in responding to you.

5. How long we keep it (retention)

We keep account, billing and usage data for as long as your account is active and for a limited period afterward, to meet legal, accounting and security obligations, then we delete or anonymize it. Backups and write-ahead logs are retained for a documented window and then age out. We will publish specific retention periods as they are finalized; the goal is to keep personal information no longer than necessary for the purposes above.

6. Security and the honest erasure boundary

We use technical and organizational safeguards appropriate to the sensitivity of the information, including per-tenant encryption of sensitive records, encryption in transit, access controls, and isolation between customers.

For consent records, Agreely implements the right to erasure as a per-cell cryptographic shredding: erasing a record destroys every readable copy of its claim so that, the moment the erase is committed, the live database is anonymized (no readable category or purpose claim survives). To be honest about what this does and does not guarantee:

• The live database is anonymized immediately; full physical destruction completes within a documented retention window.
• What can remain after a shred is an unreadable on-chain commitment orphan (kept so other records still verify), a linkage to an opaque random reference carrying no readable claim, and encrypted ciphertext residual in write-ahead logs and backups until retention expiry.

We do not claim that data is "irreversibly destroyed everywhere at all times." No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

7. Service providers (sub-processors)

We share personal information with a small set of service providers who process it on our behalf, under contract and only as needed:

• Stripe for payment processing and subscription billing. Location: United States.
• OVH for hosting the application, the production database and its encrypted backups, where personal information is stored and processed. The public status page, status.agreely.ca, is also hosted there. Location: Beauharnois, Québec, Canada.
• Zoho Mail for transactional email relay: invitations, verification codes, confirmations, and the emails our customers send through Agreely. The relay receives the recipient's name and email address and the content of the message. Location: United States.
• Anthropic, PBC for cookie categorization by language model, for sites using the Témoins product. Location: United States. The payload sent to Anthropic is designed to carry no personal information (cookie names and attributes, domains); the one possible residue is the scanned page's title, truncated to 300 characters, which could exceptionally contain a person's name.
• The Base blockchain for anchoring cryptographic hashes only. No personal information is placed on-chain.
• Fly.io for the agreely.ca website's Umami audience measurement (section 10). Location: Toronto, Ontario, Canada.
• Cloudflare for delivering the agreely.ca website. Location: United States.
• DigitalOcean for hosting the agreely.ca website. Location: outside Québec.

We will keep this list current as our providers change. See our security page for the same list with each provider's role and location in full.

8. Hosting in Québec and processing outside Québec

The personal information of the Agreely service is hosted in Québec: the application, the production database and its encrypted backups are at OVH, in Beauharnois, on two servers. The backups are kept in two repositories, one on each of these servers.

This hosting in Québec is not a communication of personal information outside Québec. For the records our customers manage through Agreely (section 4), entrusting us with keeping them is a communication (P-39.1, s. 18.3) or release (A-2.1, s. 67.2) necessary for performing a mandate or a contract for services, not one made outside Québec (P-39.1, s. 17; A-2.1, s. 70.1).

Some processing does leave Québec, for specific reasons:

• Email. The emails Agreely sends, including those our customers send through Agreely, go through the Zoho Mail relay, located in the United States, which receives the recipient's name and email address and the content of the message.
• Cookie categorization. For sites using the Témoins product, Anthropic, in the United States, categorizes cookies from metadata designed to contain no personal information; the one possible residue is the scanned page's title (section 7).
• Payments. Stripe, in the United States, processes payments and subscription billing, with the account holder's name and email; card numbers never pass through our servers.
• Anchoring. The public Base blockchain receives only cryptographic hashes, never personal information.
• The agreely.ca website. The agreely.ca site is served through Cloudflare and hosted at DigitalOcean, and the Umami audience measurement (section 10) runs at Fly.io, in Toronto: they receive visitors' IP address and browser signature.

For the personal information we are responsible for, section 17 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) requires a privacy impact assessment before any communication outside Québec, and a written agreement. For the records our customers manage through Agreely, the assessment of the email leg is each customer's own (P-39.1, s. 17; A-2.1, s. 70.1): we document it, we do not carry it out on their behalf.

9. Your rights

Subject to applicable law, you may exercise the following rights regarding your personal information:

• Access the personal information we hold about you.
• Rectification of information that is inaccurate, incomplete or out of date.
• Withdrawal of consent, where processing is based on consent.
• Portability: receive certain information in a structured, commonly used technological format.
• Erasure / de-indexing where the law allows.

To exercise any of these rights, contact the person in charge of the protection of personal information at david.tucker@ophelios.com. We will respond within the timeframe required by law. If you are not satisfied, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

10. Cookies, sessions and audience measurement

The agreely.ca website and the app use a small number of cookies and similar technologies that are necessary to sign you in, keep your session secure, and remember basic preferences (such as language and theme). We do not use advertising cookies.

To understand how the agreely.ca website is used, we measure audience with Umami, an open-source analytics tool that Ophelios runs on its own instance, hosted in Canada (Fly.io, Toronto, Ontario). It sets no cookie and writes nothing to your device, the single exception being your opt-out below, and only if you ask for it. Each page view sends our own server the page address and its title, the referring page when you arrive from another site, your screen size and your browser language; as with any web request, your IP address and your browser signature (the “user agent”) also reach our server.

We do not keep your IP address. The server uses it, without ever storing it, to derive a pseudonymous identifier (IP address, user agent, a secret of our own and a salt that is renewed periodically, currently every month) used to count visits, along with an approximate location (country, province or state, city) and your browser, operating system and device type. What is kept is limited to that and to the browsing data described above: the page address (including its parameters) and title, the referring page, the screen size and the browser language. No advertising profile is built about you, you are not followed from one website to another, no individual identification feature is enabled, session replay is turned off, and nothing is shared with a third party: the analytics server is ours.

If you prefer not to be counted, you can turn off audience measurement for the agreely.ca website in your browser, on the website’s Audience measurement page. Your choice is stored locally in this browser for that purpose only, so clearing the agreely.ca website’s data will reset it. The measurement also honours your browser’s “Do Not Track” signal when you have it on.

If we ever use analytics tools that set non-essential cookies or that follow your browsing from one site to another, we will say so here and obtain the required consent first.

11. Changes to this policy

We may update this policy as the service evolves or as the law requires. We will post the updated version here with a new "last updated" date, and we will provide notice of material changes where appropriate.

12. Contact

Questions about this policy or your personal information? Contact our person in charge of the protection of personal information:

David Tucker, person in charge of the protection of personal information
Ophelios Studio
david.tucker@ophelios.com