1. Who we are

TrustDID Solutions Inc. ("TrustDID", "we", "us") is a company incorporated in Canada, based in Quebec. This policy explains what personal information we collect through trustdid.ca and the TrustDID service, why we collect it, who else handles it, and what you can ask us to do with it.

It applies to visitors to our website, people who enrol for an account, and customers using the service. It does not apply to what you do with the software once it is on your own machine — that stays with you.

2. Who is responsible

Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) requires us to name a person in charge of protecting personal information. That role is held by Jacques Latour, Founder and Privacy Officer, reachable at privacy@trustdid.ca or by mail at TrustDID Solutions Inc., Quebec, Canada.

Write to that address for anything in this policy: a question, a request to see or correct your information, a complaint, or a request to delete your account.

3. What we collect

Only what the service needs to work:

• Account and enrolment details — your name, email address, and for business accounts the organisation name and domain. We use these to create your account, issue your identity, and reach you about the service.
• Billing information — billing address, country and province. The province and country determine the sales tax we must charge. We never receive or store your card number; see section 5.
• Your DID document — for hosted identities, the public keys and metadata that make up your decentralised identifier. This is published openly by design so that anyone can verify signatures you make. Do not put anything private in it.
• Verification codes — short-lived one-time codes emailed to you when you sign in. They expire in minutes and are then useless.
• Server logs — our web server records the IP address, the page requested, the time, and the browser's user-agent string, as essentially every web server does. We use these to keep the service running and to detect abuse.

4. What we do not collect

This is worth stating plainly, because it is the unusual part:

• Your documents. Sealing and checking run entirely on your own computer. A document is never sent to us — not even to verify it. What crosses the network is public information: identities and vouch lists.
• Your private keys. For self-managed plans they are generated on your machine and never leave it. For managed plans we hold keys on your behalf, and we say so explicitly at signup.
• Behavioural or advertising data. We run no analytics scripts, no pixels, no session recording, and no third-party tags. We measure traffic by reading our own server logs, which involves no code in your browser.

5. Cookies and local storage

We use no advertising or analytics cookies, so there is nothing here to consent to. What we do set is limited to making the site work:

• A session cookie, set when you sign in, so the site knows it is still you between pages. It is HttpOnly, Secure, and SameSite=Lax, and it is cleared when you sign out.
• A one-off technical cookie that records which version of the site your browser has cached, so an update does not leave you looking at a stale page.
• A language preference stored in your browser's local storage, so the site stays in English or French as you chose. It never leaves your browser.

Webfonts and every other asset are served from our own domain. Loading a page on this site does not send your IP address to any third party.

6. Who else handles your information

We keep this list as short as we can, and we do not add to it lightly:

• Helcim — our payment processor. When you pay, your card details go directly to Helcim and are never transmitted through or stored on our servers. We receive only the outcome: whether it succeeded, the amount, and the last digits of the card. Helcim's own privacy policy governs what they hold.
• Our email provider — used to deliver enrolment mail, sign-in codes, and receipts. Your email address necessarily passes through it.
• Our hosting provider — the servers that run the service, located in Canada.

We do not sell, rent, or trade your personal information. We disclose it otherwise only where the law requires it — for example a valid court order — and we will tell you if that happens unless we are legally barred from doing so.

7. Where your information is stored

Our servers and database are located in Canada. Some of the providers in section 6 may process limited information outside Canada in the course of delivering their service; where that happens, we assess the protection it receives before relying on them, as Law 25 requires.

8. How long we keep it

Account and billing records are kept while your account is active and afterwards for as long as tax and corporate law requires us to retain them — in Canada, generally six years. Sign-in codes expire within minutes. Server logs are kept for a short operational window and then rotated out. When information is no longer needed for any of these purposes, we delete or anonymise it.

Your published DID document is a special case: because others rely on it to verify signatures you have already made, removing it breaks those verifications. Tell us if you want it withdrawn and we will explain what that affects before doing it.

9. Your rights

Under Quebec's Law 25 and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you can ask us to:

• Show you the personal information we hold about you.
• Correct it if it is wrong or out of date.
• Delete it, where we are not required to keep it.
• Give it to you in a portable form — a structured, commonly used, machine-readable file.
• Stop using it, by withdrawing consent, though this may mean we can no longer provide the service.

Write to the Privacy Officer at privacy@trustdid.ca. We will respond within 30 days. If you are not satisfied with our answer, you may complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

10. Security

Traffic to the site is encrypted in transit. Access to the systems holding personal information is restricted and protected by multi-factor authentication. Payment card details never reach our servers at all. We keep the smallest amount of information we can, on the principle that what we do not hold cannot be lost.

No system is perfectly secure. If a breach occurs that presents a risk of serious injury, we will notify the Commission d'accès à l'information and affected individuals promptly, as Law 25 requires, and keep a register of any incident.

11. Children

TrustDID is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 14. If you believe a child has given us information, write to us and we will delete it.

12. Changes to this policy

We may update this policy. If a change materially affects how we handle your information, we will email registered customers before it takes effect. The effective date at the top of this page always shows when it was last revised.

13. Contact

Questions, requests, or complaints about privacy go to the Privacy Officer, TrustDID Solutions Inc., at privacy@trustdid.ca.