Aviso legal

Política de privacidad

Qué datos recopila esta web, por qué, dónde se almacenan y cómo solicitarnos que los modifiquemos o eliminemos.

Última actualización: 2026-09-23

Este es un primer borrador pendiente de revisión por parte de un abogado colegiado en Quebec. En él se describe el funcionamiento real de este sitio web, verificado a partir de su propio código y base de datos; sin embargo, no se ha comprobado su suficiencia jurídica y nada de lo que en él se recoge debe interpretarse como una certificación de cumplimiento de la Ley 25 de Quebec ni de ninguna otra ley.

Este documento aún no se ha traducido a tu idioma. El texto en inglés que figura a continuación es la versión oficial. Las traducciones se someten a revisión antes de su publicación, de modo que nunca se muestra una traducción automática de un documento jurídico como si hubiera sido revisada.

Who is responsible for your information

PSP Innova Inc. is responsible for the personal information described in this policy.

For anything to do with your personal information — to ask what we hold, to have it corrected, to ask us to delete it, or to withdraw a consent you have given — write to techweb@xtirpa.com. That is the address to use, and it reaches the people who can act on it.

You can also write to us on paper, at 1040 Boulevard Industriel, Granby, Québec, Canada, J2J 1A4.

What this site collects, and why

This site collects personal information in four places, and in each one only what the form in front of you asks for. There is no advertising, profiling or sale of personal information of any kind on this site. The only measurement of how the site is used is the analytics described below, and it does not apply to the four forms above in any way that identifies you: analytics never records what you type into them.

One thing does happen on every page whether you fill in anything or not: the software that handles signing in runs on every page, so that a page knows whether you have an account before it draws anything. That software is Clerk's, and it contacts Clerk on each page you open, which means Clerk sees the ordinary details of the request — your IP address and your browser's user agent — for every page of this site you read. It is used to work out whether you have a session and for nothing else. Our cookie policy lists the cookies this involves.

Requesting access to restricted documentation

When you ask for access to the restricted parts of the document library, the form records your name, email address, country, and — if you choose to give them — your organisation, its address, your telephone number, and your reason for asking. This is used to decide whether to grant access, and to send you an invitation if it is granted. The decision is made by a person, not automatically.

Registering a product for warranty

When you register an Xtirpa™ system, the form records your first and last name, your position, your company, the distributor you bought from, your email address, telephone and fax numbers, your street address, city, province or state, and postal code, the language you would like to be written to in, and for each component you register its model number, serial number, purchase date and manufacturing date.

This is used to register the product under the manufacturer's warranty, to generate your registration certificate, and to email that certificate to you. The certificate is stored so that it can be re-sent or looked up later. You are asked to keep the confirmation email as your proof of registration, which is why the registration itself is not deleted on a schedule.

Asking for a quote

When you ask for a quote through the configurator, the form records your name, email address, job role, company, country, province or state, city, any message you write, and which configuration you were looking at. This is used to route your request to the right sales representative and to answer it. The record of which representative it was sent to is kept with the request.

The newsletter

If, and only if, you tick the newsletter box on one of the forms above, your email address is added to a mailing list along with the name, company, telephone number and country that form collected, and a record of what you submitted on it. Nothing adds you to this list except your own choice on a form.

Every newsletter email carries a one-click unsubscribe link that needs no account and no login, and removes your address immediately.

The monthly behaviour report

A small number of people inside the organisation receive a monthly email summarising anonymous visitor behaviour on this site. This list is not something you can join yourself: a super admin adds an address by hand, one at a time, and it holds only that email address and, optionally, a display name. Every report email carries the same kind of one-click unsubscribe link as the newsletter. A record of each month's send is kept for 25 months, the same period the behaviour analytics themselves are kept for; the recipient list itself is kept until a super admin removes an address or the recipient unsubscribes.

If you have an account

Accounts on this site exist so that approved readers can reach restricted documents. An account holds your email address, your display name, your role and whether your account is approved. Authentication itself — your password or sign-in method, and your two-factor settings — is handled by Clerk and is not held on this site's own systems.

Analytics, and how it is switched off

Two systems, under one switch: Google Analytics, and a first-party measurement system this site built and runs itself. Both are off unless you turn them on, and the same choice turns both on and off together.

This site uses Google Analytics to count visits and see which pages are useful. It is the kind of technology that can recognise a returning browser and follow which pages it opens, so it is treated as such:

It is off unless you turn it on. Not loaded-but-restricted — not loaded at all. Until you choose, Google is not contacted, no script is in the page, and no analytics cookie exists. You turn it on from the banner the first time you visit, or from Cookie settings at the foot of any page.

Turning it off again undoes it. The script is removed, Google's own off switch is set for this site, and the cookies it had set are deleted — so switching it on again later starts fresh rather than continuing where it left off.

Refusing costs you nothing. Every page, every document and the whole of your account work exactly the same either way.

What Google receives when it is on is the ordinary information a web request carries — your IP address, your browser, the page you opened — used to count and group visits. Google holds that under its own terms, for a period set on this site's analytics property. Our cookie policy names the two cookies involved.

There is no advertising technology on this site, and nothing here is used to build a profile of you as an individual or shared with anyone for that purpose.

This site's own behaviour measurement

Separately from Google Analytics, this site can run its own first-party measurement of how the public pages are used: roughly where clicks land and what kind of element was clicked, how far a page is scrolled, whether a form field is used and left empty or filled in, whether a page is slow or breaks, clicking the same spot repeatedly, and clicking something that visibly does nothing.

It is not personal information, and it is designed so that it cannot become personal information even by accident:

• it never records what you type into a field, only whether a field was left empty or filled in;
• it never records an IP address, a precise browser identity, or any part of a web address beyond the page itself;
• it never operates on a page reached only by signing in - My Dashboard, the admin area, and every page behind them are entirely outside its reach;
• it keeps a random code in your browser's session memory, never a cookie, for as long as one browser tab stays open, so that the things you do on one visit can be understood together - and that code is never joined to your name, your email address, your account or anything else that identifies you, anywhere in this system.

It is off by default, switched on by the same Analytics choice described above, and as of this writing it has not been turned on. Turning it off stops it sending anything further and clears the session code described above.

Retention. The detailed record is kept for 90 days and then deleted. A daily count of how many of each kind of event occurred - with no detail about any individual visit - is kept for 25 months, to support a once-a-year comparison. These periods are fixed in how the system is built, not a setting an administrator adjusts, because this data has no person attached to it for a retention schedule to protect.

No decision about you is made automatically anywhere on this site. An access request is read and decided by a person.

Information collected automatically

Two things are recorded that you do not type in.

To stop automated abuse of the public forms, the site records the IP address a submission came from, or the email address used, together with the time, so that it can enforce a limit of a few submissions per hour. Where a submission is blocked as automated, the originating IP address is recorded in the administrative audit log.

Administrative actions — approving an account, changing a role, downloading a certificate, deleting a record — are recorded with the identity of the administrator who performed them and the time. This is the record of what was done with your information, and it is deliberately kept.

Where your information is stored and processed

Your information is stored in a database and file storage hosted by Supabase in Amazon Web Services' Canadian region, in Montreal, Québec.

The site itself runs on Vercel. Requests reach Vercel's Montreal edge, but the server-side code that handles them currently executes in the United States. That means your information is processed outside Québec even though it is stored inside it, and the United States does not offer the same legal protections for personal information as Québec does.

Who else sees it

Personal information is shared only with the service providers this site needs to function, and only for that purpose. None of them is permitted to use it for their own ends, and none of it is sold, rented or traded.

• Supabase — the database and file storage where everything is held. Canada.
• Vercel — hosting and server-side execution. United States.
• Clerk — authentication. Holds your email address and sign-in credentials if you have an account, and sees the IP address and user agent of every page request on this site, as described above. United States.
• Cloudflare — sits in front of Clerk's service and our database provider, filtering automated abuse. Sees the request details of anything routed through it. United States.
• Resend — email delivery. Receives the recipient address and the contents of any email we send you. United States.
• Microsoft SharePoint — the source of the documents in the library. Documents are read from it; no personal information is sent to it.
• Google Analytics — counts visits, only if you have switched it on. Receives your IP address, your browser and the pages you open. United States. See the section on analytics above, and our cookie policy for the cookies.

Two services are used for translating this site, and neither one receives personal information. DeepL translates the site's own written copy and document titles. Anthropic produces draft translations of the legal and safety text on this site for a person to review. What is sent to both is text written for publication; nothing you submit through a form, and nothing about your account, is sent to either.

We will disclose personal information where the law requires it, and we will not otherwise.

How long it is kept

Where a period is shown as kept until you ask, nothing deletes that record on a schedule. For a warranty registration that is on purpose: it is your proof of registration, and deleting it would take that from you. For the newsletter it is because your consent lasts until you withdraw it, and you can withdraw it at any time with the link in any newsletter email.

The administrative audit log is not deleted. It records what was done with personal information, including the fact that information was deleted, and erasing it would erase that proof.

Analytics data is kept separately, for 14 months

The table above is this site's own database. Google Analytics is a different system holding different records, so it has its own period and its own number: 14 months. That applies to both kinds of data Google keeps — the individual events, and anything associated with a returning browser — and it is set on the analytics property itself rather than by anything on this site.

It is deliberately not merged into the table above. Two systems with two real figures should be stated as two figures; one combined number would be true of neither.

None of it applies unless you have switched analytics on. If you never do, there is nothing for Google to keep.

Your rights, and how to use them

Under Québec law you may ask us to confirm what personal information we hold about you, to give you a copy of it, to correct it if it is wrong, to stop using it, and to delete it. You may also withdraw a consent you have given.

To do any of those, write to techweb@xtirpa.com, or to the postal address at the top of this policy. We will need enough information to be sure it is your record we are acting on, and we will not ask for more than that.

Three of these you can do without asking anyone. You can leave the newsletter with the unsubscribe link in any newsletter email, which takes effect immediately and needs no account. You can change or withdraw your cookie choice from Cookie settings at the foot of any page, which takes effect on the page you are looking at. And if you have an account, you can see and change your own name and sign-in details from your account settings.

For the rest, we look your record up across every table that holds it and delete what you ask us to, and each deletion is recorded in the audit log with who did it and when. There is no automated portal for this: a person reads your request and a person acts on it.

If you are not satisfied with how we have handled a request, you may complain to the Commission d'accès à l'information du Québec.

Children

This site is documentation and tooling for people who install and use industrial fall-protection equipment at work. It is not directed at children and we do not knowingly collect information about them.

Changes to this policy

The date at the top of this page is when this wording last changed. Where a change affects how your information is used, we will say so rather than quietly replacing the text.