Skip to main content
ConKarma

Quebec Privacy Addendum (Law 25)

Effective Date: April 26, 2026 Last Updated: July 21, 2026

This Addendum supplements the ConKarma Privacy Policy for individuals in Quebec, Canada, in line with An Act respecting the protection of personal information in the private sector (CQLR c P-39.1) as modernised by Law 25 (2021). Capitalised terms not defined here have the meaning given in the main Policy.

1. Person in Charge of Personal Information

The person in charge of the protection of personal information at XTZ Group, Inc. for Quebec purposes is reachable at legal@conkarma.app with the subject "Quebec privacy request". This individual is responsible for ensuring the Service complies with the Act.

2. Categories Collected and Purposes

Same categories as in the main Privacy Policy §2. We collect each category for the specific purposes listed there; we do not use personal information for new purposes without obtaining fresh consent or otherwise complying with the Act.

3. Consent — Granular and Express

Where consent is the basis for processing, we obtain it expressly, in clear and simple terms, and separately from any other information. In particular:

  • Adult features require an opt-in age confirmation that is distinct from account creation.
  • Optional analytics are off by default in regions where consent is required for non-strictly-necessary processing.
  • Marketing communications, where ever offered, will require separate opt-in.

You may withdraw any consent at any time. Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

4. Automated Decision-Making (s. 12.1)

We do not use personal information to render decisions based exclusively on automated processing that produce legal effects on you or significantly affect you. If we ever introduce such processing, we will inform you, explain the principal factors and parameters, and offer the right to have the decision reviewed by a person.

5. Your Rights

You have the right to:

  • Access the personal information we hold about you (Settings → Export my data).
  • Rectify inaccurate, incomplete, or equivocal information.
  • Withdraw consent at any time without affecting prior lawful processing.
  • Cease dissemination, de-index, or re-index information, where the legal conditions in s. 28.1 are met (right to "deindexation").
  • Receive your information in a structured, commonly-used technological format and have it transmitted to another person or body authorised by law (data portability — entry into force: September 22, 2024).
  • Submit comments that will be added to a file containing your information.

To exercise these rights, email legal@conkarma.app. We respond within 30 days.

6. Cross-Border Transfers (s. 17)

Personal information is transferred to and processed in the United States and — for coarse GeoIP resolution from your IP address only — by a provider in Germany (the European Union). Before transferring, we conduct a privacy-impact assessment that considers the sensitivity of the information, the purposes, the protective measures including contractual ones, and the legal framework of the destination jurisdiction. Transfers proceed only when the assessment shows the information will receive protection equivalent to that provided under Quebec law.

Transfer mechanisms in current use:

  • Contractual safeguards with our infrastructure providers (Google LLC for Firebase services, Supabase, Inc. for managed Postgres + object storage with AWS as Supabase's own downstream sub-processor, a standard SMTP relay service for transactional email, and freeipapi.com in Germany for coarse GeoIP resolution — which receives only your IP address) that bind them to comparable confidentiality, security, and data-subject-rights commitments.
  • Standard Contractual Clauses modelled on the EU 2021/914 set, adapted to Quebec terminology.

7. Privacy Impact Assessment (s. 3.3 / 3.4)

A summary of the PIAs we maintain is available on request to legal@conkarma.app. The PIAs cover (a) the adult-feature flow, (b) the parental-consent flow, and (c) third-party transfers.

7a. Emergency Check-In Geolocation (Opt-In)

When you (or a verified parent on a child's behalf) turn on Emergency location sharing in Settings AND toggle "Share my location with this alert" on a specific emergency check-in, the app may include your latitude and longitude with that check-in. This is an opt-in, per-checkin flow — no background tracking. Under Law 25, geolocation is sensitive personal information and requires manifest, free, enlightened, and specific consent for each defined purpose; the consent screen shown before the first grant satisfies that requirement, and consent can be withdrawn at any time in Settings → Emergency location sharing. Retention horizon for Quebec users: 7 days (Law 25 data-minimisation), after which the coordinates are deleted while the "safe" / "need help" record itself remains without location. Revocation deletes any retained coordinates within minutes.

8. Confidentiality Incidents (s. 3.5)

We maintain a register of confidentiality incidents and will notify the Commission d'accès à l'information and affected individuals where the incident presents a risk of serious injury, in line with the Act.

9. CAI Complaints

You may file a complaint with the Commission d'accès à l'information du Québec (CAI) at https://www.cai.gouv.qc.ca if you believe your rights have not been respected.

10. Adult-zone (Ember) — sensitive information, express consent + retention

For Quebec residents, adult-zone (Ember) content — intimacy, fantasy, desire, and related entries — is sensitive personal information under Law 25 (s. 59): information that, by its nature (in particular information concerning sex life), or because of the context of its use or communication, entails a high level of reasonable expectation of privacy. Sensitive personal information may only be processed on the basis of express consent that is manifest, free, enlightened, and given for specific purposes (s. 12, s. 14). We therefore obtain your express consent separately from any other consent before any adult-zone processing begins:

  • Express, separate consent. The opt-in toggle in Settings → Ember privacy is presented on its own, with the consequence of every choice (retention window, backup scope, export scope) shown directly above the control. Consent is granular and revocable, and is sought distinctly from account creation and from any other request for consent.
  • Adult-zone usage analytics (separate express consent, default OFF). Only if you give the separate adult-analytics express consent — sought distinctly, in Settings → Ember privacy — do we send anonymised, surface-level Ember usage metadata to Google Analytics 4: which feature was used and a coarse action verb, under a pseudonymous GA4 client identifier only, with no personal information, no user-generated content, and no content-level detail (we log that a feature was used, never which specific act, scene, or content). Being sex-life-adjacent, this is sensitive personal information under s. 59 and is processed only on your manifest, free, enlightened, and specific consent (s. 12, s. 14), sought separately from any other consent — the same standard applied to geolocation in §7a. Google Signals, ads-personalisation, and Google data-sharing are OFF for this stream; it is never used for advertising. You may withdraw this consent at any time in Settings → Ember privacy, independently of your adult-zone access.
  • Default 3-year retention. Configurable in Settings → Ember privacy from 90 days to 10 years; you control the duration. Adult-zone rows are hard-deleted on window close.
  • Per-device enable. Adult-zone access is OFF by default on every non-primary device; you opt in per device. The audit log of changes is retained alongside the user record for the same period as the account, then destroyed.
  • Backup-exclusion toggle (Settings → Ember privacy) lets you opt the Ember subset out of iCloud / Drive backups.
  • Export-inclusion toggle lets you opt adult-zone rows into your portability/access export (default OFF — so exports stay sharing-safe).
  • Withdrawing consent. You may withdraw your adult-zone consent at any time (off-toggle in Settings → Ember privacy). On withdrawal we hard-delete every adult-zone row attributable to you within 30 days, and exclude those rows from any pending portability/access export.
  • Retention limitation (s. 23). Once the purpose for which adult-zone information was collected is served, the information is destroyed or anonymised in accordance with the retention period you set; we do not keep it longer than necessary. The retention preference and per-device enable state are themselves retained only for the life of the account or until you revoke them.

ADR-120 — no automated content model on Ember. No automated content model, classifier, moderation engine, or other automated processing operates over adult-zone (Ember) content without your express consent. We do not profile, score, or analyse Ember entries by automated means absent that consent.

Automated decision-making (s. 12.1). Consistent with §4 above, no decision based exclusively on automated processing is made about you in the adult zone (or elsewhere) that produces a legal effect or otherwise significantly affects you. Should that ever change, you have the right under Law 25 to be informed of it, to be told the principal factors and parameters that led to the decision, and to have it reviewed by a person.

11. Children's Data

Child-specific data is purpose-bound and minimised: we collect only what a child-account feature requires for its stated purpose and retain it no longer than that purpose needs, per the canonical COPPA Data Retention Policy. Under Law 25, where consent is required for the collection, use, or communication of the personal information of a minor under 14 years of age, that consent is given by the person having parental authority. For minors 14 and over, consent may be given by the minor or by the person having parental authority. We design child-account flows so that parental authority is exercised where the Act requires it.

12. Governing Law and Language

  • Governing law. Notwithstanding any general choice-of-law clause in the Terms of Service, if you are a consumer resident in Quebec, your relationship with ConKarma is governed by the law of the Province of Quebec.
  • Arbitration / class-action waiver. The mandatory-arbitration and class-action-waiver provisions in Terms of Service §17 do not apply to Quebec consumers. Under the Quebec Consumer Protection Act, a consumer cannot be compelled to arbitrate or be deprived of the right to bring or join a class action; Quebec consumers retain access to the courts of Quebec, including the Cour du Québec and class proceedings.
  • Limitation of liability. The Limitation of Liability in Terms of Service §15 is subject to its statutory carve-outs and to the mandatory protections of the Consumer Protection Act and the Civil Code of Québec; nothing in Terms of Service §15 limits liability that cannot be limited or excluded by law as to a Quebec consumer.
  • Language (Bill 96). In accordance with the Charter of the French Language as amended by Bill 96, a French-language version of the Terms of Service, this Privacy Policy, and the End-User Licence Agreement is available, and Quebec users have the right to be served and to communicate with us in French. To obtain French-language copies or to be served in French, contact legal@conkarma.app.

13. Changes

Material changes to this Addendum are communicated via in-app notice and updated Last Updated date.