Legal
This Privacy Policy explains how The Molly Project ("we," "us") collects, uses, and protects personal information in connection with the SBILT prototype (mollyproject.io). It is intended to comply with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
01 / Identity
The Molly Project is a Quebec-based research initiative developing AI-powered interview training tools.
The person responsible for the protection of personal information (responsable de la protection des renseignements personnels) as required by Law 25 is:
02 / Collection
2.1 Access Request Form
When you submit a tester access request on our website, we collect your email address. It is used solely to respond to your request and, if approved, to send you access credentials. Your email is stored on our server (OVH Canada, Beauharnois QC) and sent to our team via our own mail relay. We do not use it for marketing without your explicit consent.
2.2 Session Interaction Logs
When you use the SBILT prototype, your practice conversations are recorded in anonymous session logs stored on our server. These contain: conversation text, timestamps, random session identifiers (not linked to your identity), and interaction metrics (rapport scores, ORBIT quadrant data). These logs are used to evaluate and improve the tool for research purposes.
2.3 Server Logs
Our web server automatically records standard technical data including IP addresses, browser type, and access times. This is retained for 30 days for security and diagnostic purposes and is not used to identify you personally.
2.4 Authentication Credentials
Access to the SBILT prototype requires a username and password issued by us. Credentials are stored in encrypted form on our server. Authentication attempts are not logged beyond standard security monitoring.
03 / Retention
| Type | Retention Period |
|---|---|
| Email addresses (access requests) | Until the research phase concludes, or upon your deletion request |
| Session interaction logs | Up to 12 months, then anonymized or deleted |
| Server access logs (IP addresses) | 30 days |
| Authentication credentials | Until access is revoked or the prototype is discontinued |
04 / Third Parties
We do not sell or rent your personal information. We share it only with the following service providers as necessary to operate this prototype:
05 / Cross-Border Transfers
Your account data and session logs are hosted in Canada (OVH, Beauharnois QC). Our use of AI involves two distinct cross-border activities, both currently taking place in the United States: (1) real-time inference — during practice sessions your conversation content is transferred to OpenRouter, Inc. and Google LLC (US) to generate persona responses and coaching feedback; and (2) development and tuning — anonymized practice transcripts may be reviewed via Anthropic PBC (US) to evaluate and improve the tool. Email notifications are sent from our Québec server and delivered to our team mailbox hosted by Zoho in Canada (Toronto, Ontario), remaining within Canada. We are actively working to bring both AI activities onto Canadian infrastructure. Personal information is transferred only to the extent necessary to operate the prototype.
This is an early-stage prototype offered only to a small group of invited testers, who are informed of these data flows in advance. We rely on our providers' standard data-processing terms for these cross-border transfers and are working to formalise our assessment under Quebec Law 25 as the project matures. If you have any questions or concerns about how your information is handled, please contact us at info@mollyproject.io before using the prototype.
06 / Your Rights
You have the right to:
To exercise any of these rights, contact info@mollyproject.io. We will respond within 30 days.
07 / AI & Automated Processing
The SBILT prototype uses artificial intelligence — Google's Gemini model, accessed via OpenRouter, Inc. (United States) — to generate persona responses and coaching feedback during practice sessions. This AI processing:
No automated profiling is used to make decisions that affect your rights.
08 / Security
We take reasonable technical and organizational measures to protect your personal information, including:
In the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information and affected individuals as required by Quebec Law 25.
09 / Cookies
The SBILT prototype does not use tracking cookies or advertising technologies. The practice sessions use browser memory (sessionStorage) to maintain your current session — this is not a tracking cookie and is cleared when you close the tab.
10 / Updates
We may update this policy as the prototype evolves. The revised policy will be posted on this page with an updated date. We encourage you to review it periodically.
11 / Contact
For any privacy questions, rights requests, or concerns:
Louis Vaillancourt
Privacy contact: info@mollyproject.io
Website: mollyproject.io
Regulatory authority: Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca