Privacy Policy

This Privacy Policy explains how The Molly Project ("we," "us") collects, uses, and protects personal information in connection with the SBILT prototype (mollyproject.io). It is intended to comply with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

01 / Identity

Who We Are & Privacy Officer

The Molly Project is a Quebec-based research initiative developing AI-powered interview training tools.

The person responsible for the protection of personal information (responsable de la protection des renseignements personnels) as required by Law 25 is:

02 / Collection

What We Collect & Why

2.1 Access Request Form

When you submit a tester access request on our website, we collect your email address. It is used solely to respond to your request and, if approved, to send you access credentials. Your email is stored on our server (OVH Canada, Beauharnois QC) and sent to our team via our own mail relay. We do not use it for marketing without your explicit consent.

2.2 Session Interaction Logs

When you use the SBILT prototype, your practice conversations are recorded in anonymous session logs stored on our server. These contain: conversation text, timestamps, random session identifiers (not linked to your identity), and interaction metrics (rapport scores, ORBIT quadrant data). These logs are used to evaluate and improve the tool for research purposes.

2.3 Server Logs

Our web server automatically records standard technical data including IP addresses, browser type, and access times. This is retained for 30 days for security and diagnostic purposes and is not used to identify you personally.

2.4 Authentication Credentials

Access to the SBILT prototype requires a username and password issued by us. Credentials are stored in encrypted form on our server. Authentication attempts are not logged beyond standard security monitoring.

03 / Retention

How Long We Keep Your Information

04 / Third Parties

Who We Share Your Information With

We do not sell or rent your personal information. We share it only with the following service providers as necessary to operate this prototype:

• OVH Canada Inc. (Beauharnois, Québec) — Provides server hosting. Your data is stored in Quebec, Canada.
• Cohere Inc. (Toronto, Ontario) — AI model provider used to generate persona responses and coaching feedback. Your conversation content is transmitted to Cohere during practice sessions. Cohere is a Canadian company subject to Canadian privacy law.
• Brevo SAS (Paris, France) — Email relay used to deliver access request notifications to our team. Subject to GDPR and their own privacy policy.

05 / Cross-Border Transfers

Transfers Outside Quebec

The majority of your data is processed in Canada (OVH Beauharnois QC, Cohere Toronto ON). Email notifications are relayed via Brevo SAS (Paris, France / EU). Personal information is transferred to these providers only to the extent necessary to operate the prototype and provide the requested services.

In accordance with Quebec Law 25, we have assessed that reasonable contractual and technical measures are in place to ensure an adequate level of protection for your information during these transfers. For questions about these transfers, contact us at info@mollyproject.io.

06 / Your Rights

Your Rights Under Law 25 & PIPEDA

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information (subject to legal retention obligations)
• Withdraw consent at any time, which may affect your ability to use the service
• Data portability — request a copy of information you provided, in a structured, commonly used format
• File a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca, or the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca

To exercise any of these rights, contact info@mollyproject.io. We will respond within 30 days.

07 / AI & Automated Processing

Automated Decision-Making

The SBILT prototype uses artificial intelligence (Cohere Command R+, Toronto ON) to generate persona responses and coaching feedback during practice sessions. This AI processing:

• Is used solely for educational and training purposes
• Does not make decisions with legal or significant consequences affecting you
• Does not create profiles used to determine access to services

No automated profiling is used to make decisions that affect your rights.

08 / Security

Security Measures

We take reasonable technical and organizational measures to protect your personal information, including:

• HTTPS encryption for all web traffic (TLS via Let's Encrypt)
• Password-protected access to the prototype (credentials stored in encrypted form)
• Server hosted in a Canadian data centre (OVH, Beauharnois, Québec)
• Brute-force protection and firewall hardening on the server

In the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information and affected individuals as required by Quebec Law 25.

09 / Cookies

Cookies & Tracking

The SBILT prototype does not use tracking cookies or advertising technologies. The practice sessions use browser memory (sessionStorage) to maintain your current session — this is not a tracking cookie and is cleared when you close the tab.

Third-party resources loaded by this site (Google Fonts, CDN libraries) may set their own cookies subject to those providers' policies.

10 / Updates

Changes to This Policy

We may update this policy as the prototype evolves. The revised policy will be posted on this page with an updated date. We encourage you to review it periodically.

11 / Contact

Questions & Rights Requests

For any privacy questions, rights requests, or concerns: