Privacy policy
Last updated:
This policy explains what personal information Tarmac collects, why, and how to exercise your rights. It covers the tarmac.studio site and the Tarmac product.
Who we are and who is responsible
Tarmac is a product of Sphère 3 Solutions inc., in Québec.
The person responsible for the protection of personal information is Christian Leclerc, of Sphère 3 Solutions inc. For any question about this policy or your information, write to the address below.
What this site collects
The tarmac.studio site is static. It uses no cookies, no trackers and no analytics. It contains no form.
The web server keeps technical logs: IP address, user agent and requested pages. They are kept briefly, for security and diagnostics.
What the product collects
Access request
The access request, on id.tarmac.studio, collects your name, email, organization and language. It triggers an internal notification and you receive a bilingual acknowledgement.
Account and organization
Tarmac's identity provider, id.tarmac.studio, keeps:
- your email, name and preferred language;
- your passkeys, that is public keys, never biometric data;
- your devices and sessions;
- your organization memberships and roles;
- invitations, valid for 7 days;
- a security log.
Business data
In Tarmac, on business.tarmac.studio, your organization records its ideas, goals, analyses, framings, wireframes, decisions and comments, along with the Jira Cloud or Azure DevOps links it provides. This data is kept apart per organization.
Why, and on what basis
We use this information for three reasons:
- to provide the service: handle access requests, open and manage accounts, run Tarmac for your organization;
- to keep it secure: protect accounts and diagnose problems;
- to meet our legal obligations, for example giving notice of a confidentiality incident.
AI and web search
Some processing is done by artificial intelligence models: analysis of ideas, framing, wireframes, flows and rebuilding from an existing system. It may take place on servers located in the United States, with a cloud provider.
Only the content the feature needs is sent (ideas, descriptions, answers to questions, framing content, code excerpts). It is not used to train the models. No secret or credential is sent.
No personal data is required for an analysis. The AI cost is visible per project.
For sourced web search, queries derived from the analysis are sent to a third-party search engine. They contain no personal information.
Rebuild from an existing system
To rebuild from an existing system, a person can connect a read-only Git repository. In that case:
- the code archive is retrieved and stored encrypted. It is never executed;
- it is read in memory to produce excerpts, with secrets masked;
- it is deleted automatically at the latest 24 hours after the analysis, or as soon as the analysis is cancelled;
- the Git access token is encrypted, then erased as soon as the archive is retrieved;
- only file paths, symbol names and the AI's findings are kept, never the code itself.
Hosting and transfers
Tarmac's data is hosted in Canada. Some content is sent to third-party services:
- the content AI processing needs, to servers that may be located in the United States;
- web search queries, without personal information, to a third-party search engine;
- the stories and progress your organization chooses to push to Jira Cloud or Azure DevOps.
Retention
- Technical logs of the site: kept briefly.
- Access requests: deleted after 90 days.
- Code archives from a rebuild: deleted at the latest 24 hours after the analysis, or on cancellation.
- Git access tokens: erased as soon as the archive is retrieved.
- Accounts never verified: deleted after 7 days.
- Closed invitations, sessions and delivered events: purged after 30 days.
- Expired codes and challenges: purged daily.
- Business data: kept as long as the organization exists.
- Deleted account: the security log keeps pseudonymized traces of it.
Your rights and how to exercise them
You exercise your rights yourself, in your account on id.tarmac.studio:
- view and correct your profile;
- export your data: a complete JSON file (profile, organizations, devices, sessions, security log), sent as a link by email;
- delete your account: it takes effect at once, after confirmation by code or passkey, and an email confirms it. The security log keeps pseudonymized traces.
The owner of an organization that has other members must transfer ownership before deleting their account.
For any other request, write to the person responsible. You may also turn to the Commission d'accès à l'information du Québec.
Security
The site serves a strict content security policy.
Sign-in uses passkeys. For passkeys, only the public key is kept.
In Tarmac, the server checks permissions on every request and data is kept apart per organization. Every write and every decision goes into an append-only audit log: who, what, when.
Incidents
If a confidentiality incident presents a risk of serious injury, we notify the people concerned and the Commission d'accès à l'information du Québec, as Québec's Law 25 requires.
Changes
This policy may change. The date at the top of the page shows its last update.
Contact
Christian Leclerc, person responsible for the protection of personal information, Sphère 3 Solutions inc., Québec.