Quebec Law 25

Quebec's Law 25 (formerly Bill 64; the “Act to modernize legislative provisions as regards the protection of personal information,” chapter 25 of the 2021 Quebec statutes) is the strengthened privacy regime that applies in Quebec as of its phased-in dates between September 2022 and September 2024.

Wirehead serves residents of Quebec and is subject to Law 25 in addition to the federal PIPEDA. This page summarizes how we comply.

Privacy officer

The Founder is the named Chief Privacy Officer responsible for Law 25 compliance. Contact privacy@wirehead.com.

Consent in French and English

All consent prompts on the Platform are available in both English (EN-CA) and French (FR-CA) per Quebec Bill 96 and the Law 25 plain-language requirement (§14). Consent is granular: marketing emails are a separate opt-in from transactional emails, and either can be withdrawn from your /account/privacy page or from any email's unsubscribe link.

Privacy by default

Per Law 25 §9.1, profiling and tracking are off by default. Wirehead does not run third-party advertising trackers. Our analytics (PostHog, self-hosted) runs cookieless and does not capture IP addresses. Identification only occurs when you sign in.

Cross-border data transfer disclosure

Per Law 25 §63.5, organizations must disclose when personal information is transferred outside Quebec. Our data is currently stored with vendors in the United States (Neon, Vercel, R2 on Cloudflare US edge). A Canada Central region migration is planned for post-launch to align with Law 25 data-residency preferences. The full list of cross-border processors and what each one processes is in our Privacy Policy.

Your rights under Law 25

• Right of access. See your data at /account.
• Right of correction. Edit your data at /account.
• Right of erasure / de-indexing. Delete your account from /account/privacy. A two-step soft-delete + 24-hour restore window gives you a buffer; after 24h the account is hard-deleted.
• Right of data portability (in force since September 2024). Until our machine-readable export endpoint ships, contact privacy@wirehead.com for a copy of your data.
• Right to be informed of automated decision-making. See our AI Policy for what is automated and what is not.

Breach notification

If a confidentiality incident creates a risk of serious harm, we will notify affected individuals and the Commission d'accès à l'information du Québec as required by Law 25 §3.5.