ArrHub Privacy Policy
Version 1.3 · Last revised 10 October 2026
1. Who we are
This policy is issued by Dalimer Outsourcing Inc., doing business as ArrHub, 83 West St-Paul Street, Montreal, Quebec H2Y 1Z1, Canada (NEQ 1176062009) ("ArrHub", "we").
It explains what personal information ArrHub collects, why, to whom we communicate it, how long we keep it and how you can exercise your rights. It applies to arrhub.com and to every ArrHub site that links to it, to ArrHub Alerts and to our correspondence. It covers visitors to the site, subscribers and their named users, people who write to us, and professionals we contact.
This policy is published in French and in English.
2. The person in charge
ArrHub's Privacy Officer is the person in charge of the protection of personal information. The Privacy Officer approves this policy and the practices that implement it, handles requests and complaints, and can be reached at:
Privacy Officer, ArrHub
privacy@arrhub.com
83 West St-Paul Street, Montreal, Quebec H2Y 1Z1, Canada
3. What we collect, why, and how
| You are | What we collect | Why | How |
|---|---|---|---|
| A visitor to the site | The technical data your browser sends: IP address, browser type, page requested, date and time | To deliver pages and keep the site secure | Automatically, by our hosting provider, when a page loads |
| A visitor who accepts audience measurement | Pages viewed, how you arrived, approximate location (city or region), device and browser type, and a random identifier stored in a cookie | To learn which pages are read | Through Google Analytics, only after you choose "Accept all" or turn on audience measurement (section 4) |
| A subscriber or named user | Name, work email, company, billing address, business name, tax numbers where provided, subscription status and dates, the language in which you receive the issues, and the version of the subscriber terms you accepted and when | To provide ArrHub Alerts Premium, send issues in your language, bill, keep accounting and tax records, and answer support requests | From you, at checkout or on an order form; payment records from Stripe, which holds your language preference with the subscription |
| A reader of ArrHub Alerts in a Nutshell by email | Email address, the language you choose, the page where you signed up, the network part of your IP address, the identification your browser sends, and the record of your consent: the date, the time and the version of the text you agreed to | To send you the free edition each week in your language, to confirm that the address is yours, and to show that you asked for it | From you, when you sign up on the site and open the confirmation link we send to that address |
| Someone who writes to us | Name, email, company, subject and message | To reply, and to handle correction and coverage requests | From you, through the contact form or by email |
| A professional we contact about ArrHub | Name, title, company, and work email or professional profile | To introduce ArrHub to people whose work involves the records it reports | From public professional sources, such as company websites and professional networks |
Card payments are processed by Stripe on its own payment page. We do not receive or store full card numbers.
We collect only what these purposes require. We do not collect sensitive information, such as health information, and we do not ask for it.
Public register records. The registry and the weekly issue report entries from public registers, such as FDA and Health Canada databases. Some entries may name an individual in a professional capacity, for example the contact person on a regulatory submission. We reproduce such a field only as the register publishes it, with a link to the source, and we do not compile profiles of individuals. Section 10 explains how to ask us to review an entry that concerns you.
4. Cookies and audience measurement
The site uses Google Analytics only if you accept it. Until you choose, no audience-measurement cookie is set and no request is sent to Google.
Google Analytics includes functions that could allow a person to be identified, located or profiled. They are off by default and are activated only by your choice in the cookie banner, or in "Paramètres des témoins / Cookie settings" at the foot of every page, where you can also withdraw your consent at any time.
We do not use advertising cookies. We have turned off Google's advertising features and Google signals, and we do not link audience-measurement data to your name or email address. The cookie policy at arrhub.com/legal/cookies lists every cookie the site sets.
The language of a page is part of its address (arrhub.com/fr for French). The site sets no cookie to remember your language.
5. Consent and your choices
When you give us personal information for a purpose described in section 3, you consent to its use and communication for that purpose. For any other purpose, including audience measurement, we ask for your consent separately.
When you sign up for ArrHub Alerts in a Nutshell by email, you consent to receive it each week. The signup takes effect only when you open the confirmation link we send to the address given; a request not confirmed within 7 days is deleted. Every issue carries a link to unsubscribe, which takes effect at once. We keep the record of your consent for the period stated in section 8. We do not share the list of readers with anyone; Resend delivers the issues as our service provider (section 6).
You may withdraw your consent at any time, by writing to privacy@arrhub.com, by changing your cookie settings, or by replying to one of our messages to ask us not to write again. Withdrawal may prevent us from providing a service that depends on the information, such as delivering a subscription.
Every message we send to introduce ArrHub identifies us and tells you how to ask us to stop. If you ask, we stop, and we keep only your email address on a do-not-contact list so that we can honour your request.
We do not sell personal information, and we do not use it for advertising. We do not make any decision about you based exclusively on automated processing of your information.
6. To whom we communicate it
Within ArrHub, access is limited to the people who need it for their work; today, that is the editor.
We use the service providers below. Each receives only what its service requires, under a written agreement that limits its use of the information to that service.
| Provider | Service |
|---|---|
| Vercel | Website hosting |
| Supabase | Database, hosted in Montréal |
| Stripe | Payment processing, and merchant of record for payments at checkout |
| Anthropic | AI tools for drafting, verification, software development and automated translation, processing on ArrHub's behalf |
| Resend | Email delivery |
| Microsoft | Email mailboxes (Microsoft 365) |
| Audience measurement, only with your consent |
For card payments at checkout, Stripe Managed Payments applies and Sold through Link, LLC acts as merchant of record: it calculates and remits taxes, issues receipts, and handles payment inquiries, refunds and disputes, under its own privacy policy. Stripe also processes payment information to meet its own legal obligations, such as fraud prevention.
Anthropic, PBC (United States) provides the AI tools ArrHub uses to draft and check its texts, to develop its software and to translate the issues into French. Those tools process the texts and code ArrHub gives them, which may include personal information that a public register publishes in a professional capacity. ArrHub does not entrust subscriber, reader or correspondent records to them. ArrHub uses Anthropic's API, under Anthropic's commercial terms, for automated translation. Other Anthropic tools the editor uses do not receive subscribers' personal information.
We may also communicate information to our accountants and legal advisers, who are bound by confidentiality; to authorities, when the law requires it; and, if ArrHub or its business is sold, financed or reorganised, to the other party to that transaction, under the conditions the law sets.
7. Information outside Québec
Vercel, Stripe, Resend, Google and Anthropic are located in the United States, and Microsoft may keep mailbox data outside Québec.
Supabase keeps our database in Montréal; its staff may access it from outside Québec for support.
Before we entrust personal information to a provider outside Québec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose for which it will be used, the protection measures that will apply, including contractual ones, and the legal framework of the place concerned. We record the arrangement in a written agreement.
Information kept outside Québec is subject to the laws of the place where it is kept, which may allow the authorities there to access it.
8. How long we keep it
| Information | Kept for |
|---|---|
| Subscription record: name, work email, company, status, language, and the version of the terms accepted | The subscription, and 12 months after it ends |
| Nutshell reader record: email address and language | Until you unsubscribe |
| Record of your consent to the Nutshell edition: the date and time, the version of the text you agreed to, the page where you signed up, the network part of your IP address and the identification your browser sends | 24 months after you unsubscribe |
| A signup request not confirmed | 7 days |
| Invoices, receipts, payment and tax records | The period tax laws require |
| Messages you send us | 24 months after the last exchange, unless they form part of a subscription record |
| Professional contact details used to introduce ArrHub | Until you ask us to stop, or 24 months after our last message if you have not replied |
| Do-not-contact list | As long as needed to honour your request |
| Audience-measurement data held by Google | 2 months |
| Audience-measurement cookies in your browser | Up to 2 years, unless you withdraw your consent or delete them |
| Record of your cookie choice | 12 months |
| Technical server data | A short period set by our hosting provider, for operation and security |
At the end of the period, we destroy the information or anonymize it, subject to any longer period a law requires.
9. Security
We protect personal information with measures suited to its sensitivity: encrypted connections to the site, access limited to the people who need it, and providers chosen for their security practices. No system is completely secure.
If a confidentiality incident occurs, we take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature, and we record it in our register of incidents. Where it presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the people concerned.
10. Your rights
You may ask us:
- to confirm whether we hold personal information about you, to see it and to obtain a copy;
- to receive the information you gave us in a structured, commonly used technological format, or to have it sent to a person or body authorised by law to collect it;
- to correct information that is inaccurate, incomplete or equivocal, or to delete information whose collection, communication or keeping is not authorised by law;
- where the conditions the law sets are met, to stop disseminating information about you or to de-index a hyperlink attached to your name;
- to tell you where we obtained information about you;
- to withdraw your consent (section 5).
How to make a request. Write to the Privacy Officer at privacy@arrhub.com or at our postal address. We may ask you to confirm your identity. We reply in writing within 30 days of receiving your request. Access is free; if you ask for a transcription, reproduction or transmission of information, we may charge a reasonable fee and will tell you the approximate amount beforehand. If we refuse a request, we give you our reasons, the provision of law on which the refusal is based, and the recourse available to you.
Complaints. Send any complaint to the Privacy Officer first; we acknowledge it and reply in writing within 30 days. You may also apply to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) and, where the federal law applies, to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
11. If you are in the European Union or the United Kingdom
Where the GDPR or the UK GDPR applies, we rely on: performance of a contract, for subscriptions; your consent, for audience measurement; our legitimate interests in operating and securing the site, replying to messages and introducing ArrHub to professionals, to which you may object at any time; and our legal obligations, for accounting and tax records.
You also have the rights to erasure, to restriction of processing and to object, and you may lodge a complaint with the supervisory authority where you live or work.
The European Commission recognises Canada as providing adequate protection for commercial organisations subject to PIPEDA. Transfers to providers in the United States rely on the safeguards those providers offer, such as the EU-U.S. Data Privacy Framework or standard contractual clauses.
12. Minors
ArrHub is a service for professionals. It is not directed at minors, and we do not knowingly collect personal information about anyone under 14.
13. Our privacy practices
The Privacy Officer approves this policy and the practices that implement it. In short:
- Keeping and destruction. The periods in section 8 apply. At the end of each period, the information is destroyed or anonymized.
- Roles and responsibilities. The Privacy Officer is responsible for protecting personal information. Access within ArrHub is limited as section 6 describes, and providers act only under written agreements.
- New systems. Before we acquire, develop or overhaul a system that handles personal information, and before we entrust information to a provider outside Québec, we conduct a privacy impact assessment proportionate to the sensitivity of the information.
- Incidents. We keep a register of confidentiality incidents (section 9).
- Complaints. The Privacy Officer handles them as section 10 describes.
14. Changes to this policy
We publish each new version of this policy on this page with its revision date; previous versions remain available at their permanent addresses. When a change affects how we use or communicate your information, we announce it on the site, and we tell subscribers by email, before it takes effect.