GroupConvo privacy policy

Draft — prepared with AI research, not legal advice, not yet reviewed by a lawyer.

Effective date: 27 October 2026 · Operator: TJ-Hosting · Contact: contact@tj-hosting.ca

[q6, answered 12 Oct 2026: TJ-Hosting is the operator. Its legal form and mailing address are still to confirm: lawyer review list item 5.]

Notes for the editor are in square brackets. Clause sources are in the table at the end; section numbers (§) refer to research/LEGAL-RESEARCH-2026-10-12.md in the project store.

GroupConvo collects very little about you. This policy says what we collect, why, how long we keep it, who else sees it, and what you can ask us to do.

1. Who is responsible

TJ-Hosting, of Ontario, Canada, runs groupconvo.com and decides how personal information collected through it is used (in UK terms, the "controller"). Contact: contact@tj-hosting.ca.

[UK REPRESENTATIVE: if a lawyer confirms that UK GDPR applies and the Article 27 exemption does not, name the UK representative here — see §3.3.]

2. What we collect

When you just read the site:

• Server logs. Like almost every website, our web server records each request: your IP address, the page you asked for, the time, and your browser's description of itself (user agent). We use these logs to keep the site running and secure. [PROPOSED RETENTION: 14 days, then deleted. Confirm the VPS's actual log rotation before launch.]
• Two cookies that the site needs to work: a session cookie and a security cookie that protects the report form against forged requests (CSRF). They are strictly necessary, so we don't ask for consent for them. They hold no advertising or tracking identifiers and expire after 2 hours without activity.
• Session records. The session behind that cookie is stored on our server with your IP address and user agent, and is deleted after about 2 hours without activity. [Build A stores sessions in the database (SESSION_DRIVER=database, SESSION_LIFETIME=120), and Laravel's database driver records the IP address and user agent; check the chosen build's setting before launch.]

We don't use advertising, social-media trackers or third-party fonts, and we use analytics only if you accept it (below). We don't build profiles of visitors.

If you accept Google Analytics:

• We use Google Analytics 4, a Google service, to count visits: the pages viewed, the type of device and browser, the page that sent you here, and your rough location (country and city), which Google estimates from your IP address. Google says Google Analytics 4 doesn't store IP addresses.
• It loads only if you choose Accept in the cookie banner. Until you choose, and if you choose Decline, no Google script runs and no Google cookie is set.
• If you accept, Google Analytics sets two cookies, _ga and _ga_ followed by an ID, that tell repeat visits from the same browser apart. They expire after 2 years. Google handles the data on its servers, including in the United States. The legal basis is your consent. Google keeps the data for [PROPOSED: 2 months, Google Analytics 4's default; confirm the property's data-retention setting].
• We remember your choice in a cookie of our own, gc_consent, for 6 months. It holds only "accepted" or "declined".
• You can change your mind at any time: choose Cookie settings at the bottom of any page, then Decline. That stops Google Analytics on this site and removes its cookies from your browser.

When you report a debate:

• the debate you reported, the reason you chose, and anything you typed in the optional details box (please don't include personal information there);
• a keyed hash of your IP address — a scrambled code made from your IP address and a secret key. We use it to stop one person flooding the report button. We can't read your IP address back from it, but because the same address always makes the same code, we treat it as personal information;
• the time of the report.

When you email us: your email address, your message and anything you choose to send.

We don't knowingly collect information from children under 13 (see section 8).

3. Why we use it

A report automatically hides the debate until a person reviews it. That affects the debate, not you: no decision about you is made automatically.

We don't sell your personal information or share it for advertising.

4. Who else sees it

• Our hosting provider, which runs the server the site is on: [HOSTING PROVIDER AND SERVER LOCATION — project memory says an IONOS VPS; confirm the data-centre country before launch].
• Professional advisers (for example a lawyer) when we need advice about a report or complaint.
• Authorities or courts, if the law requires it.

We don't send your personal information to the AI model providers. The debates are generated on our own computer from published news stories; nothing a visitor submits goes into a debate or to a model.

5. Where it is stored

The operator is in Canada; the server is in [SERVER COUNTRY]. If you are in the UK or elsewhere, your information is handled outside your country. [UK transfers: the UK has adequacy regulations for Canada that cover organisations subject to PIPEDA; whether they cover this site depends on whether PIPEDA applies to it — see §3.3 and the lawyer review list.]

6. How long we keep it

7. Your rights

You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it, and you can object to how we use it. Write to contact@tj-hosting.ca. We answer within 30 days. We may need to check it's really you; because we only store a hash of IP addresses, we may not be able to find a report you sent unless you tell us when you sent it and which debate it was about.

You can also complain to a regulator:

• Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• UK: the UK data protection regulator (the Information Commissioner's Office, renamed the Information Commission in 2026 [verify name and website at launch]).
• U.S.: we don't sell or share personal information as California law defines it, and we don't meet the thresholds of the U.S. state privacy laws; you can still ask us any of the above.

8. Children

GroupConvo isn't directed to children under 13, and we don't knowingly collect personal information from them. If you think a child has sent us personal information, write to us and we will delete it.

9. Security

The server uses encrypted connections (HTTPS). Access to the admin area is limited to the operator. Report data is stored only on our server. No system is perfectly secure; if a breach puts your information at real risk, we will tell the people affected and the regulators the law requires.

10. Email from us

We don't send email today. If we ever start a newsletter or similar, we will ask for your consent first, say clearly who is sending it, and include an unsubscribe link in every message.

11. When voting launches

[This section does not apply yet.] When we add accounts or voting, we will collect more: for example an email address for your account and the votes you cast. Votes on political statements can reveal your political opinions, which UK and EU law treat as special category data; we will ask for your explicit consent, show votes only as totals, and update this policy before launch. We will set a minimum age for accounts [MINIMUM AGE — see §3.3].

12. Changes

We will update this policy when what we collect changes. The effective date at the top shows the current version; material changes are noted on the site.

Source table