In short
No account and no cookie. Audience measurement without cookies, as aggregated statistics. No advertising, no advertising tracker, no data sold. The listings in the Brazilian section present companies, never individuals.
Data controller
Grégory Payotte, publisher of Payotte (natural person), Mirabel (Quebec), Canada. Form: payotte.com/contact. Email: gregory@payotte.com.
What we process, why and for how long
| Processing | Data | Purpose | Retention |
|---|---|---|---|
| Website hosting | IP address, browser, page requested, date and time (server logs) | Serving the pages and keeping the site secure | At most 6 months |
| Audience measurement (Cloudflare Web Analytics) | Page viewed, referring page, type of browser and device, country; no cookie, no identifier stored on your device | Knowing which pages are read, in aggregated figures | Aggregated statistics, with no IP address or identifier |
| Counting visits coming from our emails | Only if the link carries an src parameter: that campaign code, and your IP address | Counting one visit per person per day for each mailing | IP address automatically erased after 2 days; afterwards, only totals per mailing, per hour and per day |
| Messages you send us (form or email) | Your address, your name if given, the content of the message | Replying to you and handling your request, including a request to exercise your rights | 3 years after the last exchange |
The listings link to third-party sites (firms, registers) whose practices are not covered by this policy.
Cookies and trackers
The site sets no cookie and uses no advertising tracker. Audience measurement works without cookies or any identifier stored on your device; this is why no consent banner is shown.
Recipients and processors
GoDaddy (site hosting), Cloudflare (audience measurement, server and storage for the visit count), Resend (sending the contact form messages) and Google (the Gmail inbox that receives them). No data is sold, rented or handed over.
Brazilian data protection law
Payotte is operated from Canada. Brazil's general data protection law is Lei nº 13.709 of 14 August 2018, the Lei Geral de Proteção de Dados Pessoais (LGPD). According to its article 3, as consolidated on the website of the Câmara dos Deputados (text of the law), the law "applies to any processing operation carried out by a natural person or by a legal person of public or private law, regardless of the medium, the country of its head office or the country where the data are located, provided that: (I) the processing operation is carried out in the national territory; (II) the processing activity aims at offering or supplying goods or services, or at processing data of individuals located in the national territory; or (III) the personal data processed were collected in the national territory" (our translation of the Portuguese text). Whether and how the LGPD applies to Payotte is a legal question that this page does not settle.
Where data is processed
Payotte is operated from Canada. GoDaddy and Cloudflare process data in the United States.
Your rights
You may ask for access to your data, its correction, its erasure, the restriction of processing, and object to processing based on Payotte's legitimate interests, by writing to gregory@payotte.com. We reply within one month at most. If you are not satisfied, you can first write to us again, and then refer the matter to the national data protection authority.
Article 18 of the LGPD (our translation) gives the data subject the right to obtain from the controller, at any time and on request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law; portability to another provider; deletion of data processed with consent; information about the entities with which the controller has shared data; information about the possibility of refusing consent and its consequences; and withdrawal of consent. The article adds that the data subject may object to processing carried out without consent where the law is not respected (§ 2), that the request is met at no cost to the data subject, within the deadlines and terms set by regulation (§ 5), and that the data subject may petition against the controller before the national authority (§ 1). We have not read that regulation: the one-month reply time above is Payotte's own commitment.
The national authority is the Agência Nacional de Proteção de Dados (ANPD), created by article 55-A of the LGPD. On its website (gov.br/anpd, page read on 15 October 2026), the ANPD states that a request to exercise a right must first be addressed to the controller and that, if it has not been met or the answer is not satisfactory, the data subject may send the ANPD a "petição de titular"; since 1 January 2025 these petitions are sent only through its Sistema de Requerimentos, after signing in with a GOV.BR account. The ANPD also notes that the rights of the data subject are not absolute.