Last updated: July 7, 2026
Illumino is designed so that compliance is not a checklist you manage. It is a property of the architecture. Because we collect no personal data about your visitors by design, the heaviest consent, disclosure, and deletion obligations under Law 25, PIPEDA, GDPR, and PECR simply do not arise. Illumino is built and operated in Québec, Canada, and holds itself to Canadian privacy law first.
Quebec Law 25 came into full force in September 2023 and imposes obligations on private-sector organisations that collect, use, or communicate personal information about Quebec residents. The most significant obligations include obtaining consent before collection, appointing a privacy officer, publishing a privacy policy, conducting privacy impact assessments for high-risk processing, and notifying the Commission d'acces a l'information (CAI) of confidentiality incidents.
Because Illumino collects no personal information about visitors, the consent and disclosure obligations of Law 25 do not apply to your use of Illumino as an analytics tool. Specifically: we do not use cookies, we do not log IP addresses, we do not create visitor profiles, and we do not use fingerprinting or any cross-site tracking technique. The data we collect (aggregate counts, country codes, browser families, page paths) does not meet the definition of "personal information" under Law 25, which requires that information allow for the identification of a natural person directly or indirectly.
Illumino is operated by a Quebec-based operator and is itself subject to Law 25 with respect to its account holders' data (email addresses, billing information). We maintain a privacy policy, respond to access and correction requests, and report confidentiality incidents as required.
PIPEDA is Canada's federal private-sector privacy law. It applies to organisations that collect, use, or disclose personal information in the course of commercial activities in provinces without substantially similar legislation, and to cross-border data flows. Its ten fair information principles include accountability, consent, limiting collection, and safeguards.
Illumino's position under PIPEDA mirrors its position under Law 25: the visitor analytics data we process (aggregate counts, country codes, browser families, page paths) is not personal information because it cannot identify an individual, so PIPEDA's consent and access obligations do not attach to your use of Illumino as an analytics tool. For our own account holders, we apply the ten principles to the limited personal information we do hold (your email address and billing details), all of which stays on Canadian infrastructure.
CASL governs commercial electronic messages sent to Canadians. It does not directly regulate analytics data collection. Illumino does not send any commercial electronic messages to your visitors. The only emails Illumino sends are transactional messages to account holders who have actively created an account: welcome emails, billing receipts, and service notifications. These transactional messages fall within CASL's implied consent provisions for existing business relationships and do not require express consent.
Illumino does not collect visitor email addresses and does not add your visitors to any mailing list.
The GDPR applies when you process personal data of people in the European Union. The most common analytics compliance burden under GDPR is the requirement to obtain prior consent before placing tracking cookies or processing personal data (such as IP addresses) that could identify an individual.
Illumino eliminates this burden by architecture. The Illumino tracking snippet does not set any cookies. The visitor's IP address is used transiently, in memory, to derive a country code on our server, then immediately discarded; it is never stored or logged. The snippet does not generate or transmit any persistent identifier tied to an individual visitor. Because no personal data is stored by Illumino, the legal basis requirements of GDPR Article 6 do not apply to visitor analytics. You do not need a consent banner for Illumino.
City-level data is protected by a k-anonymity threshold of k=5: a city only appears in your reports when at least 5 distinct visits from that city are recorded on a given day. This ensures that even aggregate geographic data cannot single out an individual in a small population.
If you use Illumino alongside other tools that do set cookies or process personal data (for example, an advertising pixel or a live-chat widget), those tools require their own consent mechanisms. Illumino does not interact with or replace those obligations.
For Illumino account holders who require a formal Data Processing Agreement as a controller-processor document, see Getting a Data Processing Agreement below.
PECR is the UK regulation that governs the use of cookies and similar technologies on websites. It requires prior informed consent before setting non-essential cookies or accessing information stored on a user's device, with limited exceptions for "strictly necessary" cookies.
Illumino sets no cookies through its tracking snippet. The snippet does not read from or write to any browser storage mechanism including cookies, localStorage, sessionStorage, or IndexedDB. It transmits only the anonymised data described in the Privacy Policy. Because no cookies or storage access occurs, PECR's consent requirement does not apply to Illumino. You do not need a cookie consent banner for Illumino on UK-facing websites.
Illumino sets no cookies at all. The tracking snippet reads from and writes to no cookie, localStorage, sessionStorage, or IndexedDB, anywhere: not on your website, not on the Illumino dashboard, not anywhere in our infrastructure. You do not need a cookie consent banner for Illumino.
Illumino runs on a dedicated server in Québec, Canada. When a visitor's browser sends an analytics request, our server receives the connection (including the IP address) as part of normal TCP/IP routing. The IP address is passed transiently, in memory, to a geolocation lookup that derives only a country code and network (ASN). The raw IP address is then immediately discarded: it is never written to disk, to logs, or to the database, and no part of the application retains it.
Illumino retains raw hit records for 7 days, then aggregates them to anonymous daily counts and deletes the raw records. After aggregation, no data exists in our systems that could be traced to an individual request or visitor. The third parties involved in delivering the service are published in the sub-processor register.
The claims on this page are checkable; you do not have to take our word for them:
/hit: the payload is the page path, referrer domain, device class, and any UTM tags; nothing else.Self-serve: the current signed DPA is published at illumino.app/dpa, version-controlled, with the technical measures annex and the sub-processor register included. It takes effect automatically with your account; downloading and filing a copy is sufficient documentation for Law 25 and GDPR purposes.
If your organisation requires a countersigned copy, use the contact form (topic "Privacy and compliance"), mention "DPA countersignature", and include your legal entity name.
Most compliance questions are answered on this page and in the Privacy Policy. For anything they do not cover, reach our data protection point of contact through the contact form (topic "Privacy and compliance").