Lectur · Legal
Privacy policy.
Lectur is operated by Lectur Inc., a Quebec company. This page describes how we handle the personal information an institution entrusts to us. For a partner institution, the processing agreement signed with it prevails over this page.
Last updated — August 2026
What we collect
School identity and account (name, school email, role, class), course materials uploaded by teaching staff, answers and learning activity, exchanges with the AI companion, messages posted in a course forum (which, unlike exchanges with the companion, are visible to the other participants) and operational telemetry. Where the institution enables them, parent or legal guardian accounts and their link to the student. Accounts are created by the institution: the platform is invitation-only, with no open registration. The people concerned include minors, and we treat all student information as sensitive in its context. From that activity the platform also produces information about a student: an estimated level per competency, progress indicators and, where the institution enables them, risk indicators. These are the student's personal information and carry the same rights. They guide the teacher: no decision that counts, whether a grade, a sanction or an intervention, is made without a human. For assessments a teacher designates as remotely proctored, detection runs on the student's own device. No video is recorded or transmitted and no biometric template is created; only timestamped flags and a still of the flagged moment reach the teacher. A student may refuse the camera with no academic penalty and is offered another arrangement.
Where the information lives
All information at rest, meaning the application, the databases, the files and the backups, is hosted in the province of Quebec, on Microsoft Azure, Canada East region (Quebec City). Any change of hosting provider stays within the province. Calls to AI models go through Azure AI Foundry across two boundaries. By default, processing happens in the Canada East region and does not leave the province, and search over your material stays there. The functions that require the most capable models, meaning the AI companion, assisted grading, generation of teaching content, description of uploaded material and the pedagogical inferences behind the profile, are processed in the European Union data zone, governed by the GDPR, and are covered by the written assessment required under section 70.1 of the Access Act. Before any call, every raw identifier detected is replaced by an ordinal marker, and markers change from one session to the next, so the provider cannot link two sessions to the same person. Free text, meaning written answers and questions put to the companion, is sent as it was typed; the interface reminds students not to put personal details there. No model training is performed on this data. The exemption that would remove all retention by the provider has been requested and is not granted today: requests and responses may therefore be retained, encrypted and access-restricted, for at most 30 days, within the boundary where the call was processed. During that window, content flagged by the provider's classifiers may be reviewed, automatically first and then, below a confidence threshold, by authorised staff located in the European Economic Area. Microsoft is an American company and remains subject to the US CLOUD Act wherever data is processed, including in Quebec. We never disclose information to a foreign authority voluntarily, we require that any request be addressed to the institution, we notify it without delay unless the law forbids it, and we log every such event.
What we do not do
No sale or rental of information. No advertising. No training of AI models on an institution's data, by us or by our sub-processors. No analytics sub-processor: product telemetry stays in our own database. We produce aggregated, non-identifying statistics on platform use and effectiveness. No value rests on a group of fewer than ten students, no free text or individual data appears in them, and an institution's name is associated with them publicly only with its written consent.
Sub-processors
Microsoft Azure — hosting of the platform, databases, files and backups, transactional email, single sign-on with Microsoft Entra, and AI inference. Microsoft 365 — our internal tools, hosted in Canada. Information can transit them incidentally through support correspondence, and is then deleted no later than 90 days after the request is resolved. Google — OIDC single sign-on and import of classes from Google Classroom, at the institution's initiative. Moodle — import of courses and classes from the institution's own instance, at its initiative. Any change to this list is notified to the institution at least 30 days in advance, and it may object.
Retention
Accounts, course materials, answers and activity: for the duration of the mandate, then export and purge within 90 days of its end. AI companion transcripts and the audit log of its tool calls: 12 months. Learning profiles: purged no later than 30 days after the account is deactivated, or earlier on request. Operational telemetry: 90 days. Exam-monitoring media: at most 30 days after capture. Backups: 35 rolling days, expiring no later than 125 days after the end of the mandate. Incident register: 5 years per entry. Destruction is effective rather than anonymization, and proof of it is recorded in a purge register. A purge is paused only for as long as a pending access or rectification request, an incident, a proceeding or a legal retention obligation requires, and resumes as soon as that reason ends.
Your rights and our deadlines
The institution is the point of contact for access, rectification, portability and destruction requests, including those made by a parent or legal guardian. We supply the data or perform the operation within 5 business days of its request. A request that reaches us directly is relayed to the institution within 2 business days. In the event of a confidentiality incident, real or suspected, we notify the institution's officer without delay, then provide a written notice no later than 72 hours after becoming aware of it. Lectur's person in charge of the protection of personal information: Alexandre Hachey, co-founder. Write to contact@lectur.ca with the subject « Renseignements personnels ». Consent, including for the camera option, may be withdrawn at any time and without penalty by writing to the institution, which holds the register; we then execute the withdrawal within 5 business days.
Questions
Write to contact@lectur.ca.