Data & privacy
Data processing
What Linuen keeps, where, for what, and what is never shared.
This page describes the product's current state; items not yet decided (final hosting, contractual commitments) are indicated as such and do not constitute a legal commitment.
Retention
Your projects, sources, documents, estimates and versions are kept in the application's database (hosting targeted in Canada) and backed up with it.
Isolation
A workspace belongs to one person. No one else enters it, except Linuen in the case described below. Linuen's console shows the list of workspaces, support requests and the log, without the content of projects.
When Linuen opens your workspace
Linuen's platform owner can open your workspace to work in it: check a project, correct it, support you — especially when you have written to them. They then see your projects and can modify them as you would; their corrections are signed under their own name, and they never use your credits. Every opening and every closing is logged in the platform log, with your request and the targeted project when there is one; a permanent banner reminds you of this throughout the work, and the opening expires on its own after eight hours. Write to Linuen
AI providers
Excerpts from your project (authorized sources, retained architecture references, proposal) are transmitted to the configured providers only when you launch an operation; the roles, models and processing conditions are displayed; the models' raw responses are erased by a periodic purge (30 days by default).
What you send when you submit a project
You may put in a project whatever your project needs, including personal information or confidential data: Linuen places no restriction on it. Here is what that implies. The text you write and the documents you import are sent to the configured AI providers whenever you launch an operation, and only then. The country where each provider processes the information is shown further down, under "Where the AI processing takes place"; for the current provider, it is outside Canada, in the United States. That provider's terms apply to what it receives. For personal information, this amounts to disclosing it outside Quebec and Canada, within the meaning of the applicable laws: your organization is responsible for it, including for having the right to submit it. The local detection described below helps you see what is sent, without guaranteeing anything. We recommend that you send only what your project requires: what is not in the project is not sent.
Personal information is detected and masked before sending
Before any analysis, the software locally detects, without AI, the most common personal information — people's names, emails, phone numbers, social insurance numbers, card numbers, postal codes in addresses, birth dates — and shows them to you. You decide to mask or keep each one; nothing leaves while an occurrence awaits your decision. Masked values travel as tokens and the mapping stays in Canada. This safeguard helps you see what is sent and reduces accidents; it does not catch everything (a trade secret, or a name slipped into a sentence, cannot be recognized mechanically) and it does not replace your own judgment about what you send.
Shared references
Your data never joins the references published by Linuen; a reference is published only after a person's review.
End of subscription
Cancellation stops the renewal; viewing, raw data export and downloading already-purchased packages remain accessible under the announced policy.
Questions
Use the contact form; requests are logged and handled by a person. Write to Linuen
Where the AI processing takes place
When you launch an operation, the analysis is performed by: Anthropic (United States). The processing takes place outside Linuen's hosting; each provider's terms apply.
IP address
At sign-up, the suggested province is inferred from your IP address by a database installed on Linuen's server: the address is sent to no one and this detection does not record it. It is, however, kept with each sign-in session, for account security, and appears in the server's technical log.
Laws and regulator
Quebec: Law 25 (Commission d'accès à l'information du Québec). A complaint may be made to the named regulator. Privacy
Account protection
- Mandatory two-step sign-in: password, Google or Apple, then a temporary code (TOTP) from an authentication app, with ten single-use backup codes.
- Bounded sessions (eight hours maximum, thirty minutes of inactivity), revocable from the account; sensitive operations require recent authentication.
- Second-factor secrets encrypted at rest; no automatic account linking by simple email address match.
These protections describe what is actually in place; they do not constitute a certification or a guarantee of absolute confidentiality.