Transparency, on purpose

How the label is calculated

Nothing here is a black box. The label is a direct rendering of the privacy policy grader's11 checks: each check becomes one row, and the weighted score becomes the letter grade. Same checks, same weights, no extra judgment.

The pipeline

1Check
The policy text is scanned for bilingual (English/French) keywords and patterns across 11 checks mapped to Law 25 and PIPEDA expectations. Each check returns pass, partial, or missing.
2Score
Each check carries a weight (accountability and rights weigh most). Pass earns full weight, partial earns half, missing earns none. The total is scaled to 0–100.
3Render
Each check becomes one row on the card with a plain-language value (e.g. “Named, with contact”, “Browsewrap only”, “Not stated”). The score becomes the letter grade. Everything happens in your browser.

Check → row mapping

The weight column shows each check's influence on the score. A dash means that check never returns that status — for example, “purposes of collection” is either stated or not.

Check	Label row	Weight	Pass	Partial	Missing
Privacy officer named, with contact	Privacy officer	2×	Named, with contact	Named, no contact	Not stated
Purposes of collection stated	Purposes of collection	1.5×	Stated	—	Not stated
Individual rights mentioned	Your rights	1.5×	Access, correction, deletion	Some rights listed	Not stated
Retention periods stated	Retention limits	1×	Stated	Mentioned only	Not stated
Cross-border transfer disclosure	Data leaving Québec/Canada	1×	Disclosed	Vague	Not disclosed
Consent language	Consent basis	1×	Stated	Browsewrap only	Not stated
Breach / confidentiality incident mention	Breach notification	1×	Addressed	Mentioned, no notification detail	Not stated
Children's data addressed	Children's data	0.75×	Addressed	—	Not addressed
Automated decision-making disclosed	Automated decisions	0.75×	Disclosed	—	Not disclosed
Last-updated date present and recent	Last updated	1×	Dated, recent	Unclear	Not dated
Complaint path to the regulator	Complaint path	1×	CAI / OPC named	No regulator named	Not stated

Score → grade bands

Grade	Score	What it signals
A+	97–100	Exceptional. The policy reads as though it went through serious Law 25 work.
A	93–96	Excellent. Core expectations covered with, at most, minor gaps.
A−	90–92	Strong. A couple of soft spots worth a second look.
B+	87–89	Good. Solid foundations with a few fixable gaps.
B	83–86	Above average. Noticeable gaps, none fatal on its own.
B−	80–82	Decent. Several checks came back partial or missing.
C+	77–79	Fair. Roughly a quarter of the expectations look unmet.
C	73–76	Mediocre. A Law 25-sized gap or two is likely.
C−	70–72	Weak. Multiple core expectations missing.
D+	67–69	Poor. The policy reads as incomplete.
D	63–66	Very poor. Most of what regulators look for is absent.
D−	60–62	Failing. Little more than a placeholder policy.
F	Below 60	Failing. Major Law 25 and PIPEDA expectations look absent.

What the label cannot tell you

The checks read words. They cannot verify practices: whether consent was truly informed, whether data is really deleted on schedule, whether the PIA for a cross-border transfer exists, how vendors handle data, or whether the policy matches what the company actually does. Keyword matching can also miss well-written policies that use unusual phrasing — a missing row is a question, not a verdict.

That is why every card carries the line “Heuristic grade, not legal advice.”Treat labels as a starting point for diligence and conversation — for procurement shortlists, for customer trust, for deciding which policy deserves a closer read — never as a compliance conclusion.

If a label surfaces gaps worth closing properly, you're welcome to send me a note — I help Canadian teams turn policies like these into programs that hold up.