Privacy Policy

Drafted against Quebec's Law 25. This page reflects the application's actual practices as of the date above, but should be reviewed by legal counsel before being relied on as a final compliance position.

1. Who we are

Verifiqa is operated by [NEXT_PUBLIC_LEGAL_ENTITY_NAME not configured], with its registered address at [NEXT_PUBLIC_LEGAL_ENTITY_ADDRESS not configured] (the "Company"). This policy explains what personal information we collect through the Verifiqa application, why, who it is shared with, how long it is kept, and how to exercise your rights.

2. Person in charge of the protection of personal information

In accordance with Law 25, the following person is responsible for enforcing these rules within the Company:

[NEXT_PUBLIC_PRIVACY_OFFICER_NAME not configured], [NEXT_PUBLIC_PRIVACY_OFFICER_TITLE not configured]
[NEXT_PUBLIC_PRIVACY_OFFICER_EMAIL not configured]

3. Personal information we collect

Depending on how you use Verifiqa, we collect:

• Account information: first and last name, email address, password (stored hashed by our authentication provider).
• Organizational membership: which organization, team, and roles/permissions you are assigned.
• Work-related content: inspection responses, findings, corrective task records, and documents/photos you or your organization upload in the normal course of using the service.
• Usage and security information: technical logs (IP address, user agent, timestamp) tied to requests made to the service, including denied access attempts, for security and troubleshooting purposes.
• Billing information: processed by our payment processor (Stripe); the Company does not store your full payment card number.

We do not collect sensitive personal information (health, ethnicity, orientation, political opinions, biometrics) as part of the service's normal operation, unless you voluntarily include it in a free-text field - please avoid doing so.

4. Purposes of collection

• Providing, operating, and securing the service (authentication, access control, security logging).
• Maintaining the asset-compliance and safety records your organization uses Verifiqa for.
• Administering your account, subscription, and billing.
• Communicating with you about the service (notices, due-date reminders, assignment notifications).
• Complying with our legal obligations and responding to requests from competent authorities.

Collection is based on your consent at account creation, and on the performance of the service agreement between you (or your organization) and the Company for the rest.

5. Sharing with third parties and transfer outside Quebec

We never sell your personal information. We share it only with the following service providers, to the extent necessary to provide the service:

• Supabase Inc. - database hosting, authentication, and file storage (infrastructure located in the United States).
• Stripe Payments Canada Ltd. / Stripe, Inc. - subscription payment processing.
• Resend (Withoutdoubt, Inc.) - transactional email delivery (notices, reminders).
• Vercel Inc. - web application and API hosting.

Transfer outside Quebec: These providers process personal information outside Quebec, primarily in the United States. In accordance with section 17 of Law 25, the Company has completed a privacy impact assessment before this transfer, taking into account the sensitivity of the information, the purposes, the contractual protective measures in place, and the legal framework applicable abroad. This assessment is documented internally and can be made available on reasonable request to the person in charge identified above.

6. Retention period

We retain your personal information only for as long as necessary for the purposes described above, then destroy or de-identify it, subject to any longer legal retention obligation (including tax or regulatory). As a general guide:

• Account and organizational membership: for the life of the account, then up to 3 years after closure (Quebec's general civil prescription period).
• Asset-compliance and safety records (inspections, findings, corrective actions): up to 7 years, subject to any regulatory requirement specific to your industry.
• Security logs (denied access attempts): up to 2 years.
• Confidentiality incident register: a minimum of 5 years, as required by Law 25.
• Billing records: up to 6 years, in line with applicable tax requirements.

7. Your rights

By contacting the person in charge identified above, you may:

• Access the personal information we hold about you.
• Have any inaccurate, incomplete, or ambiguous information corrected.
• Withdraw your consent to collection, subject to your organization's own contractual obligations.
• Request the portability of your computerized personal information, in a structured, commonly used technological format.
• File a complaint with Quebec's Commission d'accès à l'information (CAI) if you believe your rights have not been respected.

If your account belongs to a customer organization, some requests (for example, deleting an inspection record) may need to be coordinated with your organization's administrator, who remains responsible for its own compliance obligations.

8. Security measures

Access to data is isolated by organization at the database level (row-level security), passwords are managed by a dedicated authentication provider and never stored in plain text, communications are encrypted in transit, and denied access attempts are logged for security monitoring.

9. Confidentiality incidents

In the event of a confidentiality incident presenting a risk of serious harm, we will notify the Commission d'accès à l'information and the affected individuals, in accordance with Law 25. Every confidentiality incident, whether or not it meets that threshold, is logged in an internal register kept for at least 5 years.

10. Cookies

Verifiqa uses only cookies that are strictly necessary for the service to function (keeping you signed in). We do not use any tracking, advertising, or analytics cookies at this time.

11. Changes to this policy

We may update this policy. Any material change will be announced within the application before it takes effect.

12. Contact us

For any question about this policy or your personal information: [NEXT_PUBLIC_PRIVACY_OFFICER_EMAIL not configured]