Privacy Policy

Account information: company name, responsible contact's name, email address, phone number, and RBQ license number where applicable, provided when a contractor account is created.

Client information: when a contractor creates a case file, they may enter that client's name, email, phone number, and address, as well as the documents that client uploads (proofs of purchase, certificates, proof of ownership, invoices, etc.).

Technical information: IP address, browser type, and connection data, collected automatically for the security and proper functioning of the Service.

We use the personal information we collect to: provide and operate the Service; authenticate users and secure access to case files; send transactional emails (invitations, missing-document reminders, case status notifications); provide technical support; and comply with our legal obligations.

We do not use personal information processed within the Service for targeted advertising and do not sell it to any third party.

Processing of the contractor's account information is based on performance of the service contract between us (these Terms of Service). Processing of the contractor's clients' information, entered by the contractor into the Service, is carried out on the contractor's behalf; the contractor remains responsible for obtaining appropriate consent from their clients.

We do not share your personal information with third parties for commercial purposes. We do rely on service providers (processors) to operate the Service, namely:

• Supabase — database hosting, authentication, and storage of uploaded documents.

• Resend — delivery of transactional emails (invitations, reminders, notifications).

• Stripe — payment processing and subscription management. Stripe receives the subscribing company's name, email, and payment details; DossierVert never has access to and never stores any payment card information on our servers (Stripe is PCI-DSS Level 1 certified).

• Sentry — technical error tracking, to detect and fix issues with the Service.

• PostHog — product analytics and audience measurement, to help us improve the Service. No identifying information (name, email) is sent to PostHog; only an internal technical identifier is used, and session recording is disabled.

These providers have access to personal information only to the extent necessary to provide their services, and are contractually required to protect it.

Some of our processors (including Supabase, Resend, Stripe, Sentry, and PostHog) may process or host information on servers located outside Québec, including outside Canada. In accordance with Law 25, we ensure that such information receives protection equivalent to that required under Québec law before any such transfer, including through privacy impact assessments and appropriate contractual commitments with our providers.

We retain personal information for as long as necessary for the purposes for which it was collected, or as long as required by law. A user may request deletion of their account and associated information at any time, subject to our legal retention obligations.

We implement reasonable technical and organizational security measures to protect personal information against unauthorized access, loss, or disclosure, including: encryption of data in transit, secure authentication, database-level Row-Level Security policies restricting a company's data to its own users, and role-based access restrictions for administrative functions.

Under Law 25, you have the following rights regarding your personal information: the right of access, the right of rectification, the right to withdraw consent, the right to data portability (where provided by law), and the right to file a complaint with the Commission d'accès à l'information du Québec.

To exercise any of these rights, contact the person responsible for the protection of personal information at info@dossiervert.ca. We will respond to your request within the timelines required by law.

In accordance with Law 25, the person with the highest authority at DossierVert acts as the person responsible for the protection of personal information, unless that function is delegated to another person. Any question or complaint may be directed to info@dossiervert.ca.

Our use of cookies within the Service is described in our Cookie Policy.

The Service is not directed at minors, and we do not knowingly collect personal information from them.

We may update this policy from time to time. Any material change will be communicated to you by email or through a notice displayed in the Service.