1. Privacy Officer
Under Law 25, Vincent Roy-St-Jean acts as the person in charge of personal information protection for Torvite.
For any question, complaint, or access, rectification, or erasure request, write to confidentialite@torvite.ca.
2. Data we collect
Data you provide directly
- First name, last name, email (account creation)
- Company name, phone, city, trade (profile)
- Professional license numbers (RBQ, CMEQ, CMMTQ or other)
- GST / QST numbers
- Company logo (optional)
- Client data you enter (name, email, phone, address)
- Content of your quotes (items, prices, descriptions)
- Conversations with the AI assistant
Data collected automatically
- IP address, browser type, OS, visit timestamps
- Pages visited, session duration (via Vercel Analytics, anonymous, cookieless)
- Performance metrics (Vercel Speed Insights, anonymous)
Data we DO NOT collect
- Advertising tracking cookies
- Browser fingerprinting
- Social network data
3. Why we collect this data (purposes)
- Service delivery: create your account, save your quotes and clients
- AI feature: send your prompts to Anthropic to generate quotes
- PDF generation and email: via Resend
- Billing: manage your Pro subscription (Stripe)
- Communication: send transactional emails (confirmation, password reset, invoices)
- Security: detect abuse, prevent fraud
- Product improvement: anonymous aggregated analytics
We DO NOT USE your data for:
- Third-party marketing
- Selling lists
- Targeted advertising
- Training AI models
4. Subprocessors (third parties handling your data)
| Service | Role | Hosting | Policy |
|---|---|---|---|
| Supabase | DB hosting + auth | Canada (ca-central-1) | supabase.com/privacy |
| Anthropic | AI service (Claude) | United States | anthropic.com/privacy |
| Resend | Email delivery | United States | resend.com/legal/privacy-policy |
| Vercel | App hosting + analytics | United States (global CDN) | vercel.com/legal/privacy-policy |
| Stripe | Payment processing | United States | stripe.com/privacy |
| ImprovMX | Email forwarding (aliases) | United States | improvmx.com/transparency/gdpr-compliance |
5. Transfers outside Québec
Some subprocessors (Anthropic, Resend, Vercel, Stripe) process your data in the United States. For each one, we review the guarantees offered (encryption, certifications, contractual commitments) before entrusting them with data.
The following data may transit outside Québec:
- Anthropic: content of your prompts (quote descriptions)
- Resend: email addresses and content of transactional messages
- Vercel: application code (not your personal data)
- Stripe: payment information (never stored by Torvite)
You can decline these transfers by not using the AI feature or by not activating the Pro plan.
6. Retention periods
| Type of data | Period |
|---|---|
| Active account (profile, quotes, clients) | As long as your account exists |
| Deleted account | Immediate deletion, no backup copies beyond 30 days |
| Connection logs | 90 days |
| Aggregated analytics | Indefinitely (anonymous) |
| Pro billing history | 7 years (tax requirement) |
7. Your rights under Law 25
You have the right to:
- Access: obtain a copy of your personal data
- Rectification: correct inaccurate data
- Erasure: delete your account (direct option in Settings)
- Portability: receive your data in a structured format (CSV)
- Withdrawal of consent: at any time
- Automated decisions: request human review if an automated decision affects your rights
To exercise a right, write to confidentialite@torvite.ca (response within 30 days).
If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (CAI):
- Website: cai.gouv.qc.ca
8. Security
- Encryption in transit (HTTPS / TLS 1.3)
- Encryption at rest (AES-256 via Supabase)
- Hashed passwords (bcrypt)
- Two-factor authentication available (if enabled)
- Limited log access, audit trail
In the event of a privacy incident, you will be notified within 72 hours.
10. Changes
This policy may be updated. Any major change will be communicated by email and displayed at the top of the application for 30 days.
11. Contact
Vincent Roy-St-Jean
Privacy Officer
confidentialite@torvite.ca