Privacy policy
1. Person in charge of the protection of personal information
Marc-André Simoneau, Dossalys, Saint-Jean-sur-Richelieu, Quebec. Questions, access or correction requests, complaints: [email protected], subject "Privacy". We answer within 30 days.
2. Two different roles
Your broker information (name, email, agency, billing): Dossalys is responsible for it. Your clients' information in your emails and documents: you are responsible for it; Dossalys processes it only to provide the service, as your agent, under the data processing agreement.
3. What we collect and why
- Account: name, email, agency and its address, password (stored hashed).
- Acceptances: version of the terms accepted, date and IP address, as proof of consent.
- Billing: handled by Stripe; we never see your full card number.
- Connection authorizations: Gmail, Microsoft or Google Drive access tokens and Prospects session cookies, encrypted.
- Processed content: headers and text of emails with attachments, the attachments, names and addresses of your clients and properties, to file your documents.
- Technical log: what Clara did, errors, reports, for support and improvement.
We sell no information, do no targeted advertising and do not use your documents to train AI models. The public site uses no tracking cookies.
4. Service providers and locations
Google (Gmail, Google Drive, Gemini through Vertex AI; Canada or United States), Microsoft (OneDrive; your Microsoft 365 region), Stripe (payments; Canada and United States), Cloudflare (public site and network protection; global), our hosting provider (application servers and database, in Canada), and our transactional email provider (Dossalys notices only: your address and the notice text, never your documents). Before any communication outside Quebec, we assessed the privacy factors and put contractual protections in place.
Google data. Dossalys's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is used only to file your documents; it is not sold, not used for advertising or to train AI models, and no one reads it except at your request (support), for security, or to comply with the law.
5. Retention
Clara works on a working copy of your attachments and filing, kept on encrypted disks in Canada during the subscription; filed documents are copied to your OneDrive or Drive, where they remain yours. We also keep metadata (file name, folder, category). The working copy is deleted within 30 days after the subscription ends. Account data: during the subscription, then deleted within 30 days of closing (90 days for backups). Invoices: 6 years (tax law). Terms acceptances: during the subscription and 3 years after.
6. Security, incidents and your rights
Encryption in transit and at rest, tokens and cookies encrypted with separate keys, need-to-know access, access logging, encrypted backups and strict isolation between accounts. We keep a register of confidentiality incidents and notify the Commission d'accès à l'information, affected brokers and, where needed, the people concerned when an incident presents a risk of serious injury. You may request access, correction or portability, withdraw consent by disconnecting a service or deleting your account, and complain to the Commission d'accès à l'information du Québec.
7. Google user data
Dossalys's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to file your attachments for you; no human reads it except with your consent for support, for security, or as required by law.