Privacy policy

1.Introduction and compliance

GRENIER SOLUTIONS formally commits to protecting the privacy and the security of the personal information of its clients, of the users of its hosted platforms, and of its visitors. This policy is drafted in accordance with Québec's Law 25 and with Canadian data protection standards (PIPEDA).

It covers all of our operations: our public website, our client portal, the custom software platforms we develop and host for businesses, as well as our API integrations (such as Google services).

2.Roles: controller vs. processor

In the course of our activities, we take on two distinct legal roles:

• Controller: For data collected directly from you for the management of your GRENIER SOLUTIONS account, billing, and our business relationships.
• Processor / service provider: When we develop, program or host platforms for other businesses. In this context, we process the data of your end users strictly according to your instructions and never use it for our own purposes.

3.Data collected

We may collect and process the following categories of data:

• Identity and contact data: Name, email, phone number, company name, billing addresses.
• Authentication and integration data: Login credentials, OAuth access tokens.
  Note regarding Google APIs: When our platforms use Google sign-in services (SSO) or connect to Google APIs (e.g., Calendar, Drive, Gmail), we only collect the data strictly necessary for the integration to work, in accordance with the Google API Services User Data Policy.
• Website and contact form: Name, email, phone number (optional) and message sent through the form, used only to reply to you and follow up on your request. The website uses no analytics tool and no tracking cookies. To block spam, the form uses Google reCAPTCHA, which loads only when you start filling it in; this Google service may then place a cookie required for it to work and collect technical data such as your IP address and your browser. Your browser also keeps, on your device only, a draft of the form (erased once it is sent) and, where applicable, the fact that you dismissed the offer of the English version.
• Error reports: If a technical error occurs on the website, a report (page visited, browser, IP address) is sent to our error-tracking tool, hosted on our own servers in Québec.
• Infrastructure and usage data: IP addresses, system logs, security telemetry, and usage metadata from our software for debugging and security purposes.

4.Use and sharing of data

Your personal information is used transparently and legitimately to:

• Provide, operate, maintain and secure our hosted platforms and infrastructure.
• Enable interoperability with third-party services you have approved (such as Google or Microsoft integrations).
• Respond to security emergencies and technical incidents.

Sharing: We never sell, rent or monetize your data. Sharing is limited to the providers needed to operate our services, under their contractual terms, or to cases where the law requires it. For example, some of our servers are hosted by OVHcloud, in its Beauharnois data centre, in Québec. The disks of these servers are encrypted, and only GRENIER SOLUTIONS holds the key. The rest of our infrastructure is hosted on our own servers, also located in Québec. Some providers process information outside Québec: Cloudflare, which hosts this website and protects our services (including the contact form) against attacks, and Google, for reCAPTCHA.

5.Specific use of Google API data

GRENIER SOLUTIONS' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never use this data for targeted advertising or for building unsolicited profiles.

6.Security and retention

We protect your data with measures suited to its sensitivity: encryption in transit (HTTPS/TLS), access based on each user's role, two-factor authentication, firewalls and backups. Encryption at rest is applied according to the sensitivity of each platform, as described in our Security policy. Personal information is kept for the entire duration of the business relationship, then for as long as necessary to meet our legal obligations (including tax obligations) and to establish, exercise or defend our rights. It is then destroyed or anonymized.

7.Your rights (Law 25)

In accordance with applicable laws, you have extensive rights regarding your personal information:

• Right of access and portability: Obtain a copy of your data in a structured technological format.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to de-indexation or to be forgotten: Request the deletion of your data, subject to our contractual or legal obligations.
• Withdrawal of consent: Withdraw your consent (e.g., revoke OAuth access to your Google account through your account's security settings).

8.Changes to the privacy policy

GRENIER SOLUTIONS reserves the right to make changes to this privacy policy at any time, at its sole discretion and without notice. Any change takes effect immediately upon its publication on this page. The "Last updated" date at the top of the document will indicate when the revisions were made. We encourage you to check this page regularly. Continuing to use our platforms and services after the publication of a revised policy confirms your acceptance of the new terms for the processing of your data.

9.Person in charge of the protection of personal information

To exercise your rights, or for any question about this policy or about how your data is processed by our platforms, please contact our person in charge of the protection of personal information:

We respond to access and rectification requests within 30 days. If you have not heard from us within 7 days of your request, please contact us again: your message most likely did not reach us.

In the event of a confidentiality incident presenting a risk of serious injury, we notify the Commission d'accès à l'information and the persons concerned, and we keep a register of such incidents.