Privacy policy

Who is accountable for your information

[À COMPLÉTER — raison sociale], [À COMPLÉTER — adresse], operates the Maatron service. Quebec enterprise number (NEQ): [À COMPLÉTER — NEQ]. For any privacy question, write to info@maatron.dev.

The company is established in Quebec. The applicable statutes are therefore Quebec's Law 25, which modernises the protection of personal information, and Canada's federal PIPEDA. We do not claim compliance with the European GDPR: that assessment has not been carried out, and claiming it without doing the work would be worth nothing.

Full identification of the operator is set out in Legal notice.

The personal information we collect

The list is short, and it is the whole list.

Your email address. It is your sign-in identifier and the way we reach you about the service.

Your name, as you typed it. It lets other members of your organization see who uploaded which file.

Your organization's name, which defines the space your data lives in.

An Argon2id hash of your password. The password itself is never stored, and the hash cannot be turned back into it.

An open session, kept on the server: its expiry date, its revocation date where applicable, and a hash of the token — never the token itself. The cookie that carries that token is described in Cookies.

To that add, for every uploaded file, the identifier of the account that uploaded it. That is what makes an upload attributable, and therefore challengeable, rather than anonymous.

What we do not collect

No analytics, no advertising, no third-party tracker, no profiling. The product is not trying to learn how you behave: it analyses the files you hand it.

We ask for no date of birth, no phone number, no home address, and no sensitive information within the meaning of Law 25. A field that does not exist is a field that cannot leak.

Your backup files

A controller backup is business data, not personal information: it describes an installation, programs, frames, inputs and outputs.

Stopping there would be dishonest. These files sometimes carry identifiers of people: an author name at the top of a program, initials in a comment, an operator ID. We do not extract them, index them or search them — but they are in the file, so they are with us for as long as the file is.

The files stay yours, and Terms of Service says so in the same words. We process them to deliver the service, and for nothing else.

What the information is used for

Three uses: to authenticate you, to attach your data to your organization and to no other, and to write to you about the service — an outage, a significant change, an invoice.

Your address is not used for unsolicited prospecting. If we ever wanted to write to you for other reasons, it would be with your consent, asked for separately and refusable at no cost.

How long we keep it

Three deadlines rather than a single figure. One figure would be wrong in both directions: loss of access is immediate, while no serious backup system rewrites itself on demand.

Access revocation: immediate, on request. The data stops being reachable by anyone, including you.

Erasure from live systems, meaning object storage and the database: thirty days at most.

Destruction of backup and disaster-recovery copies: sixty days at most, as their own retention cycle expires.

These deadlines are published, so they bind us. The mechanisms that hold them are described in Security and trust.

Subprocessors and transfer outside Quebec

The service relies on three providers: Render Services Inc. (Oregon, United States) for running the application interface and the processing, Cloudflare, Inc. for file storage, and Vercel Inc. for hosting the web application.

Your data therefore leaves Quebec and Canada, and is hosted or processed in the United States. We say so rather than let you find out: Law 25 requires such communications outside Quebec to be disclosed, and requires a privacy impact assessment before they are put in place.

The current list of subprocessors, their role and the contractual commitments framing them are set out in Data Processing Agreement.

None of this trains a model

Neither your account information, nor your files, nor the analysis results are used to train, fine-tune or evaluate any artificial intelligence model, ours or anyone else's.

The analysis is deterministic: same files, same result. It has nothing to learn from your data.

Your rights

You may request access to your information, its correction, its deletion, the withdrawal of your consent, and a copy of your data in a structured, commonly used format.

Write to info@maatron.dev. We answer within the thirty days the law allows. If a request is too vague to act on without risking the deletion of something you did not mean, we ask you to narrow it rather than guess.

If our answer does not satisfy you, you can complain to the Commission d'accès à l'information du Québec, the supervisory authority with jurisdiction.

Security and incidents

The technical measures — encryption in transit and at rest, separation between organizations, private storage and short-lived signed links — are described in Security and trust.

If a confidentiality incident presents a risk of serious injury, we notify the people concerned and the Commission d'accès à l'information, as Law 25 requires, and the incident is entered in a register.

Changes to this policy

This policy will change when the product changes: one more subprocessor, one more piece of data. The last revision date is at the top of the page, and a significant change will be announced by email before it takes effect.

This document describes our practices. It is not legal advice.