Privacy Policy

This privacy policy describes how Proposal+ ("Proposal+", "we", "us") collects, uses, discloses, retains and destroys personal information in connection with the operation of the Proposal+ platform and the proposal.plus and proposition.plus websites (collectively, the "Service"). It is established in accordance with Quebec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as modernized by Law 25 (the Act to modernize legislative provisions as regards the protection of personal information).

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information at Proposal+ is:

JFB
Person in charge of the protection of personal information
Email: confidentialite@proposal.plus
Montréal, Québec, Canada

Any question about this policy, any request to exercise your rights and any incident report may be sent to this address.

2. Scope and roles

Proposal+ is a service for professional services businesses ("Firms") that use it to prepare, send and have their own clients (the "Firms' Clients") accept service proposals. Two distinct roles follow:

• For information about website visitors and Service users (account creation, contact requests), Proposal+ determines the purposes and means of collection and acts as the enterprise responsible within the meaning of the Act.
• For information about the Firms' Clients (contact details, business context, proposal content), the Firm remains responsible for the initial collection from its clients; Proposal+ processes that information on the Firm's behalf, as a service provider, solely to deliver the Service.

3. Personal information we collect

3.1 Account and profile

• Email address, password (stored only in hashed form), interface language, role within the Firm;
• Firm information: business name, billing email, default proposal language, logo.

3.2 Information entered by Firms about their clients

• Name, contact details and business context notes of the Firms' Clients;
• Proposal content: services offered, pricing, contractual clauses, drafted or generated sections.

3.3 Contact requests and waitlist (website chat)

If you use the website's contact assistant, we collect — only after the explicit consent shown in the conversation — your name, your company name, one contact detail (email or phone) and, where applicable, your message. No information is transmitted before that consent.

3.4 Proposal acceptance and electronic signature

When a Firm's Client views a proposal through a public link and responds to it, we collect: their name, email, electronic signature, the timestamp of the acceptance or refusal, their IP address and their browser identifier ("user agent"). These elements form the signature audit trail and demonstrate its integrity.

3.5 Technical logs

Views of public proposals and certain security events (rate limiting, errors) are logged with the IP address and user agent, for security, audit and abuse-prevention purposes.

3.6 Cookies

See section 10 below.

4. Purposes of use

We use personal information only for the following purposes:

• Providing, operating and securing the Service (authentication, multi-tenancy, backups);
• Generating, sending and obtaining signatures on proposals at the Firms' request;
• Following up on contact and access requests;
• Building the audit trail required for the validity of electronic signatures;
• Preventing fraud and abuse, diagnosing technical incidents;
• Complying with our legal obligations.

We do not use your personal information for behavioural advertising and we do not sell any personal information.

5. Consent

Unless an exception under the Act applies, we collect personal information directly from the person concerned, with their manifest, free and informed consent, given for specific purposes. You may withdraw your consent at any time by writing to confidentialite@proposal.plus; withdrawal does not affect the lawfulness of processing carried out beforehand and may limit our ability to provide the Service to you.

6. Artificial intelligence

Proposal+ uses language models to assist in drafting proposal content. In that regard:

• Quebec hosting first. Where available, processing is performed on a sovereign server located in Québec, precisely to limit the movement of information outside the province.
• Fallback provider. If that server is unavailable, processing may be entrusted to GitHub Models (Microsoft Corporation), whose servers are located in the United States. The business context entered for the proposal (which may contain personal information about the Firm's Client) is then communicated to that provider for the duration of the processing. See section 7.
• No training. We do not use your information to train artificial intelligence models.
• Interaction log. Each generation is recorded (model used, request, response, token volume) to ensure traceability and diagnostics.
• No fully automated decisions. Artificial intelligence suggests content; the decision to send a proposal and its final content always rest with a human. Proposal+ renders no decision based exclusively on automated processing within the meaning of section 12.1 of the Act.

7. Disclosure to third parties and outside Québec

We disclose personal information only to the providers necessary to operate the Service, under agreements ensuring adequate protection, and we carried out the privacy impact assessment required by section 17 of the Act before any communication outside Québec:

• Heroku (Salesforce, Inc.) — application and database hosting (United States);
• Cloudflare, Inc. — storage of generated PDF documents (global network);
• Resend, Inc. — delivery of transactional email (United States);
• GitHub Models (Microsoft Corporation) — fallback text generation, as described in section 6 (United States);
• Google LLC (Google Fonts) — loading of fonts on the landing page; your IP address is then transmitted to Google (United States). This resource is not loaded inside the application itself.

These providers act only on our instructions and acquire no right to use the information for their own purposes. We disclose no personal information to third parties for commercial or advertising purposes.

8. Retention and destruction

• Account-related information is retained for the duration of the contractual relationship with the Firm;
• Accepted proposals and their signature trail are retained as long as needed to evidence the contract, in accordance with the limitation periods applicable in Québec;
• Contact requests that do not convert are deleted no later than 24 months after receipt;
• Once the purposes are fulfilled, the information is securely destroyed or anonymized in accordance with the Act.

9. Security measures

We apply security measures that are reasonable and proportionate to the sensitivity of the information, including: encryption in transit (TLS), password hashing, strict isolation of each Firm's data (multi-tenant architecture), role-based access control, event logging, rate limiting on public pages and least-privilege arrangements with our providers.

10. Cookies

A banner lets you, from your first visit, accept or refuse each category of cookies and change your choice at any time through the "Manage cookies" link at the bottom of the site. Three categories are defined:

The Service uses no advertising cookies and no third-party tracking technology.

11. Your rights

In accordance with the Act, you may:

• Access the personal information we hold about you;
• Request its rectification if it is inaccurate, incomplete or equivocal;
• Withdraw your consent to its use or disclosure;
• Request that the dissemination of information cease or that it be de-indexed, in the cases provided for by the Act;
• Obtain, where the Act so provides, the portability of the computerized personal information you provided to us, in a structured, commonly used technological format;
• Request the destruction of information whose retention is no longer necessary.

Send your request in writing to confidentialite@proposal.plus. We will respond diligently, no later than 30 days after receiving it. If you are dissatisfied with how your request was handled, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

12. Confidentiality incidents

We keep a register of confidentiality incidents. Any incident presenting a risk of serious injury is reported diligently to the Commission d'accès à l'information and to the persons concerned, in accordance with sections 3.5 and following of the Act, and we take reasonable measures to reduce the risks and prevent incidents of the same nature from recurring.

13. Minors

The Service is aimed at businesses and is not intended for persons under 14 years of age. We do not knowingly collect personal information from minors.

14. Changes to this policy

We may amend this policy to reflect changes in the Service or in legislation. The current, dated version is permanently published at this address; in the event of a significant change, a notice will be displayed on the site or sent to account holders.

15. Language

This policy is published in French and in English. In the event of a discrepancy, the French version prevails.