Privacy policy

Information we process

Accounts and access credentials, company information, jobsite data (logs, hours, photos, RFIs), uploaded documents, and technical logs needed for security and diagnostics. Ouvance processes no payments during the beta; no card or billing information is requested or stored.

Purposes and consent

We use this information to authenticate users, isolate each company, run business workflows, produce requested documents, and protect the service. We do not reuse information for an incompatible purpose without an appropriate legal basis and notice. Consent is requested for a specific purpose and is not bundled with others.

Invitation-only access

Beta access is invitation-only. Using the service does not amount to blanket consent for every processing activity. Commercial messages comply with CASL: sender identification, consent, and a working unsubscribe mechanism.

Cookies and tracking technologies

We use only strictly necessary cookies, for example an httpOnly session cookie that keeps you signed in. We use no advertising, profiling, or location cookies and no third-party behavioural trackers. No additional consent is required for non-essential cookies because we set none.

Automated decisions

Ouvance makes no decision producing a legal or similar effect on a person based solely on automated processing. Assisted features, such as summarizing a daily report, support the user, who stays in control and reviews the output before any use.

Security measures

The service applies role-based access, password hashing, login-attempt throttling, httpOnly session cookies, application-layer encryption for certain sensitive information, and per-company (tenant) data separation. TOTP multi-factor authentication is available and recommended for every account.

Retention and destruction

We keep information only as long as needed for the purposes described or required by law. At the end of an engagement or on an eligible request, active data and related objects are deleted; residual backup copies expire on a defined cycle. No fiscal retention period applies while no billing exists.

Your rights

Under Law 25 you may request access to your personal information, its rectification, its portability in a structured, commonly used technological format, withdrawal of your consent and, where the conditions are met, the cessation of dissemination or indexing. Write to [email protected]. Reasonable identity verification may be required, and a reasoned decision is provided within the applicable legal period.

Privacy officer

Tiago Barros Cavalcanti, founder of Ouvance, acts as the privacy officer. You can reach him at [email protected], Montréal (Québec), Canada.

Complaints

You may send a complaint to [email protected] with the facts, date, and outcome sought. We acknowledge receipt, review the request, and provide a reasoned response. You may also file a complaint with Quebec’s Commission d’accès à l’information.

Privacy incident

Every incident is contained, assessed, and entered in a register. When there is a risk of serious injury, affected people and Quebec’s Commission d’accès à l’information are notified as required by law. The incident register is kept for at least five years.

Service providers and processing outside Quebec

Object storage may use Cloudflare R2 and infrastructure is hosted with a cloud provider. Some processing may occur outside Quebec; a provider’s region hint is best-effort and not a guarantee of residency. A privacy impact assessment and written agreements govern any processing outside Quebec. No payment provider is used during the beta.

Website demo form

The demo form collects your first name, company, email, phone (optional), trade, team size and preferred time, only to organize the demo and contact you about it. This information is kept for at most 24 months, then deleted; write to [email protected] to have it deleted sooner. The site measures its audience in aggregate (number of visits and form steps per page and per day), without cookies and without identifying visitors.

Effective date

Version 1.1 (beta), effective September 16, 2026 (version 1.0: July 18, 2026). We update this policy as the service evolves; material changes are communicated to participating companies.