Privacy Policy

This privacy policy describes how OffrePro inc. (“OffrePro”, “we”) collects, uses, discloses, retains and destroys personal information in connection with operating the offrepro.ca website and the OffrePro software, a platform for preparing and managing business proposals and documents (together, the “Service”). It is established in accordance with Québec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as modernized by Law 25 (Act to modernize legislative provisions as regards the protection of personal information).

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information at OffrePro is:

Jean-Francois Berthiaume
Person in charge of the protection of personal information
OffrePro inc.
Email: confidentialite@offrepro.ca
Québec, Canada

Any question about this policy, any request to exercise your rights and any incident report may be sent to that address.

2. Scope

OffrePro designs and operates software that lets businesses catalogue their service offerings, prepare proposals and business documents, and have them accepted through an electronic signature. Access to the Service is currently by request, through the access-request form described in section 3.

OffrePro determines the purposes and means of collection for information gathered through the site (visitors, access requests) and acts as the software provider for the information its clients enter while operating their own account. Each account stays under the control of the client business that operates it.

3. Personal information collected

3.1 Access request (public site)

If you fill in the site's access-request form, we collect — only after your explicit consent shown in the conversation — your name, your company name, one contact detail (email or phone) and, where applicable, your message. This information feeds our log of received requests and is used only to follow up on your request. No information is transmitted before that consent.

3.2 User accounts

When an account is created for you in the software, we collect your email address, a password (stored only in hashed form), your interface language and your role within your organization — the data needed to authenticate and secure your account.

3.3 Your business data in the tool

The software lets you enter and manage your own business information: your clients, your service offerings, and the content of your proposals and documents, written or generated at your request. Your business data is not sold, not used to train third-party artificial-intelligence models, and not shared with other clients of the platform: each account stays isolated and OffrePro does not disclose it to any third party for commercial or advertising purposes. When you use the AI-assisted drafting feature, the content being drafted is transmitted to the configured language-model provider for the sole purpose of producing the requested text — see section 8 for details of this transmission, including its possible location.

3.4 Electronic signature

See section 6 below.

3.5 Technical logs

Certain security events (rate limiting, errors) and views of documents shared through a public link are logged with the IP address and browser identifier (“user-agent”), for security, audit and abuse-prevention purposes.

4. Purposes of use

We use personal information only for the following purposes:

• Respond to access requests received through the site;
• Provide, operate and secure the website and software (authentication, backups);
• Build the audit trail required for the validity of electronic signatures;
• Prevent fraud and abuse, diagnose technical incidents;
• Meet our legal obligations.

We do not use your personal information for behavioural advertising and we do not sell any personal information.

5. Audience measurement (Cloudflare Web Analytics)

The site uses an audience-measurement beacon provided by Cloudflare, a provider located outside Québec. This measurement is anonymous, aggregated and cookieless: it sets no identifier on your device and cannot identify you individually. Because no personal data is transmitted to Cloudflare as part of this measurement, this transfer outside Québec does not constitute a disclosure of personal information within the meaning of the Act; we disclose it here for transparency, in keeping with the spirit of Law 25.

6. Cookies

The Service uses only technical session cookies, needed for authentication and protection against request forgery, as well as to remember your language choice. No advertising or profiling cookie is set. The categories are as follows:

Since no non-essential cookie is set, no consent banner is displayed. The Service uses no third-party individual-tracking technology.

7. Hosting and place of processing

The application and database are hosted with OVH, on servers located in Beauharnois (Québec). PDF documents generated by the Service are kept on that same infrastructure. Before any disclosure of personal information outside Québec, we carry out the privacy impact assessment required by section 17 of the Act.

8. Artificial intelligence

The software may use language models to help you draft the content of your proposals and documents. The content suggested stays under your control: it is neither transmitted nor sent to a client until you have reviewed and approved it.

When you use the AI-assisted drafting feature, the content you submit for generation (for example, the context of a proposal or document being drafted) is transmitted to the language-model provider configured for your organization's account, for the sole purpose of producing the requested text. Depending on the configuration chosen for the deployment, that provider may be located outside Québec, notably in the United States. The platform supports a sovereign configuration (a model hosted in Québec or Canada); the provider actually in use can be disclosed to you on request to the person in charge identified in section 1. If the primary provider is unavailable, the request may be picked up automatically by another provider on the configured list, which may also be located outside Québec. Where this transmission occurs outside Québec, it is covered by the privacy impact assessment described in section 7.

Personal information is pseudonymized before this transmission. At a single outbound point, the software replaces known identifiers — the contact person's name, the client organization's name, email addresses, phone numbers, and the names and emails of the people responsible for the mandate — with neutral tokens; email addresses, phone numbers and web addresses typed freely into text are masked as well. The model provider therefore receives the text to be drafted, but not those identifiers. The mapping is restored locally on the way back, so the text you see remains complete.

This pseudonymization targets identifiers, not substance: the description of the mandate, the services and the amounts submitted for drafting are transmitted as written, and a person's name typed freely into a context note, without matching a stored record, may not be masked. We invite you to keep this in mind in what you entrust to the drafting assistant.

OffrePro does not sell any personal information and does not use the content of your documents to train its own artificial-intelligence models.

9. Retention and destruction

• Information tied to a user account is kept for as long as the client business uses the Service;
• Signed documents and their signature trail are kept for as long as necessary to prove the contract, in accordance with the applicable limitation periods in Québec;
• Unconverted access requests are deleted no later than 24 months after they are received;
• When the purposes are fulfilled, the information is securely destroyed or anonymized in accordance with the Act.

10. Security measures

We apply security measures that are reasonable and proportionate to the sensitivity of the information, including: encryption of communications (TLS), password hashing, hosting in Québec, role-based access control, event logging, rate limiting on public pages, and the principle of least privilege with our providers.

11. Electronic signature

When a document (proposal, agreement or other) is signed electronically through the Service, we build a verification trail tied to that specific document: the signatory's name and email, their electronic signature, the timestamp of acceptance or refusal, their IP address and their browser identifier. These elements demonstrate the integrity of the signature and are kept with the signed document, in accordance with section 9.

12. Your rights

In accordance with the Act, you may:

• Access the personal information we hold about you;
• Request its correction if it is inaccurate, incomplete or equivocal;
• Withdraw your consent to its use or disclosure;
• Request that dissemination cease or that information be de-indexed, in the cases provided by the Act;
• Obtain, where the Act so provides, the portability of the computerized personal information you provided to us, in a structured, commonly used technological format;
• Request the destruction of information whose retention is no longer necessary.

Send your request in writing to confidentialite@offrepro.ca. We will respond diligently, no later than 30 days after receiving it. If you are dissatisfied with how your request is handled, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

13. Confidentiality incidents

We keep a register of confidentiality incidents. Any incident presenting a risk of serious injury is reported diligently to the Commission d'accès à l'information and to the persons concerned, in accordance with sections 3.5 and following of the Act, and we take reasonable measures to reduce the risks and prevent a similar incident from recurring.

14. Minors

The Service is intended for businesses and is not directed at persons under 14 years of age. We do not knowingly collect personal information from minors.

15. Changes to this policy

We may amend this policy to reflect changes to the Service or to legislation. The current, dated version is published permanently at this address; in the event of a significant change, a notice will be posted on the site.

16. Language

This policy is published in French and in English. In case of discrepancy, the French version prevails.