Person designated as responsible for the protection of personal information at Bâtir à Rabais inc.: Simon Lafortune, co-founder and director, simon@batirarabais.ca. A register of confidentiality incidents is kept under section 3.8 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1, "Law 25"). In case of an incident presenting a risk of serious injury, affected users and the Commission d’accès à l’information will be notified without delay.
Legal basis: Bâtir à Rabais inc. is subject to Law 25 and to the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5), depending on where the user resides.
Data collected: email address (required for the waitlist and product communications), optional profile (homeowner, contractor or retailer), preferred language, signup source, timestamp, truncated IP address and browser type for security and aggregate statistics. No password is stored: authentication happens through a magic link sent by email.
Purposes: announcing the beta opening, sending product newsletters the user consented to, segmenting by profile to adapt content, improving the service, preventing fraud and meeting legal obligations. No data is sold, rented or traded, and no data is used for third-party targeted advertising.
Hosting and transfers outside Quebec: the database is hosted with Supabase in a Canadian region (ca-central-1). Some delivery components (the Vercel CDN) may route requests through the United States. A privacy impact assessment was carried out under section 3.3 of Law 25; it concludes that the contractual and technical safeguards offered by those providers (encryption in transit and at rest, standard contractual clauses, SOC 2 certifications) ensure a level of protection equivalent to the one required in Quebec.
Retention: inactive account — automatic anonymization after 24 months without a sign-in; marketing list data — until unsubscribe, then 3 years as proof of consent; technical logs — 12 months. Any request for earlier deletion is handled within 30 days at most.
Rights of data subjects: access, correction, withdrawal of consent, de-indexing, portability and deletion. To exercise a right: simon@batirarabais.ca. If you disagree with our answer, you can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or to the Office of the Privacy Commissioner of Canada (priv.gc.ca). The full detail is in our privacy policy.