Privacy policy

Bâtir à Rabais inc. ("Buildsavr", "we") is a Quebec corporation duly incorporated and registered with the Registraire des entreprises du Québec, with its head office in Sainte-Julienne (Lanaudière, Quebec). Alexandre Pelletier and Simon Lafortune are its co-founders and directors. The person designated as responsible for the protection of personal information is Simon Lafortune, reachable at simon@batirarabais.ca.

This policy applies to buildsavr.com, to batirarabais.ca, to the web application (subdomains included) and to any related service operated by Bâtir à Rabais inc. It describes how we collect, use, disclose and protect your personal information.

Account and authentication: email address (required), optional profile (homeowner, contractor, retailer), preferred language, signup source and timestamp. Authentication happens through a magic link sent by email; no password is stored on our servers.

Third-party sign-in (Google and others): when you choose to sign in with a third-party identity provider, we receive your email address and a unique identifier from that service in order to create or find your account. We do not access your contacts, your messages or your files.

Service data: projects, materials lists, postal codes you enter, retailer preferences, and photos of lists or receipts you send us voluntarily.

Technical data: truncated IP address, browser type, operating system and error logs, for security, fraud prevention and aggregate statistics.

To provide, maintain and improve the price-comparison service; to authenticate users; to send transactional notices (magic link, confirmations, receipts); to send product newsletters where you have consented; to produce aggregate statistics; to detect and prevent fraud or abuse; and to comply with applicable legal obligations.

No personal data is sold, rented or traded. No data is used for third-party targeted advertising.

We disclose personal information only to subprocessors acting on our instructions and bound by contractual confidentiality and security commitments: Supabase (database and authentication, region ca-central-1), Vercel (web hosting and CDN), Anthropic (AI models for product disambiguation), Stripe (payments where applicable), an email newsletter provider, PostHog in cookieless mode for aggregate statistics, and Sentry for error and performance monitoring.

Some delivery components may route requests through the United States. A privacy impact assessment was carried out under section 3.3 of Quebec’s Law 25; contractual safeguards, encryption in transit and at rest, and our providers’ SOC 2 certifications ensure a level of protection equivalent to the one required in Quebec.

We may disclose information to a competent public authority where the law requires it, or to assert our rights in legal proceedings.

Active account: as long as the account stays open. Inactive account: automatic anonymization after 24 months without a sign-in. Marketing list: until you unsubscribe, then 3 years as proof of consent. Technical logs: 12 months.

Any request for earlier deletion is handled within 30 days at most.

No advertising or tracking cookie is set. The only cookies used are strictly necessary for the site to work, in particular the Supabase authentication session when you are signed in. Those cookies are exempt from prior consent under the practice of the Commission d’accès à l’information.

PostHog is configured in cookieless mode to measure aggregate site usage; it may process your IP address and user agent on the basis of legitimate interest, with a right to object at simon@batirarabais.ca.

For diagnostics, PostHog and Sentry may record an anonymized replay of a session. Every form field is masked at the source: your email address, your project address and any text you type are never captured. No password is involved, since authentication is by magic link.

Under Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights: access, correction, withdrawal of consent, portability, de-indexing and deletion. You may also ask what information and what main factors led to an automated decision, and ask for a human to review it.

To exercise a right or ask a question: simon@batirarabais.ca. Maximum response time: 30 days. If you disagree with our answer, you can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We apply reasonable technical and organizational measures to protect your information: TLS encryption in transit, encryption at rest, access control, logging, environment separation and regular permission reviews. Since no system is invulnerable, we keep a register of confidentiality incidents and we will notify affected users and the Commission d’accès à l’information without delay in case of an incident presenting a risk of serious injury.

The service is not aimed at children under 14 and we do not knowingly collect information about them. If you believe a minor has sent us personal information without the required consent, write to simon@batirarabais.ca so that we can delete it.

This policy may be updated from time to time. The date of the last update appears at the top of this page. Significant changes will be announced by email to registered users or through a prominent notice on the site.

Privacy, access, correction or deletion: simon@batirarabais.ca (person responsible for the protection of personal information).

Legal requests: legal@batirarabais.ca.

General questions: hello@batirarabais.ca.