Part of version 1.4 of the terms

Service-provider annex

The service-provider annex is part of Agreely's Terms of Use (section 4). The one that applies depends on your organization: an enterprise or a public body.

Service-provider annex (s. 18.3)

Enterprises

Agreely's undertaking as a service provider, in respect of the personal information your company entrusts to it.

s. 18.3 para. 1

1. Parties and roles

The client is the person carrying on an enterprise who entrusts Agreely with a mandate or a service contract involving personal information.

Agreely (operated by Ophelios Studio) acts as a mandatary or as the person performing a contract of enterprise or for services on the client's behalf. The client remains responsible for protecting that information (s. 3.1); Agreely documents, the client decides.

s. 18.3 para. 1

2. Services entrusted

In respect of the information the client entrusts to it, Agreely provides:

keeping the consent and compliance registers;
access logging (a hash-chained register whose checkpoints are anchored on a public chain);
sending request emails to the persons concerned;
where applicable, the cookie banner and the cookie-consent register.

s. 18.3 para. 1

3. Categories of personal information processed on the client's behalf

Agreely processes, on the client's behalf and according to the services enabled:

the contact details of the persons concerned (references and contact information);
consent receipts and history;
access logs and accountability metadata;
the workspace activity log: for each recorded action, the identifier of the team member, API key or Agreely operator who performed it, the action, the identifier of the record concerned and the time, with none of the record's content; it can be viewed by the client's owners and administrators, and by the Agreely team for support, these viewings being recorded in it once per person per day; the person who administers Agreely's database also has technical access to it, outside the application, which is not recorded in it;
the information contained in rights requests.

Agreely limits itself to the categories necessary to perform the contract (s. 18.3 para. 1).

s. 18.3 para. 2 subpara. 2

4. Section 18.3 para. 2 undertakings

Agreely undertakes, in writing, to take the following measures in respect of the information the client entrusts to it:

protect its confidentiality: each workspace is isolated and the client's staff reach only their own, according to role; access requires a password, and the client can require a second factor of its owners and administrators; exchanges with the service are encrypted (TLS); consent payloads and receipts, client-registry names and emails and the rights-request register are encrypted at rest under a key unique to the client, itself protected by a master key that resides on the same servers as the data;
protect its copies: the database backups are encrypted and kept in Beauharnois; the host also takes full images of the server, kept for at most seven days on the same site, where that encryption does not protect the data;
restrict the Agreely team's access to supporting and operating the service; its viewings made in the application are recorded in the activity log;
use it only for performing the service contract;
not keep it after the contract expires, as set out in the section “Term, end of contract, restitution and destruction” and subject to the section on the permanence of artefacts;
notify the client's person in charge of the protection of personal information without delay of any violation or attempted violation, by any person, of any obligation concerning the confidentiality of that information;
allow that person in charge to conduct any verification relating to that confidentiality: on written request, Agreely provides the up-to-date description of its security measures, answers questions in writing and agrees on the terms of any other verification.

5. Agreely's providers

Agreely entrusts part of performing the service to the providers below, each under a written contract. Agreely remains bound to the client by the undertakings of this annex for the information it entrusts to them.

Hébergement OVH inc. (Montréal): the application, the database and its encrypted backups, on two servers located in Beauharnois (Québec);
Zoho Mail (United States): the relay for the emails Agreely sends for the client, which receives the recipient's name and email address and the content of the message;
Anthropic (United States): cookie categorization for banners, from metadata designed to contain no personal information and no cookie value; the title of the scanned page, sent up to 300 characters, could exceptionally contain some;
Lighthouse (public IPFS network, no fixed location): pinning the public integrity copies of the documents the client publishes, described in the next section.

Agreely also writes fingerprints to the Base public chain, replicated worldwide: they contain no personal information in the clear (next section).

Stripe (United States) processes the payment of the client's subscription on Agreely's behalf; it receives none of the information the client entrusts to Agreely.

s. 18.3 para. 2 subpara. 2

6. On-chain and IPFS permanence versus the no-retention clause

Some artefacts are, by design, permanent and cannot be unpublished. This section explicitly distinguishes them from the destruction promise, by data class:

a) The on-chain anchors (Merkle roots, canonical hashes and consent commitments) are hashes: they contain no personal information in the clear and are permanent by design. Once the client's information and salts are destroyed at Agreely, neither Agreely nor anyone who does not hold the client's departure archive (or, for their own consent, the person's receipt) can link them to their content; the client holding its archive can, and that is what lets it prove its registers. They are scoped out of the destruction promise as an integrity trail.

b) The destruction or restitution promise covers the client's personal information that Agreely holds off-chain (consent receipts, customer references, access logs, etc.).

c) The documents the client publishes through Agreely (its policies and the disclosure of each published version of its consent documents, which carries the name and contact details of the person in charge as the client entered them) are pinned to IPFS as public integrity copies. Agreely has no means to withdraw a pinned document or to erase a copy a third party may have made: these copies are scoped out of the destruction promise.

Agreely does not claim a pinned or anchored artefact is destroyable. The client chooses what it publishes: before publishing, it checks that a document contains only what it means to make public.

ss. 3.5 to 3.8

7. Incident cooperation

Agreely assists the client in discharging its section 3.5 to 3.8 obligations (register, risk assessment, notice to the Commission d'accès à l'information and to the persons concerned) in respect of the information the client has entrusted to it:

notice without delay to the client's person in charge of the protection of personal information;
making available the information needed to assess the risk of serious injury;
preservation of the relevant evidence.

Agreely documents; the client's person in charge assesses, decides and notifies.

s. 17

8. Processing location and client-side note (s. 17)

Agreely hosts in Québec the information it processes for the client: the application, the database and its encrypted backups are at Hébergement OVH inc., on two servers located in Beauharnois; this hosting is not a communication outside Québec within the meaning of s. 17. Until October 19, 2026, they were hosted at Fly.io, in Ontario; the applications and the database there were destroyed on October 21, 2026.

The emails Agreely sends for the client go through the Zoho Mail relay, located in the United States, with the recipient's name and email address and the content of the message: this processing falls under s. 17, and the client must conduct its own privacy impact assessment (s. 17 para. 1) and enter into a written agreement that takes its results into account (s. 17 para. 2). Cookie categorization for banners relies on Anthropic, in the United States, using metadata designed to contain no personal information and no cookie value; only the title of a scanned page could exceptionally contain some.

This annex is an input to that assessment: Agreely supplies the facts (location, providers, measures), the client performs the assessment.

s. 18.3 para. 2 subpara. 2

9. Term, end of contract, restitution and destruction

The contract ends through the workspace's departure: an owner requests it; for 30 days the workspace keeps working and any owner can cancel the request; the workspace is then sealed: it becomes read-only for the client's team, which can still record rights requests and answer them, and its public form takes no new requests; withdrawals and erasures of consent signed by the persons concerned are still recorded there and go into the final archive; it is destroyed 30 days after the seal. An owner can cancel the departure until the seal, not after.

At the seal, Agreely generates the departure archive, which only owners can download: the client's registers, its consent proofs, the access log, the activity log, its governance texts and, in the salts/ folder, the salts still kept, which let the client link its registers to the anchored fingerprints itself; a salt already destroyed is never in it. Once downloaded, the archive is the client's responsibility. An owner can have the workspace destroyed before the due date (Destroy now) once the final archive has been downloaded.

No destruction, on the due date or on request, takes place while a hold is in effect: an unanswered rights request, a refusal 30 days old or less (the period to submit a disagreement to the Commission, s. 43), a written instruction from the client, a hold placed by Agreely, or a legal hold active in the retention register. Agreely then gives the owners a destruction statement, which documents what was destroyed and when; only its fingerprint is published.

The activity log stays online for 12 months, then in archives, and is destroyed 24 months after the end of each entry's quarter. Its destruction is suspended on the client's written instruction, in particular during an access request concerning it and until recourses are exhausted. Until the seal, owners and administrators can export its entries as CSV, and each export is recorded in the log. At the end of the contract, it is handed to the client in the departure archive (online and archived entries, as references only), then destroyed with the client's other information.

Agreely keeps a closure record for good:

the workspace's identifier, reserved, and its DID;
the departure dates, its origin and the fingerprint of the request proof;
the sector and time zone;
the statement and its fingerprint;
the final DID document marked deactivated (public keys and verified domain), which stays published at its public address;
the verified domain;
the IPFS identifiers and titles of the last published policies;
until the backups expire, a contact address to notify the person in charge of the protection of personal information of a breach touching a backup.

The departure does not revoke the DID's on-chain record. From the seal on, each public address of the workspace answers with a departure page, which shows neither the statement nor its fingerprint.

After destruction, Agreely also keeps, with no retention horizon set: the off-chain copy of anchored events, including the fingerprint of the verified domain for an access-register root; the operator console's activity journal, where the row no longer points to the workspace but its detail remains; and the email that carried the statement, whose address and workspace details are cleared when it is sent. The citizen dashboard's consent index, which Agreely keeps on its own account, is not destroyed with the workspace: each person keeps there the record of their consents to the client, as they stood at the departure, until they remove it or close their citizen account. Invoices are kept for the period required for tax purposes.

Backups and copies held by subprocessors follow their own cycle: the statement names them without declaring them deleted.

s. 18.3 para. 2 subpara. 1

10. Taking effect

This annex is part of Agreely's terms of use (section 4). It takes effect when the client accepts them and applies for as long as Agreely holds personal information on the client's behalf. If this annex and the terms of use conflict in respect of that information, this annex prevails.

This annex documents Agreely's undertakings to your company. It is not legal advice on your own obligations; your legal counsel can review it with you.

Service-provider annex (s. 67.2)

Public bodies

Agreely's undertaking as a mandatary, in respect of the personal information your public body entrusts to it.

s. 67.2 para. 1

1. Parties and roles

The client is the public body that entrusts Agreely with a mandate or a contract for services involving personal information.

Agreely (operated by Ophelios Studio) acts as a mandatary or as the person performing a contract for work or services on the client's behalf. The documents Agreely keeps for the client remain documents kept by the client within the meaning of the Access Act (s. 1); Agreely documents, the client decides.

s. 67.2 para. 1

2. Services entrusted

In respect of the information the client entrusts to it, Agreely provides:

keeping the consent and compliance registers;
access logging (a hash-chained register whose checkpoints are anchored on a public chain);
sending request emails to the persons concerned;
where applicable, the cookie banner and the cookie-consent register.

s. 67.2 para. 1

3. Categories of personal information processed on the client's behalf

Agreely processes, on the client's behalf and according to the services enabled:

the contact details of the persons concerned (references and contact information);
consent receipts and history;
access logs and accountability metadata;
the workspace activity log: for each recorded action, the identifier of the team member, API key or Agreely operator who performed it, the action, the identifier of the record concerned and the time, with none of the record's content; it can be viewed by the client's owners and administrators, and by the Agreely team for support, these viewings being recorded in it once per person per day; the person who administers Agreely's database also has technical access to it, outside the application, which is not recorded in it;
the information contained in rights requests.

Agreely limits itself to the categories necessary to carry out the mandate or perform the contract (s. 67.2 para. 1).

s. 67.2 para. 2 subpara. 2

4. Provisions of the Access Act that apply

The information the client entrusts to Agreely remains governed by the Act respecting Access to documents held by public bodies and the Protection of personal information, in particular by the following provisions:

s. 1: the documents Agreely keeps for the client are kept by the client, and the right of access to documents applies to them;
s. 53: personal information is confidential, except in the cases the Act provides;
s. 63.1: the security measures necessary to ensure its protection;
s. 63.8 to 63.11: confidentiality incidents;
s. 67.2: the mandate or contract for services entrusted in writing;
s. 70.1: release outside Québec;
s. 73: destruction, subject to the Archives Act;
s. 83 and 89: a person's access to the information concerning them and its correction;
s. 158 and 159: the offences, which apply to “anyone”, Agreely included.

s. 67.2 para. 2 subpara. 2

5. Agreely's measures and undertakings

Agreely undertakes, in writing, to take the following measures in respect of the information the client entrusts to it:

protect its confidentiality: each workspace is isolated and the client's staff reach only their own, according to role; access requires a password, and the client can require a second factor of its owners and administrators; exchanges with the service are encrypted (TLS); consent payloads and receipts, client-registry names and emails and the rights-request register are encrypted at rest under a key unique to the client, itself protected by a master key that resides on the same servers as the data;
protect its copies: the database backups are encrypted and kept in Beauharnois; the host also takes full images of the server, kept for at most seven days on the same site, where that encryption does not protect the data;
restrict the Agreely team's access to supporting and operating the service; its viewings made in the application are recorded in the activity log;
use it only for carrying out the mandate or performing the contract;
not keep it after the mandate or contract expires, as set out in the section “Term, end of contract, restitution and destruction” and subject to the section on the permanence of artefacts;
notify the client's person in charge of the protection of personal information without delay of any violation or attempted violation, by any person, of any obligation concerning the confidentiality of that information;
allow that person in charge to verify compliance with confidentiality requirements: on written request, Agreely provides the up-to-date description of its security measures, answers questions in writing and agrees on the terms of any other verification.

s. 67.2 para. 2 subpara. 2

6. Confidentiality agreements

Before releasing personal information to Agreely, the client must obtain a confidentiality agreement from every person to whom the information may be released, unless its person in charge of the protection of personal information does not consider it necessary.

On request and before any release, Agreely gives the client the signed confidentiality agreement of each member of its team who may have access to that information, and notifies the client before a new person gains such access.

7. Agreely's providers

Hébergement OVH inc. (Montréal): the application, the database and its encrypted backups, on two servers located in Beauharnois (Québec);
Zoho Mail (United States): the relay for the emails Agreely sends for the client, which receives the recipient's name and email address and the content of the message;
Anthropic (United States): cookie categorization for banners, from metadata designed to contain no personal information and no cookie value; the title of the scanned page, sent up to 300 characters, could exceptionally contain some;
Lighthouse (public IPFS network, no fixed location): pinning the public integrity copies of the documents the client publishes, described in the next section.

Agreely also writes fingerprints to the Base public chain, replicated worldwide: they contain no personal information in the clear (next section).

Stripe (United States) processes the payment of the client's subscription on Agreely's behalf; it receives none of the information the client entrusts to Agreely.

s. 67.2 para. 2 subpara. 2

8. On-chain and IPFS permanence versus the no-retention clause

Some artefacts are, by design, permanent and cannot be unpublished. This section explicitly distinguishes them from the destruction promise, by data class:

b) The destruction or restitution promise covers the client's personal information that Agreely holds off-chain (consent receipts, customer references, access logs, etc.).

Agreely does not claim a pinned or anchored artefact is destroyable. The client chooses what it publishes: before publishing, it checks that a document contains only what it means to make public.

ss. 63.8 to 63.11

9. Incident cooperation

Agreely assists the client in discharging its section 63.8 to 63.11 obligations (register, risk assessment, notice to the Commission d'accès à l'information and to the persons concerned) in respect of the information the client has entrusted to it:

notice without delay to the client's person in charge of the protection of personal information;
making available the information needed to assess the risk of serious injury;
preservation of the relevant evidence.

Agreely documents; the client's person in charge assesses, decides and notifies.

ss. 1, 9, 47, 83, 89 and 98

10. Access and correction requests

The documents Agreely keeps for the client may be the subject of a request for access (s. 1 and 9), and the personal information it holds for the client, of a request for access or correction (s. 83 and 89). The client must respond within the time limits set by sections 47 and 98.

When the client needs, to respond, a document or information it cannot obtain itself in the workspace, Agreely provides it on written request, with diligence and in time for the client to meet its own time limit.

ss. 67.3 and 70.1

11. Processing location, register and client-side note (s. 70.1)

Agreely hosts in Québec the information it processes for the client: the application, the database and its encrypted backups are at Hébergement OVH inc., on two servers located in Beauharnois; this hosting is not a release outside Québec within the meaning of s. 70.1. Until October 19, 2026, they were hosted at Fly.io, in Ontario; the applications and the database there were destroyed on October 21, 2026.

The emails Agreely sends for the client go through the Zoho Mail relay, located in the United States, with the recipient's name and email address and the content of the message: this processing falls under s. 70.1, and the client must conduct a privacy impact assessment (s. 70.1 para. 1) and enter into a written agreement that takes it into account (s. 70.1 para. 2). Cookie categorization for banners relies on Anthropic, in the United States, using metadata designed to contain no personal information and no cookie value; only the title of a scanned page could exceptionally contain some.

The client records the release of information to Agreely in its register (s. 67.3), indicating for Zoho Mail that it is a release referred to in s. 70.1. It also conducts the assessment s. 63.5 requires for any project to acquire an information system involving personal information.

This annex is an input to those assessments: Agreely supplies the facts (location, providers, measures), the client performs the assessments.

s. 67.2 para. 2 subpara. 2 and s. 73

12. Term, end of contract, restitution and destruction

At the end of the contract, Agreely hands the client a copy of what it holds on the client's behalf, then destroys the client's personal information it holds off-chain, subject to the section on the permanence of artefacts. The client keeps or destroys that copy under its own rules, subject to the Archives Act (s. 73).

No destruction, on the due date or on request, takes place while a hold is in effect: an unanswered rights request, a refusal 30 days old or less (the period to apply to the Commission for review of a decision, s. 135 para. 3), a written instruction from the client, a hold placed by Agreely, or a legal hold active in the retention register. Agreely then gives the owners a destruction statement, which documents what was destroyed and when; only its fingerprint is published.

Agreely keeps a closure record for good:

the workspace's identifier, reserved, and its DID;
the departure dates, its origin and the fingerprint of the request proof;
the sector and time zone;
the statement and its fingerprint;
the final DID document marked deactivated (public keys and verified domain), which stays published at its public address;
the verified domain;
the IPFS identifiers and titles of the last published policies;
until the backups expire, a contact address to notify the person in charge of the protection of personal information of a breach touching a backup.

The departure does not revoke the DID's on-chain record. From the seal on, each public address of the workspace answers with a departure page, which shows neither the statement nor its fingerprint.

Backups and copies held by subprocessors follow their own cycle: the statement names them without declaring them deleted.

s. 67.2 para. 2 subpara. 1

13. Taking effect

This annex documents Agreely's undertakings to your public body. It is not legal advice on your own obligations; your legal counsel can review it with you.