Privacy policy - La Corvée

Ophelios values the protection of your personal information. This privacy policy explains, in plain and clear terms, how we collect, use and protect it (s. 8.2). It is generated from our personal information register and reviewed before publication.

Scope of this policy

This privacy policy concerns the product or service "La Corvée". It describes the personal information we collect in that context. Information collected through our other products or services is covered by their own policy or by a policy covering the enterprise as a whole, where one exists.

Information collected and purposes

We collect the following categories of personal information: Business contracts and agreements: name, contact details, company, terms and signatures, Visits to ophelios.com measured by our audience tool (pages, referrer, device, approximate location), Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language, corvee.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location), La Corvée contact form messages: name, email address, message content and our replies, Requests and correspondence: name, email address, company, message content and our replies, Client invoices and accounting records (Memento), Records of organizations subscribed to La Corvée: people served, volunteers, members, donors (mandate), La Corvée activity log and technical logs (identifiers, timestamps, actions taken), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments), La Corvée user accounts (name, email, hashed password, sign-in factors, sessions). They are used only for these specific purposes: Conclude, perform and evidence our contracts and agreements with clients, partners and investors, Measure aggregate traffic to the ophelios.com site (opt-out: the Do Not Track signal, if your browser sends it, or the umami.disabled value in the site's local storage), Schedule, confirm and hold a meeting with Ophelios (demo, consultation or business meeting), Measure aggregate traffic to the corvee.ca site (opt-out: the Do Not Track signal, if your browser sends it, or an umami.disabled value in the site's local storage), Answer the people who write to La Corvée and keep a record of it, Respond to your requests (support, sales, business relations, exercise of rights), maintain our relations with clients, prospects, partners and investors, and keep a record of them, Billing, accounting and tax obligations, Carry out the organization's mandate: host and process its records according to its instructions (meals, transport, calls, volunteers, membership, budget), Ensure the security and traceability of the service and investigate incidents, Bill subscriptions and keep accounting and tax records, Operate the service: sign-in, account security and the necessary emails (invitations, account recovery, notices).

Some information may be collected from third parties. You may request the source of information collected from another enterprise (s. 7).

For the following purposes we rely on your consent, which you may withdraw at any time (s. 8): Measure aggregate traffic to the ophelios.com site (opt-out: the Do Not Track signal, if your browser sends it, or the umami.disabled value in the site's local storage), Measure aggregate traffic to the corvee.ca site (opt-out: the Do Not Track signal, if your browser sends it, or an umami.disabled value in the site's local storage).

The category "Business contracts and agreements: name, contact details, company, terms and signatures" (purpose: Conclude, perform and evidence our contracts and agreements with clients, partners and investors) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Without this information we can neither conclude the contract, nor perform it, nor evidence it.

The category "Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language" (purpose: Schedule, confirm and hold a meeting with Ophelios (demo, consultation or business meeting)) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without this information, we can neither schedule the meeting nor hold it.

The category "La Corvée contact form messages: name, email address, message content and our replies" (purpose: Answer the people who write to La Corvée and keep a record of it) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without this information, we can neither answer their request nor keep a record of it.

The category "Requests and correspondence: name, email address, company, message content and our replies" (purpose: Respond to your requests (support, sales, business relations, exercise of rights), maintain our relations with clients, prospects, partners and investors, and keep a record of them) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without this information, we can neither answer their request nor keep a record of it.

The category "Client invoices and accounting records (Memento)" (purpose: Billing, accounting and tax obligations) is held on a declared statutory basis (a legal retention obligation, s. 23), not on your consent: Tax laws (Revenu Québec, CRA) require keeping accounting records and supporting documents for about six years after the last relevant tax year. The law expressly reserves such a retention period provided by another law (P-39.1 s. 23).

The category "Records of organizations subscribed to La Corvée: people served, volunteers, members, donors (mandate)" (purpose: Carry out the organization's mandate: host and process its records according to its instructions (meals, transport, calls, volunteers, membership, budget)) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the organization's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the organization's person in charge and verification right of the organization's person in charge (s. 18.3 para. 2). The organization remains responsible (s. 3.1). « Contract » is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "La Corvée activity log and technical logs (identifiers, timestamps, actions taken)" (purpose: Ensure the security and traceability of the service and investigate incidents) is held on a declared statutory basis (fraud prevention and security, s. 12 para. 2 (3)), not on your consent: Use necessary for the prevention and detection of fraud or the assessment and improvement of protection and security measures (s. 12 para. 2 (3)).

The category "Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments)" (purpose: Bill subscriptions and keep accounting and tax records) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Collection and holding necessary for the conclusion and performance of the subscription contract (s. 9 para. 1 (1)). Invoices are kept 6 years for tax purposes (terms of use, section 10).

The category "La Corvée user accounts (name, email, hashed password, sign-in factors, sessions)" (purpose: Operate the service: sign-in, account security and the necessary emails (invitations, account recovery, notices)) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without a named account, La Corvée can neither authenticate the person nor give them access to their organization's records.

Some of this information is sensitive; where consent is required to use it for another purpose or to communicate it, that consent must be given expressly (ss. 12 para. 1 and 13 para. 2): Contains sensitive information: health (allergies, medical reasons for a ride), financial situation (contributions) and home access. Access is limited by role, the database refuses reads to roles without the right, and every consultation is logged.

Means of collection

We collect the information described above from you by the following means (s. 8):

online forms (website or application): Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language (on rdv.ophelios.com, when you book a meeting), La Corvée contact form messages: name, email address, message content and our replies, Client invoices and accounting records (Memento), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments), La Corvée user accounts (name, email, hashed password, sign-in factors, sessions);

automatically, when you use our online services (technical logs): Visits to ophelios.com measured by our audience tool (pages, referrer, device, approximate location) (by our audience-measurement tool, without cookies, when you visit ophelios.com), corvee.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location) (through our audience measurement tool, without cookies, when you visit corvee.ca), La Corvée activity log and technical logs (identifiers, timestamps, actions taken);

email: Business contracts and agreements: name, contact details, company, terms and signatures, Requests and correspondence: name, email address, company, message content and our replies, Client invoices and accounting records (Memento), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments);

telephone: Requests and correspondence: name, email address, company, message content and our replies;

in person: Requests and correspondence: name, email address, company, message content and our replies;

paper documents, including by mail: Business contracts and agreements: name, contact details, company, terms and signatures.

Professional contact information

Certain information concerns the exercise of a professional function within an enterprise (Client representatives' contact details (name, position, work email and phone)). Under section 1 of the Act respecting the protection of personal information in the private sector (as amended by Law 25), the consent rules do not apply to it; it is not subject to consent or withdrawal. Your right of access and rectification and our incident obligations still apply.

Retention and destruction

Retention must be limited to the period necessary for the purposes of collection, followed by destruction or anonymization (s. 23). The periods below are declared rules, not proof of completed destruction. Correspondence and requests: kept for 24 months after the last exchange, then destroyed. Client representatives' contact details (Memento): kept for 24 months after the last activity, then destroyed. Umami audience measurement: raw events: kept for 13 months from collection, then destroyed. La Corvée contact form messages: kept for 24 months after the last exchange, then destroyed. La Corvée organization accounts and records: kept for 24 months after the end of the organization's subscription, then destroyed. La Corvée activity log: kept for 24 months from collection, then destroyed. Billing and tax records: kept for 72 months after the purposes are achieved, then destroyed.

Protection of your personal information

We take reasonable security measures to protect your personal information, considering in particular its sensitivity, the purposes for which it is used, its quantity, its distribution and its medium (s. 10). When your information is destroyed, it is destroyed securely. Across the enterprise, they include, in particular: training and confidentiality undertakings, incident response, secure destruction, minimization and de-identification, logging and monitoring, access control, encryption, backups and recovery.

Recipients

Your personal information is accessible only to the persons in our organization whose duties require it. It may also be communicated to the following recipients. In Québec: Hébergement OVH inc. (hosting of our servers). Outside Québec: Apple (iCloud) (calendar for demo meetings), Cloudflare (delivery of La Corvée's website and name servers), Fly.io (hosting of website audience measurement), Zoho Mail (relay of transactional emails).

Hébergement OVH inc.: Hosting of the virtual private servers that run Agreely (database, application, encrypted backups; since 2026-10-19), La Corvée (application, database and backups) and Ophelios's booking tool (rdv.ophelios.com: Cal.com, its database and its daily backups; since 2026-10-27); information communicated: All personal information held by Agreely, by La Corvée and by Ophelios's booking tool, including the records held on behalf of clients (stored on the servers and in their backups).

Apple (iCloud): Ophelios's iCloud calendar: entry of the meetings booked on rdv.ophelios.com, and reading of busy times so that only free slots are offered; information communicated: Name and email address of the person booking, date, time and link of the meeting and any notes entered.

Cloudflare: Content delivery network and proxy for the corvee.ca site, and name servers (DNS) for the corvee.ca domain, through Ophelios's Cloudflare account; information communicated: visitors' IP address, user agent and requests.

Fly.io: Hosting of the Umami instance (analytics.ophelios.com) that measures the audience of the agreely.ca, corvee.ca and ophelios.com sites; information communicated: Page viewed and its title, referring page, screen size, language, browser, system and device type, approximate location, pseudonymous visit identifier, plus the IP address and user agent in transit.

Zoho Mail: Relay of the transactional emails sent by Agreely (verifications, notices, alerts), by La Corvée (invitations, notices, reminders, invoices) and by Ophelios's booking tool (request, confirmation or refusal of a meeting), and hosting of the mailboxes that receive messages addressed to Agreely (including the mailbox of the person in charge of the protection of personal information), to Ophelios and to La Corvée; information communicated: Name and email address of senders and recipients and content of the messages, which may contain names and contact details.

Your personal information is not communicated to any other third party without your consent, except in the cases provided for by law (ss. 13, 18 and 18.3).

Communication outside Québec

Some of your personal information may be communicated outside Québec, to the following recipients: Apple (iCloud) (Ontario, Canada, Apple Canada Inc., Toronto; server location not stated), Cloudflare (United States, Cloudflare, Inc.; global network, logs processed in the United States and Europe), Fly.io (Outside Québec, Fly.io, Inc., a US company; instance in the Toronto, Ontario region), Zoho Mail (United States). These recipients act on our behalf. A privacy impact assessment has been carried out for each of these communications and concluded that the information would receive adequate protection (s. 17).

Your rights

You have a right of access and rectification (ss. 27 and 28). You also have the right to obtain a computerized copy of personal information you provided to us in a structured, commonly used technological format, unless doing so raises serious practical difficulties (s. 27, para. 3). In the cases provided for by law, you may require that the dissemination of your information cease or that it be de-indexed (s. 28.1). You may withdraw your consent to the communication or use of the information collected (s. 8). These rights are exercised in writing with the person in charge identified below (ss. 29 and 30). As of the publication date of this policy, they may also be exercised online at the following address: https://app.agreely.ca/p/ophelios/rights.

Person in charge of personal information protection

To exercise your rights or for any question, contact: David Tucker, President and Chief Executive Officer - david.tucker@ophelios.com.