Privacy policy

Caelum Cloud Services Inc. ("Caelum", "we") builds, hosts and maintains websites and applications for businesses. This policy explains, in plain terms, what personal information we collect, why, who we share it with, how long we keep it, and the rights you have. It applies to our website, our client portal and our emails. It follows Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's PIPEDA.

Who is responsible

The person in charge of the protection of personal information at Caelum is our founder, Privacy Officer. You can reach them at [email protected] for any question or request about your information.

What we collect, and why

Information	Why we use it	How long we keep it
Your account: name, work email, position, profile picture, password (stored only as a salted hash we cannot reverse)	To give you access to the client portal and know who does what for your business	While your business is our client; once the relationship ends, deleted on request, except what the law requires us to keep
Your business: name, address, phone, billing email, tax numbers, logo	To prepare quotes, contracts and invoices and apply the right taxes	As long as needed for the relationship, and for invoices at least 6 years (tax law)
Billing: quotes, contracts, invoices, credit notes, payments	To bill and be paid, and to meet our tax and accounting obligations	6 years after the end of the fiscal year they relate to
Cards: card brand, last 4 digits and expiry of a card saved for auto-pay, and your authorization (name, time, IP address)	To pay invoices with the card you chose, and prove you authorized it	Until you remove the card or turn auto-pay off, then with the billing records. Your full card number never reaches us: it is collected and kept by our payment processor, Stripe.
Security records: sign-ins, password resets, the IP address and browser used, devices you approved	To protect your account (lockouts, new-device approval) and investigate misuse	Sign-in records 90 days; approved devices until you remove them
Activity history: who created or changed what in the portal (never passwords), with the time and IP address	To keep an audit trail of changes to contracts, invoices and accounts	2 years
Your messages: service requests, support tickets and their attachments	To answer you and deliver the service	While your business is our client; deleted on request once the relationship ends
Newsletter: your email, and when and from where you confirmed your subscription	To send the newsletter you asked for, and prove your consent (Canada's anti-spam law, CASL)	Until you unsubscribe (one click in every newsletter); we then keep only the record of your consent and unsubscription
Quote acceptance: the name you typed to sign, the time and IP address	To prove the agreement	With the contract it created

Database backups are kept 30 days, then deleted. We only collect what we need for these purposes; we do not sell personal information, and we do not use it for advertising or profiling.

Cookies and tracking

We use no advertising or analytics trackers and nothing that identifies, locates or profiles you. The site only uses what it needs to work: a technical connection cookie, your signed-in session (kept in your browser tab and removed when you close it), and, once you approve a device, a random device key saved in your browser so we don't ask again. These can't be turned off without breaking sign-in, so we don't ask for consent to them.

Who we share it with

We share personal information only with the service providers we need to run our services, under contracts that require them to protect it and use it only for us:

• Stripe (United States / Ireland), our payment processor: card payments, saved cards and payment links.
• Resend (United States): delivering our emails (invoices, notifications, newsletter).
• MXroute (United States): hosting our mailboxes, so messages you send us (support, replies) are received there.
• Cloudflare (worldwide network): website security and delivery, and file storage (invoices, backups, pictures).
• Have I Been Pwned: when you choose a password, we check it against known data breaches. Only the first 5 characters of a hash of the password leave our servers, never the password.

Some of these providers store or process information outside Québec and Canada. Before doing so we assessed that the information stays adequately protected. We may also disclose information when the law requires it (for example to tax authorities).

How we protect it

Encrypted connections everywhere, passwords stored as strong salted hashes, approval by email of every new device, lockout after repeated failed sign-ins, access limited to the people who need it, an activity history of changes, and off-site backups in encrypted storage. If an incident ever puts your information at risk of serious harm, we will tell you and the Commission d'accès à l'information promptly, as the law requires.

Your rights

You can, at any time and free of charge:

• access the personal information we hold about you, and get it in a structured, commonly used format;
• have it corrected if it is wrong or incomplete — much of it you can change yourself in the portal;
• withdraw your consent (for example unsubscribe from the newsletter) and ask us to delete information we no longer need;
• ask what information we used to make a decision about you (we make no fully automated decisions).

Write to [email protected]; we answer within 30 days. If you're not satisfied with our answer, you can complain to Québec's Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada.

Information our clients entrust to us

When we host a client's website or application, the information of their customers belongs to them: we handle it only on their instructions, to provide the service. Questions about that information should go to the business concerned.

Changes

We'll post any change here with a new date, and tell clients by email of any important change before it applies.