Chargement…
Confidentialité
Version provisoire - en attente de révision par un conseiller juridique québécois. Version française à venir.
Draft - pending review by Quebec legal counsel. French translation forthcoming.
Texte reproduit intégralement depuis le document maître 6.8 (Politique de confidentialité publique).
How Comptoir collects, uses, and protects personal information - and the rights you have over yours.
The published, public-facing policy - the plain-language companion to the internal Law 25 Program (6.x). Not legal advice; review with Quebec privacy counsel and publish in French and English before launch.
Document 6.8 · Phase 6: Legal, Compliance & Risk · Quebec, Canada
Changes in v1.1. AI-disclosure language only (§6). The earlier promise that a person at the business can always step in is replaced with the ratified honest-on-ask standard: the assistant is honest when asked what it is, and a customer who wants a person is given the business's phone number and opening hours to call directly - a human does not take over the text conversation. A ⚖ counsel flag is added on Law 25 sufficiency. (Entity-name placeholders: addressed in v1.2 - see Changes in v1.2 below.)
Changes in v1.2. R-4 entity forward-fill (DEC-1): privacy officer contact block (§13) and §1 entity note now carry [XXXX-XXXX Québec Inc.] doing business as Comptoir, replacing the generic "[Entity legal name]" placeholder. Registered address and privacy contact email tagged PENDING DATA pending incorporation. AI-disclosure/honest-on-ask language from v1.1 unchanged.
Comptoir provides AI assistants that help local businesses talk to their customers - confirming appointments, answering questions, requesting reviews, and bringing past customers back. Running that service means handling personal information with care. This policy explains, in plain language, what we collect, why, who we share it with, and the rights you have. It is published under Quebec's Act respecting the protection of personal information in the private sector, as modernised by Law 25.
Who this covers. This policy applies to visitors to our website, to the businesses that use Comptoir, and to the people those businesses serve, whose information may pass through our platform. Where we handle a business's customer data, we do so on that business's instructions - see §2.
Our Privacy Officer. Misha Demers is Comptoir's Privacy Officer, responsible for the protection of personal information and for answering your questions and requests. Contact details are in §13. (Entity: [XXXX-XXXX Québec Inc.] doing business as Comptoir. Registered address: PENDING DATA - to be confirmed at incorporation.)
In both official languages. Comptoir operates in French and English; this policy is published in both, and the French version governs for Quebec residents.
Comptoir handles personal information in two different capacities, and your rights route differently in each.
As the business making the decisions (controller). For our website visitors and for the businesses that sign up with us, Comptoir decides what is collected and why - account details, billing, support, and how our site works. For this information, you exercise your rights directly with us (§10).
As a service acting for a business (processor). When a business uses Comptoir to message its own customers, that business decides what is collected and why; we act on its instructions and process the data on its behalf. The phone numbers, conversation content, and visit history of a business's customers belong to that relationship. If you are a customer of a business that uses Comptoir and you want to access, correct, or delete your information, the fastest route is the business itself - and we help them respond. The terms governing this role live in our Data-Rights & Data-Processing Agreement (6.6).
We collect only what the service needs. We do not collect biometric data, and we do not sell personal information to anyone.
Basic technical information (such as device and browser data) and any details you choose to give us through a form or our demo. This lets us run and improve the site and respond to you.
Account and contact details, the configuration of your AI front desk, billing information (processed by our payment provider), and support correspondence. This lets us provide, bill for, and support the service.
Contact details (typically a phone number), the content of conversations with the AI front desk, appointment and visit history, and the consent status that governs whether and how they may be messaged. This is what makes the reminders, replies, and win-backs work - and it is handled on the business's behalf under §2.
We collect, use, and share personal information with consent, except where the law allows otherwise. Our consent is clear, specific, and asked for on its own - not buried in other terms.
We use personal information to operate the service: to run the AI front desk, deliver and confirm messages, schedule appointments, take payment, provide support, keep the platform secure, and meet our legal obligations. We also use it to improve Comptoir - but with a hard limit on how.
Insights are built from the crowd, never from one business. Any benchmark or industry insight we produce is drawn from many businesses combined and stripped of identifying detail, so no single business or person can be picked out, and only above a minimum-group threshold. This is governed by the Data-Rights DPA (6.6); a business can opt out of contributing, and we never publish one business's data as its own.
Comptoir's assistants use artificial intelligence to read incoming messages and draft helpful replies on the business's behalf. Two commitments govern this:
The fuller rules on how the assistants behave - accuracy, honest disclosure, how to reach a person, and what they will not do - are set out in our AI Governance & Bot-Conduct Policy (6.9), which holds the assistants to an honest-on-ask standard.
⚖ For counsel - Law 25 automated-processing openness duty ( PENDING DATA ). The honest-on-ask standard above is adopted under DEC-7 and homed in 6.9 §3. The assistants run without live human monitoring and do not hand a customer to a human mid-conversation - a person is reached by calling the business directly. Counsel must confirm this satisfies the Law 25 openness duty before reliance; the conservative fallback, if required, is a one-line assisted-by-an-AI notice in this policy rather than a disclaimer in every conversation.
We share personal information only with the service providers that make Comptoir work, each under contract and only for the purpose we engage them for. We do not sell it. The main categories of provider are:
AI processing (to read and draft messages), SMS delivery, payment processing, database and website hosting, email delivery, workflow automation, and calendar scheduling.
A current list of our key providers is available on request and is kept up to date. Several of these providers operate outside Quebec, mainly in the United States, so some information is processed there.
Data that leaves Quebec is assessed first. Before relying on a provider outside Quebec, we assess whether the information will receive protection comparable to what Law 25 requires, and we put contractual safeguards in place. The assessment is documented in our Law 25 Program (6.x).
Our website uses a small number of technologies to function and to understand how the site is used. Any technology that could identify, locate, or build a profile of you is turned off by default; we activate it only with your consent, and you can change your choice at any time through the controls on our site. We tell you what each category does before you decide.
We keep personal information only as long as we need it for the purpose it was collected, or as the law requires us to. After that, we destroy it or anonymise it so it can no longer identify anyone. Where we act for a business (§2), the business sets the retention of its customers' data, and our defaults and schedule are set out in the Law 25 Program (6.x).
Law 25 gives you strong rights over your personal information. With us you may:
To make a request, contact our Privacy Officer (§13). We respond within 30 days. If you are a customer of a business that uses Comptoir, the quickest path is usually that business, and we will help it respond. If you are not satisfied with how we handle your request, you may complain to the Commission d'accès à l'information du Québec (the CAI).
We protect personal information with technical and organisational measures appropriate to its sensitivity - including encryption, strict access controls scoped so each business sees only its own data, and an audit log of access to customer records (5.1 / 5.2).
If a confidentiality incident occurs. If personal information is lost or accessed without authorisation and the incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people affected, as Law 25 requires, and we take steps to reduce the harm. We keep a register of every confidentiality incident. The full protocol is in our Law 25 Program (6.x).
Comptoir is built for businesses and their adult customers. We do not knowingly collect the personal information of a child under 14 without the consent of a parent or guardian. If you believe we hold such information without that consent, contact our Privacy Officer and we will address it.
If we make a material change to this policy, we will post the updated version here and, where appropriate, let you know. The date of the latest version is shown in the document control above.
Contact our Privacy Officer Misha Demers, Privacy Officer - Comptoir [XXXX-XXXX Québec Inc.] doing business as Comptoir - [registered address and privacy contact email - PENDING DATA, to be confirmed at incorporation] You may also contact the Commission d'accès à l'information du Québec (CAI), the authority that oversees Law 25.
This published policy is the front door. The detail lives in the documents below, so nothing is duplicated.
| Topic | Owning document |
|---|---|
| Internal privacy program, PIAs, breach register, retention schedule | 6.x Law 25 Privacy Program |
| End-customer (processor) data; benchmark / composite consent | 6.6 Data-Rights & Data-Processing Agreement |
| Messaging consent, opt-outs, the consent state machine | 6.7 CASL Compliance Policy |
| How the AI assistants behave; accuracy, the honest-on-ask standard, how to reach a person, limits | 6.9 AI Governance & Bot-Conduct Policy |
| Security architecture, access scoping, the audit log | 5.1 Technical Architecture · 5.2 Data Schema |
| The website & demo; the French version | 4.5 Website Spec · 4.3 Bilingual Voice & Tone |
Comptoir - Privacy Policy. Document 6.8 · published under Quebec's Law 25 · draft for counsel review · French and English required before launch · not legal advice.