Privacy Policy

1. Data controller

BatiCore, Saint-Basile-le-Grand, Quebec, Canada. Privacy Officer (RPRP): Cliford Saint-Natus, founder — privacy@baticore.ca

2. Information collected

BatiCore collects the following information:

• Account data: name, email address, password (bcrypt-hashed), RBQ licence number
• Company data: legal name, address, GST/QST numbers, NEQ
• Client data: contact details (name, email, phone, address, city)
• Quote data: work descriptions, amounts, LCCJTI electronic signatures (double SHA-256 hash, handwritten signature stroke, IP address, User-Agent, timestamp)
• CCQ / site data: workers’ CCQ numbers, GPS clock-in coordinates, regular and overtime hours, daily reports
• CNESST data: incident reports (near-misses, accidents — including photos and description of corrective actions)
• HR data: name, role, timesheets, CCQ payroll calculations — SIN only with separate explicit consent
• Client portal tokens: single-use tokens for secure portal access (invalidated after use)
• Website visitor data: name, email and — if provided — company and phone number sent through the contact form, to answer the request
• Technical data: IP addresses, access and audit logs, browser (User-Agent)

3. Purposes of processing

• Providing the BatiCore service (quote, site and compliance management)
• Billing and subscription management (via Stripe)
• Sending transactional communications (via Resend)
• Service improvement and fraud prevention
• Compliance with Quebec legal obligations (Law 25, RBQ, CNESST)

4. Ownership of your data and BatiCore's role

You remain the owner of all data that you and your teams upload to BatiCore (clients, quotes, job sites, documents). BatiCore claims no ownership of your business data or of content about your clients.

For information you enter about your own clients and workers, BatiCore acts as an agent (mandataire): we process it only to provide the service, on your instructions — never for our own purposes.

• We never sell, rent or trade your personal information to third parties.
• We do not use your business data or your clients' data for advertising or marketing profiling.
• Briefs sent to the AI (Anthropic) are anonymized, processed in transit only, and are not used to train models.
• You can export your data (portability) and request its deletion at any time.

5. Transfers to third parties

BatiCore's hosting — application, API, database and files — is provided by Amazon Web Services in the Canada region (Montréal, ca-central-1): your data is stored in Canada and is not transferred outside Quebec for hosting. Some limited information is nevertheless transmitted to subcontractors located in the United States (see the table below), in accordance with Article 17 of Law 25. A privacy impact assessment (PIA) is underway or completed for these transfers to ensure an adequate level of protection. Each subcontractor is contractually bound by confidentiality obligations: it may use your information only to provide the service to BatiCore, never for its own purposes or marketing.

6. Data retention

• Account and company data: subscription duration + 7 years (tax obligations)
• Quotes and LCCJTI signatures: permanent (legal proof, Quebec civil prescription)
• CCQ data (attendance, hours): 5 years (CCQ requirements)
• CNESST incident reports: 5 years
• Briefs sent to AI (Anthropic): not retained by Anthropic (in-transit processing only)
• Client portal tokens: invalidated after single use
• Technical access logs: 12 months; audit log of sensitive actions: retained with the related data (up to 7 years for operations with tax or legal scope)

7. Your rights (Law 25)

In accordance with the Act to modernize legislative provisions respecting the protection of personal information (Law 25), you have the following rights:

• Right to access your personal information
• Right to rectification
• Right to erasure (on request to privacy@; account data deleted within 30 days of termination). This right may be limited by other legal retention obligations — notably tax and payroll supporting records, as well as contracts and electronic signatures (LCCJTI) kept as legal evidence.
• Right to portability of your information (export provided on request)
• Right to withdraw your consent at any time

To exercise your rights: privacy@baticore.ca

8. Security

• TLS encryption in transit (HTTPS)
• Passwords hashed with bcrypt (cost 12)
• MFA secrets encrypted with AES-256
• JWT tokens stored in httpOnly + SameSite=Strict cookies (not accessible via JavaScript)
• Multi-tenant RBAC access control with 7 roles (OWNER, ADMIN, MANAGER_COMMERCIAL, FINANCE, ESTIMATEUR, CHEF_CHANTIER, OUVRIER) and tenantId isolation
• LCCJTI electronic signatures: double SHA-256 hash (linesHash + signatureHash)
• OWASP security headers via Helmet (CSP, HSTS, X-Frame-Options)
• Audit logs for all sensitive actions
• Automated encrypted backups (AWS RDS, Canada region — Montréal)

9. Privacy incident notification

In accordance with Law 25, in the event of a confidentiality incident (unauthorized access, use, disclosure or loss of personal information) presenting a risk of serious harm, BatiCore keeps a register of incidents, takes reasonable measures to reduce the risk and prevent recurrence, and promptly notifies the Commission d'accès à l'information du Québec as well as the affected individuals. We will inform you by email at your account's primary address. You agree to notify us without delay if you suspect a compromise of your credentials or device.

10. Staff access to your data

Your data is isolated per tenant (tenantId). BatiCore staff have no routine access to the content of your account.

• Administrative access is limited to what is necessary: support and troubleshooting at your request, maintenance, security investigation or legal obligation.
• Where feasible, we request your permission before accessing your workspace for support purposes.
• All administrative access and every sensitive action are logged (tamper-evident audit trail).
• An internal dashboard of aggregated business metrics is reserved for the founder and exposes no personal information about your clients.
• We never modify your data unless necessary (requested support or an incident), and always with logging.

11. Disclosure required by law

BatiCore may be required to disclose personal information to a government or judicial authority upon receipt of a valid legal request (court order, warrant, subpoena). Where this occurs, we limit ourselves to the information strictly required and, where the law permits, we inform you.

12. Client responsibilities

As the controller of the data you upload, you agree to:

• Have the right to collect and upload your clients' and workers' information, and obtain any required consents.
• Social Insurance Number (SIN): it is optional in BatiCore and used only to prepare tax slips (T4, Relevé 1, record of employment). If you upload it, you act under your own responsibility as an employer: you must have the worker's consent or act within your tax compliance obligations.
• Manage your users' access and their roles (permissions) within your account.
• Use BatiCore in accordance with applicable laws and our terms of use.
• Not upload any sensitive information that is not necessary for your use of the platform.

14. Automated decisions

BatiCore uses algorithms that may have an impact on you. None of these analyses produces a legal effect through exclusively automated processing: they are calculation proposals that require human validation by the account administrator before any official processing.

• AI quote generation (Claude / Anthropic) — suggestive only, you retain final control
• CRM score and Copilot alerts — no contractual impact, informational only
• Project health score — monitoring indicator, human decision required
• CCQ hours and payroll calculation — INDICATIVE calculation based on CCQ rules: BatiCore prepares payroll, it does not process it. Human validation by the administrator is required before any payment or official filing.

To contest an automated calculation: privacy@baticore.ca

15. Communications, minors and miscellaneous

• Communications: BatiCore sends only transactional emails (account, quotes, notifications). No marketing newsletter without your consent — you can unsubscribe at any time.
• Minors: the platform is intended for professionals; we do not knowingly collect information about minors.
• Internet limits: despite our measures, no transmission over the Internet is 100% secure; protect your credentials and your device.
• Changes: in the event of a significant change, we will update the date at the top of this page and notify you via an in-app notice or by email.

16. Complaint

If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).