Privacy Policy
Last updated: June 2, 2026 · Version 1.3
This English version is provided for convenience; in case of discrepancy, the French version prevails.
🔒 Your data is hosted in Canada, encrypted in transit and at rest, and never sold to third parties. Full compliance with Quebec's Law 25.
1. Data controller
SubmitX Inc. (hereinafter "SubmitX", "we") is responsible for processing your personal information. To reach us: support@submitx.ca · 514-835-8734 · Montreal, Quebec, Canada.
2. Data collected
We collect the following types of data:
- Identification data: last name, first name, business email, phone number
- Company data: company name, RBQ number, address, line of business
- Usage data: pages visited, features used, session length (via PostHog, without personal identification by default)
- Billing data: payment details (handled by Stripe; SubmitX never stores your card numbers)
- Project data: quotes, clients and projects created in the platform
- Technical data: IP address, browser type, operating system (for security and debugging)
3. Gmail integration: Google API Services
Compliance statement: Google API Services User Data Policy
SubmitX offers an optional integration with Gmail through the Google API. If you choose to connect your Gmail account, we access the following data:
- Reading your emails (scope
gmail.readonly): to display your inbox in SubmitX and automatically link emails to your construction projects.
- Sending emails on your behalf (scope
gmail.send): to send quotes, follow-ups and messages to your clients directly from SubmitX.
What we do NOT do with your Gmail data:
- We do not share the content of your emails with third parties.
- We do not use your emails for advertising or targeting purposes.
- We do not sell your Gmail data.
- We do not analyze your personal emails that are unrelated to your construction projects.
- We do not use Gmail data to train generalized artificial intelligence models.
- No SubmitX employee reads your emails, except: (a) with your explicit consent, (b) for security reasons (investigation of a reported abuse), (c) when required by law, or (d) in aggregated and anonymized form for internal debugging.
"Limited Use" compliance: Google API Services User Data Policy:
SubmitX's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:
- We only use Gmail data to provide or improve user-facing features in SubmitX (sending quotes, classifying client replies, detecting follow-ups).
- We do not transfer Gmail data to third parties unless necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition with explicit consent.
- We do not use Gmail data to target advertising.
You can revoke SubmitX's access to your Gmail account at any time from myaccount.google.com/permissions or from your SubmitX settings (Settings → Integrations → Gmail → Disconnect).
4. Purposes of processing
Your data is used to:
- Provide, maintain and improve the SubmitX services
- Manage your account and your subscription
- Send you service-related communications (notifications, invoices, alerts)
- Send marketing communications if you have consented to them (max. 1 email per month)
- Meet our legal obligations (tax, accounting)
- Improve our AI algorithms (only on aggregated and anonymized data)
5. Legal basis for processing
- Performance of the contract: processing necessary to provide the services you subscribed to
- Consent: for marketing communications (can be withdrawn at any time)
- Legitimate interest: for security, fraud prevention and improving the services
- Legal obligation: for retaining accounting data
6. Data sharing
We never sell your personal information. We may share your data with:
- Technical subprocessors: Supabase (database and files, Canada, AWS ca-central-1, Montreal), Anthropic (Claude AI, United States, no use of data for training), Vercel (application hosting, United States), Stripe (payment, United States), Resend (email, United States), PostHog (analytics, European Union), Twilio (SMS, United States), OpenAI (backup voice transcription and search, United States, no use for training), Google (maps, addresses and mobile notifications, United States), Documenso (electronic signature, United States), Intuit QuickBooks (if connected). Full, up-to-date list: app.submitx.ca/legal/privacy
- Legal authorities: only if required by Canadian or Quebec law
All our subprocessors are bound by data processing agreements that meet the requirements of Law 25.
7. Hosting and international transfers
Your database and files are hosted in Canada (Supabase, AWS ca-central-1 region, Montreal). Some subprocessors (Anthropic, Vercel, Stripe, Resend) process data in the United States, in accordance with approved transfer mechanisms (Standard Contractual Clauses).
8. Retention period
- Active account data: kept for the entire duration of your subscription
- After termination: the account goes back to the Free plan and the data stays accessible; if the account is closed, you have 30 days to export the data, followed by permanent deletion (except tax documents kept for 7 years, a legal requirement)
- Accounting data: kept for 7 years (legal tax obligation)
- Security logs: kept for 90 days
9. Your rights (Law 25)
Under the Act to modernize legislative provisions as regards the protection of personal information (Law 25), you have the right to:
- Access: obtain a copy of your personal information
- Rectification: correct inaccurate data
- Deletion: request that your data be erased (subject to legal obligations)
- Portability: receive your data in a structured, readable format
- Objection: object to certain processing, including marketing
- Withdrawal of consent: withdraw your consent at any time
To exercise your rights, contact our person in charge of data protection at: support@submitx.ca. We respond within 30 days.
10. Security
SubmitX implements technical and organizational measures to protect your data:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Multi-factor authentication available for all accounts
- Data access limited to authorized staff (principle of least privilege)
- Regular security testing
- Confidentiality incident management policy (notification within 72 hours in the event of a breach)
11. Cookies
We use session cookies that are necessary for the service to work, and anonymized analytics cookies (PostHog) to improve the experience. You can refuse analytics cookies without any impact on the service.
12. Changes
Any significant change to this policy will be communicated to you by email 30 days before it takes effect.
13. Contact
Person in charge of the protection of personal information: