Back

Privacy Policy

Last updated: 2026-07-26

1. Data Collected

We collect: account information (name, email, hashed password), project data (tasks, documents, comments), usage data (pages visited, actions performed), and technical data (IP address, browser). Passwords are hashed with bcrypt and never stored in plain text.

2. Use of Data

Your data is used to: provide the service, improve the platform, generate AI suggestions (only within your space), and communicate with you (notifications, invoices). We NEVER sell your data to third parties. Data sent to the AI API is processed in transit and not retained by the provider.

3. Storage and Security

Data is stored in isolated databases per enterprise (multi-tenant architecture). Encryption in transit (TLS). Regular backups with configurable retention. Access restricted by roles (RBAC). Compliant with Quebec Law 25 and GDPR.

4. Your Rights (Law 25 / GDPR)

You have the right to access, rectify, delete and export your data (portability), withdraw consent, and file a complaint with the CAI (Quebec) or CNIL (France). To exercise these rights, contact privacy@zenoba.ai.

5. Artificial Intelligence

Zenoba AI processes your documents and project data to generate plans and recommendations. This processing occurs within your isolated space. Data is not used to train external models. You retain ownership of all content generated from your data.

6. Privacy officer

The person responsible for the protection of personal information is Zenoba Inc. For any question or request regarding your data: privacy@zenoba.ai.

7. Subcontractors

We use the following subcontractors: Anthropic Inc. (San Francisco, USA) for AI processing, OVH (Montreal, Canada) for hosting and embeddings. Data transferred outside Quebec is subject to a Privacy Impact Assessment (PIA) in accordance with Law 25.

8. Retention period

Account data is retained as long as the account is active. After account deletion, data is erased within 30 days. Backups are purged within 90 days. Audit logs are retained for 1 year.

9. Transfer outside Quebec (PIA)

Some data may be processed in the United States (Anthropic AI API). A PIA has been conducted in accordance with section 17 of Law 25. Protection measures include: encryption in transit, subcontracting agreements, data minimization.

In compliance with Quebec Law 25 on the protection of personal information.

Privacy and data