Privacy policy

Forge Tech Accounting ("Forge Tech", "we", "our") takes the protection of your personal information seriously. This policy explains what information we collect, how we use it, who we share it with, and your rights — in compliance with Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information), federal PIPEDA, and international best practices.

1. Organization and contact

Forge Tech is a software publisher based in Quebec, Canada. Our Privacy Officer, in accordance with Section 3.1 of Law 25, is:

Guillaume Regimbald — Founder · President
Email: [email protected]
Phone: 1.418.935.1300

2. Information we collect

2.1 Information you provide directly

• Identification: full name, work email, phone number, company name, billing address
• Payment: we never store credit card numbers. Processing is delegated to Helcim Inc. (Canada, PCI-DSS Level 1)
• Your bookkeeping content: invoices, transactions, employees, customers, vendors, uploaded files — stored in your dedicated and encrypted database
• Communications: emails sent via the contact form, technical support requests

2.2 Information collected automatically

• Technical data: IP address, browser type, operating system, pages visited, visit duration (server logs)
• Cookies: strictly necessary functional cookies (session, language preference). No advertising or third-party tracking cookies.

2.3 Information from third parties

• Helcim Inc. (payment and subscription status)
• Cloudflare (anonymized performance analytics)

3. Why we collect this information

In accordance with Section 8 of Law 25, we collect information only for specific purposes:

• Provide the accounting software service you purchased or signed up to trial
• Process payments and billing
• Send you transactional communications (receipts, payment alerts, critical updates)
• Improve security and detect abuse
• Comply with legal obligations (Revenu Québec, Canada Revenue Agency, valid judicial requests)

We never use your bookkeeping, customer data, or financial data to:

• Train artificial intelligence models
• Sell, rent, or trade to commercial third parties
• Automated profiling for advertising purposes

4. Data hosting and location

Your data is hosted in Quebec, Canada. Our PostgreSQL servers are operated by Forge Tech on Quebec infrastructure, with a separate encrypted database per client. No US or European provider hosts your accounting data.

Some ancillary services do receive information. We list every one of them, including those located outside Quebec:

• Cloudflare Inc. (United States) — content delivery network and denial-of-service protection; receives connection metadata in transit (IP address, headers) and never stores your bookkeeping content
• Helcim Inc. (Calgary, Canada) — payment processing; retains card data per PCI-DSS
• MailChannels (Canada) — transactional email delivery
• Anthropic PBC (United States) — language model behind our artificial intelligence features. See section 4.1

4.1 Artificial intelligence features — what leaves Quebec

Our artificial intelligence features rely on two engines: Ollama, which runs locally and transmits nothing, and Claude by Anthropic PBC (United States), used for the most demanding work. Here is exactly which features call the latter.

Two technical limits we impose on ourselves. First, the Forgeron AI assistant has no access to your accounting database: its only tools are the current time, conversation memory and web search. It cannot look up your invoices, employees or customers on its own initiative. Second, your data is never used to train an artificial intelligence model — neither ours nor a third party's.

We have completed a privacy impact assessment for these transfers, as required by section 17 of Quebec's Law 25. It is available on request at [email protected].

Prefer that nothing leaves Quebec? Write to us: we disable both automatic features for your account, and the assistance features fall back to the local engine. This is the configuration we apply by default to professionals bound by privilege and to organizations holding health information.

5. Retention period

• Accounting data: retained while your subscription is active. Seven (7) years after termination (Revenu Québec obligation), then secure deletion.
• Payment data: retained by Helcim per their policies (7 years for tax compliance)
• Server logs: 90 days maximum
• Support emails: 2 years after case resolution

6. Your rights (Law 25 and PIPEDA)

You have the right to:

• Access your personal information we hold
• Rectify any inaccurate, incomplete, or outdated information
• Request deletion of your account and data (subject to legal obligations)
• Request portability of your data in a structured format (CSV/Excel exports built into the software)
• Withdraw consent at any time
• File a complaint with the Quebec Information Access Commission (CAI) or the Office of the Privacy Commissioner of Canada

To exercise a right, email us at [email protected]. We respond within 30 days (Law 25 legal deadline).

7. Security

• TLS 1.3 encryption for all communications
• At-rest encryption (PostgreSQL) for tenant databases
• DPAPI for sensitive fields (SIN, RAMQ, medical conditions — non-profit modules)
• BCrypt for passwords
• Two-factor authentication (TOTP) available
• Daily encrypted backups
• 24/7 incident monitoring

8. Privacy incidents

In accordance with Section 3.5 of Law 25, if a privacy incident presents a serious risk of harm to data subjects, we will:

• Notify the Quebec Information Access Commission as soon as possible
• Notify the affected individuals by email
• Maintain an incident register (available on CAI request)

9. Cookies

We use only strictly necessary cookies for the site to function:

• locale: your language preference (FR/EN)
• session: your authenticated login session

No advertising cookies, no Facebook pixel, no Google Analytics currently active. If we add any in the future, an explicit consent banner will be displayed.

10. Changes to this policy

This policy may be updated. Material changes will be communicated to you by email at least 30 days before they take effect. The last updated date appears at the top of this page.

11. Contact us

Privacy Officer:
Guillaume Regimbald
Forge Tech Accounting
Quebec, Canada
[email protected] · 1.418.935.1300