SMBSoft
Privacy Policy
This policy describes how SMBSoft collects, uses, retains and protects personal information, in accordance with Québec's Act respecting the protection of personal information in the private sector, as modernized by Law 25.
1. Person in charge of personal information
SMBSoft's person in charge of the protection of personal information can be reached at maxime.creationbox@gmail.com. All access, rectification or deletion requests and incident reports go through that address.
2. Information we collect
- User account: name, email address, password (hashed — never readable), role in the company.
- Business data you store: accounting, invoices, contacts, suppliers, projects, documents (e.g. scanned receipts), imported bank transactions.
- Employee data (payroll module): name, social insurance number, salary, deductions, bank details for direct deposit. This data is entered by the employer, who remains responsible for it; SMBSoft acts as a service provider.
- Minimal technical data: access and audit logs (IP address, timestamps, actions), required for security.
We use no advertising trackers or third-party cookies. The only cookies used are for authentication.
3. Why we use it
- Providing the service: accounting, tax and payroll calculations, reports and slips.
- Security: authentication, prevention of unauthorized access, audit log.
- Subscription billing and service-related communications.
We never sell or rent personal information. No automated decision with legal effects is made based on your information.
4. Where your data is hosted
Data is hosted in Québec (OVH data centre, Beauharnois). It is not transferred outside Canada for primary storage, except as described in section 5.
5. Service providers
- Stripe (card payments and subscriptions): receives the payment information required; SMBSoft never stores card numbers. Stripe may process data in the United States.
- Anthropic (automatic receipt reading): when you use receipt scanning, the document image is sent to Anthropic's API to extract amounts; it is not used to train models.
- Your financial institution: the direct-deposit files you generate are uploaded by you to your bank.
Each provider is bound by confidentiality commitments and only receives what its function requires.
6. How we protect it
- Encryption in transit (TLS) on all connections.
- Social insurance numbers encrypted at rest (AES-256-GCM) in the database.
- Hashed passwords (bcrypt), secure session tokens (httpOnly cookies), payroll access restricted to management roles.
- Strict per-company data isolation (multi-tenant), immutable audit log, daily backups.
7. How long we keep it
Active account data is retained while the account exists. After an account is closed, data is deleted from active systems within 90 days, subject to retention periods required by tax laws (accounting records). Backups are overwritten on their rotation cycle.
8. Your rights
- Access: obtain the personal information we hold about you.
- Rectification: have inaccurate information corrected (most of it can be edited directly in the application).
- Deletion: request deletion of your information, subject to legal obligations.
- Portability: receive your data in a structured, commonly used format.
Send any request to the person in charge (section 1); we answer within 30 days. You may also file a complaint with the Commission d'accès à l'information du Québec.
9. Privacy incidents
Any incident presenting a risk of serious injury is logged, reported to the Commission d'accès à l'information and notified to the persons concerned, as required by Law 25.
10. Changes
Any material change to this policy is announced in the application or by email before it takes effect.