Privacy policy

Who we are

Camarade is a management platform for unions, operated by JobeLabs inc., Boischatel, Quebec G0A 1H0, Canada. This policy covers the camarade.ca website, the application (app.camarade.ca and each union's own address, such as example.camarade.ca) and the public sites that unions publish with Camarade.

Person responsible for the protection of personal information

Under Quebec's Act respecting the protection of personal information in the private sector (Law 25), the person responsible is Jonathan Beaupré, president of JobeLabs inc. For any question, request for access, correction or deletion, or complaint: [email protected]. We answer within 30 days.

Who is responsible for what

For information you give us directly (a demo request, creating your account), JobeLabs inc. is responsible.

For information a union puts in its Office (its member directory, its treasury, its files), the union is the organization responsible under Law 25. JobeLabs inc. then acts as its service provider: it processes that information only to provide the service and on the union's instructions. Requests about that information go to the union first; we help it answer.

What we collect

We collect only what the service needs:

• Your account: name, email address, password (stored hashed, never readable), and your two-factor authentication factor if you turn it on.
• Your role in a union (administrator, treasury, executive, steward, member) and your notification and language preferences.
• The access log: who viewed or changed what, and when, in their union's Office.
• What the union puts in its Office: accounting entries, expense claims and receipts, union leave, member directory, documents.
• Messages sent through the “Contact us” form of a union's site: name, email, optional phone, subject and message.
• For billing: the union's name, the email of the person who pays and the payment history. Card numbers are entered at Stripe; Camarade never sees or keeps them.

Signing in with Google

You can sign in with your Google account. We only ask for the basic permissions (openid, email and profile). Google then sends us your name, your email address, your profile picture and your Google account identifier.

This information is used only to create your account, recognize you when you sign in and secure your access. We have no access to your mailbox, contacts, files or calendar.

Camarade's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is never sold, never used for advertising, never transferred to third parties except the service providers named below that are needed to run the service, and never used to train artificial intelligence models.

How the information is used

To provide the service: open your account, give you access to your union's Office according to your role, send the notifications you chose, bill the union's subscription, answer your requests and keep the platform secure (access log, abuse prevention).

We sell no information, run no targeted advertising and make no automated decisions about you.

Our service providers and where the data goes

We rely on a few providers, bound by contract, who process information only to serve us:

• Supabase (database, accounts, files and backups): hosted in the Montréal region, Quebec (Amazon Web Services data centre, ca-central-1).
• Cloudflare (delivery of the site and application, attack protection): global network. Cloudflare carries the pages; unions' data is not stored at Cloudflare.
• Resend (automatic emails: notifications and sign-in): United States. Emails say there is something new and point to the Office; they contain no sensitive information.
• Zoho Mail (our mailboxes, including [email protected]): data centre in Canada. This is where your messages arrive when you write to us.
• Stripe (subscription payments, in preparation): Canada and United States.
• Google (optional sign-in with a Google account): United States.
• Anthropic (assisted document reading, only if the union turns it on): United States. The text of a member list is sent there to be transcribed, without social insurance numbers, and is not used for training. This disclosure outside Quebec was the subject of a privacy impact assessment.
• Anthropic (C Bot, camarade.ca's assistant): United States. The question you type and the earlier messages of the same conversation are sent there to produce the answer; they are not used for training.

Security

Encrypted connections everywhere, mandatory two-factor authentication for sensitive roles (treasury, executive, administration), separation between unions checked by automated tests, an access log the union can review, daily backups. The Camarade team has no access to an Office's content without the union's written consent, for a limited time and recorded in its log.

In case of a confidentiality incident, we notify the union concerned without delay, and the Commission d'accès à l'information and the people affected when the law requires it.

Retention

Your account is kept as long as you use it. A union's data is kept during its subscription; at the end, the union can export it, then it is deleted within 90 days, except what the law requires us to keep (for example billing records, 6 years). Backups erase themselves as they rotate.

A demo request is kept at most 2 years without follow-up, then deleted.

Questions asked to C Bot and its answers are kept 12 months, without IP address or cookie, to improve the assistant and the documentation; email addresses and phone numbers typed by mistake are masked before saving. Please don't type personal information there.

Your rights

You can ask to access, correct or delete your information, or withdraw your consent, by writing to [email protected]. To delete your account, write to us from the address linked to the account: deletion is done within 30 days. Information a union keeps about you (for example in its directory) belongs to that union; we pass your request on.

If our answer does not satisfy you, you can contact Quebec's Commission d'accès à l'information.

Cookies and analytics

The camarade.ca website sets no cookies and uses no third-party analytics. We count visits ourselves, per day and per page, without IP addresses or identifiers.

The application keeps your sign-in session in your browser's storage: this is strictly necessary to stay signed in. Unions' public sites count visits the same way as camarade.ca, without cookies.

Changes

If this policy changes significantly, we announce it in the application before it takes effect. The update date appears at the top of the page.