Privacy policy

1. Who we are

Triago is a service offered by Gestimatech inc., a construction consulting firm based in Quebec, Canada. We offer a smart email assistant for Quebec contractors and small businesses. Triago is a product of Gestimatech inc., which acts as the person in charge of the protection of personal information within the meaning of Quebec's Law 25.

Contact information of the person in charge: Jean-François Perreault — jf@gestimatech.com — Gestimatech inc., Quebec, Canada.

2. Data we collect

• User account: your email address (used to sign you in with a magic link).
• Access request: your email address and, if you provide them, your name, your company, your phone number and the description of your email management problem. The phone number is asked for in our advertising form and on our access request page; the description, in the advertising form only. They are optional — your access works without them. They serve one purpose only: calling you back to understand your need. They are never used for cold outreach, never sold, never shared with a third party — except with the providers that place the assistant's call, named just below — and they are destroyed after 24 months without news from you. You can ask for their deletion at any time (section 10). We also ask for your profile (business owner, self-employed, employee or individual): it tells us whether the assistant can offer you a call — it does not call individuals. It is kept with your request, for the same period. If you arrive through a link in one of our ads, the page address carries the name of the ad (its campaign and the trade it targets, fields utm_campaign and utm_content): we keep it with your request to learn which ad brings accounts. It is not a cookie, it says nothing about you, it is shared with no one, and our marketing team only receives totals.
• Call from the AI assistant: if you check the box that allows it, Triago's AI assistant (Gestimatech inc.) may call you at the number you entered, and at that number only, to talk to you about Triago. It introduces itself as an AI. Without that box, it never calls you. The same box also lets Triago text you at that number, about that call and your access only: to confirm that the number is yours, to confirm or cancel a callback, to tell you the assistant tried to reach you, and to send you your access. These texts never promote anything. Without that box, we only text you within the 6 months after your latest request, and only at a confirmed number — or, if you leave us a phone message, within the 6 months after that message, about the callback. Before any call, we confirm that the number is yours with a text message (a code to enter, or a link to tap), sent through Twilio (United States); Twilio creates and checks the code, and we never keep it. We keep the proof of your consent (the exact text of the box, the date, the number and when it was confirmed) for 24 months. The call is transcribed so that JF receives a summary of it; the transcript and the summary are used only to follow up on your request. To place the call, we rely on providers located outside Quebec: telephony (Twilio, United States), speech transcription (Deepgram, United States), the assistant's voice (ElevenLabs, United States; Microsoft Azure, in Canada, as a fallback), artificial intelligence (Anthropic, United States) and the gateway that relays our calls to the AI (Cloudflare). You can withdraw your consent at any time — by replying STOP to any of our texts, by telling the assistant during the call, by telling JF, or by writing to jf@gestimatech.com — and the assistant will never call or text that number again. So that this withdrawal holds, we keep your number alone (without your name) on our internal do-not-call list for 3 years, as the CRTC rules require.
• Style profile: text generated from the analysis of the emails you sent (stripped of the original content, it keeps only your communication patterns).
• Sorting metadata: technical identifiers of the emails processed, target folders, the corrections you make, as well as the subject and the sender of each email filed — this is what lets us show you the history of what was filed, and avoid processing the same email twice.
• What we keep of the content, and why: we do not keep the full body of the emails you receive. We do, however, keep:
  • the draft replies Triago writes for you. The draft itself is placed in your mailbox; the copy we keep is deleted after 30 days, automatically;
  • your conversations with Li-A, the assistant, so that she keeps track from one conversation to the next;
  • a short excerpt (under 300 characters) of the beginning of some emails, created when Triago analyzes a mailbox to understand how you file it. These excerpts are deleted automatically after 30 days, every day, without anyone stepping in.
• Invoices: an exception you trigger yourself — see just below.
• Invoices read: when you ask Triago to look for your invoices, the billing data is extracted and kept: number, date, supplier name, amounts, taxes and line item descriptions. The PDF file itself is never kept — it is read, then erased from memory. This reading only happens at your request. The invoice is analyzed by our service provider Anthropic (United States), which does not keep it and does not train on it — see section 4. This data is destroyed after 24 months, automatically.
• Microsoft Graph and Google Gmail OAuth tokens: access and refresh tokens, encrypted in the database, that let Triago work with your Outlook or Gmail mailbox on your behalf.
• Google user data accessed (Gmail API): headers (sender, recipients, subject, date), message body and labels. This data is read in real time to produce a classification, a reply or a follow-up — it is never stored on our servers beyond the processing time.

3. Hosting and location

All your stored data is hosted in Canada (Supabase, Montreal region / AWS ca-central-1). The application infrastructure (Cloudflare Workers) runs on a global network, with TLS termination at the Cloudflare nodes closest to the user. We comply with Quebec's Law 25 on the protection of personal information in the private sector.

4. Data shared with service providers

Triago shares strictly the minimum data needed with the following service providers, each bound by a confidentiality agreement and a Data Processing Agreement (DPA) that meets the requirements of Law 25 and the GDPR:

• Supabase (Montreal, Canada): database storage (account, style profile, metadata, encrypted OAuth tokens). Hosted in Canada Central.
• Cloudflare (global network): application hosting (Workers), CDN, TLS termination, protection against attacks. The application runs on Cloudflare's network: it processes data in transit and in memory only, without storing it (content logging and the AI gateway cache are turned off). Cloudflare has no access to the data stored in Supabase.
• Anthropic (Claude API, United States): artificial intelligence service provider. It temporarily receives the content of an email to produce a classification, a draft reply, or to read an invoice you ask us to analyze (in that case, the PDF file itself is sent to it). Anthropic does not train on data sent through the API and deletes it within 30 days, except where required by law or to investigate abuse, under its published commercial terms.
• Microsoft (Graph API): access to your Outlook mailbox through OAuth 2.0, only for the actions you authorized (reading, filing, drafts).
• Microsoft (Azure AI Speech, Canada East): transcription of what you dictate to Li-A, and reading her answers out loud — only when you use it, and capturing your voice also requires your prior consent. Processing takes place in Canada, nothing is kept, and no voiceprint is computed. Details in section 7.
• Google (Gmail API): access to your Gmail mailbox through OAuth 2.0, only for the actions you authorized (reading headers and body, filing with labels, draft replies).
• Resend (United States): sends the emails that give you access to Triago — the access link, its reminder and invitations. Resend receives only your email address and the content of that email. We separated these emails from our newsletters precisely so that an email you are waiting for carries no tracking pixel and no tracking links. Resend also sends the emails our team writes to companies that asked us for information, or whose address is published in the RBQ register: it receives their address and the content of that email. Each of these emails carries a link to stop receiving them. This transfer takes place outside Quebec.
• Brevo (Paris, EU): sends the magic sign-in link, our information emails and our summaries. Brevo receives only your email address and the content of the email sent.
• Memoras Finance (United States) — only if you ask for it: the accounting module of the Memoras suite. It receives nothing at all until you paste your own Memoras key into the Invoices screen: that step is what opens the transfer, and removing the key closes it. When you send an invoice, it receives the PDF attachment and what Triago read in it (supplier, number, date, amounts). If the invoice was written in the body of the email rather than attached, Triago builds a PDF document from it that contains the sender, the subject, the date and the text of the message — that document is what gets sent. You can send each invoice one by one, or ask for them to go out automatically: that setting is off by default, it turns off just as easily, and it never sends what Triago could not read. Your key is encrypted on our servers and is never shown to you again. This transfer takes place outside Quebec.

Triago does not sell, rent or transfer your personal information to third parties for commercial, advertising or profiling purposes. The service providers above process data only to provide the service requested.

Phone numbers and text messages. The phone number you give us on the Text messages page is used only to call you back and, if you agreed to it, to send you text messages from Gestimatech. Your mobile information — your number and your consent to text messages — is not sold, rented or shared with third parties for promotional or marketing purposes. Your number is hosted by our Canadian hosting provider (Supabase, Montreal) like the rest of your data, and it is not passed on to any other service provider, except to the messaging carrier strictly needed for the message you asked for. You can reply STOP at any time to unsubscribe, or HELP for help.

Communication outside Quebec. Some service providers process data outside Quebec — Anthropic (United States), Resend (United States) and Brevo (European Union). As required by Law 25, we carried out a privacy impact assessment for these communications: they are governed by a Data Processing Agreement, limited to the strict minimum needed and subject to protections deemed adequate (encryption in transit and at rest, deletion within 30 days at Anthropic, no AI model training on your data). Your stored data (account, profile, metadata) remains hosted in Canada.

5. Data protection measures

Triago applies technical and organizational security measures to protect your personal information, including sensitive data (OAuth tokens, content of emails processed):

• Encryption in transit: all exchanges between your browser, Triago and our service providers use TLS 1.2 or higher (HTTPS everywhere, HSTS enabled).
• Encryption at rest: the Supabase database encrypts data at rest (AES-256). Microsoft and Google OAuth tokens are encrypted at the application level before being written to the database.
• Access control: Supabase Row Level Security (RLS) isolates data by user — a user technically cannot access another user's data. Internal administrator access is protected by multi-factor authentication (MFA) and limited to one person. Every time an administration screen is opened, it is logged — who, which screen, when; never what was viewed.
• Data minimization: we do not keep the full body of the emails you receive. What is kept is detailed in section 2 and is limited to what makes the service work: sorting metadata (identifiers, subject, sender, target folder, your corrections), the drafts Triago writes for you, and your conversations with Li-A. If you ask Triago to read your invoices, the extracted billing data is kept for 24 months — never the PDF file.
• Logging: sign-ins to your account and the actions Triago takes on your emails (filing, labeling, follow-up) are logged, so you can trace what happened and when.
• Immediate revocation: you can revoke Microsoft or Google access at any time from your Triago account or directly from your Microsoft / Google security settings. Triago then immediately stops all processing.
• Incident management: as required by Law 25, any confidentiality incident that presents a risk of serious injury is reported to the Commission d'accès à l'information du Québec and to the people concerned as soon as possible.

6. What Li-A remembers about you

Li-A, the assistant who helps you set up Triago, remembers what you tell her about yourself from one conversation to the next. That is what keeps her from asking you the same thing every time, and from offering you again what you already turned down.

• What she remembers: your trade and your work context, your preferences, the decisions you made about your settings, what you turned down, and what has already been explained to you. Only what you told her — never the content of your emails.
• What she never remembers: nothing about your clients, suppliers or correspondents. No email address, no phone number. These people are not our users and have no way to opt out: so they must not be in there.
• Where it is kept: in your account, in Canada, like the rest of your data. It is never shared with another Triago account. The number of memories is capped.
• How long: as long as your account exists. Deleting your account erases this memory with it.
• How to have a memory corrected or removed: just tell Li-A — “forget that”, or “that's not right”. She removes it immediately, without asking you why, and will not learn it again. You can also write to jf@gestimatech.com.
• Who else can see it: Gestimatech, to check that Li-A does not remember anything inaccurate or useless, and to remove what should not be there.

7. When you talk to Li-A

You can dictate your requests to Li-A instead of typing them, and have her read her answers out loud. This feature only turns on after your explicit consent, asked for the first time you use it.

• What is sent, and where: the recording of what you just said is sent to Microsoft Azure AI Speech, on servers located in Canada (Canada East region), only long enough to turn it into text. Your voice does not leave the country.
• What is kept: nothing. Neither the audio, nor a print of your voice, nor the transcript — Triago records neither. The recognized text appears in your input field; it only becomes a message if you send it yourself. We keep only a daily count — the number of seconds dictated and the number of characters read out loud — which is used to cap costs, contains no content, and is destroyed after 90 days.
• No recognition of the person: Triago never tries to identify who is speaking from their voice, and computes no voiceprint. There is therefore no biometric processing.
• Reading out loud: it captures nothing. The text read is the one Li-A just wrote on screen, and it is sent to the same Canadian service to be turned into sound.
• How to withdraw your consent: at any time, in Mailboxes → Talk to Li-A, by clicking “Withdraw my consent”. Dictation turns off right away: the microphone stops working and will ask for your consent again before any new use. You can also write to jf@gestimatech.com. We keep only the date on which you gave and then withdrew your consent — Law 25 requires us to be able to prove it.

8. Use of Google data (Limited Use Policy)

Triago's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, when you connect your Gmail account to Triago:

• Triago uses Gmail data only to provide the features visible to the user (automatic sorting, draft replies, follow-ups).
• Triago does not sell Gmail data to third parties, does not use it for advertising, does not use it for cross-app profiling, and does not transfer it to third parties unless the user requires it or the law requires it.
• Triago does not train any AI model on Gmail data. The content sent to Anthropic (Claude API) to produce a classification or a draft does not train its models, and Anthropic deletes it within 30 days.
• No human (employee, contractor or third party) reads users' Gmail data, except: (1) with your explicit consent, (2) for security reasons (e.g. investigating abuse), (3) to comply with a legal obligation, or (4) if the data is anonymized and aggregated for internal operations.

9. Your emails — Microsoft and Google

Your emails stay in your Outlook or Gmail mailbox. Triago reads them to produce a classification, a draft or a follow-up, and does not keep their full body on our servers. What is kept — subject, sender, drafts written for you — is detailed in section 2. The artificial intelligence used (powered by Anthropic's Claude API as a service provider, in the United States) does not train on your data, and Anthropic deletes it within 30 days.

10. Your rights (Law 25)

At any time, you can:

• Access your personal data
• Ask for it to be corrected (correction of inaccurate, incomplete or ambiguous information)
• Withdraw your consent to the processing of your data at any time
• Ask for its complete deletion
• Get a portable copy of your data (right to data portability)
• Revoke Microsoft or Google access at any time (from Triago or directly in your Microsoft / Google account settings)
• File a complaint with the Commission d'accès à l'information du Québec

To exercise these rights, contact us at jf@gestimatech.com. We answer within 30 days at most.

11. Data retention

Your information is kept as long as your Triago account is active. When you ask for your account to be deleted, all your data (profile, OAuth tokens, sorting metadata, follow-ups) is deleted within 30 days at most, except where the law requires us to keep it (for example, security logs kept for up to 12 months).

Access requests that went nowhere: if you left us a phone number and a description of your problem without ever activating an account, these two pieces of information are automatically destroyed 24 months after our last exchange. This destruction is carried out by the database itself, every month — not on request, not by hand.

12. Cookies

Triago uses cookies that are strictly necessary for sign-in and the session to work — those are always on. With your consent (banner on your first visit, which you can change at any time through “Manage my cookies” at the bottom of the page), we also use:

• Audience analytics (optional, with consent): Google Analytics and Microsoft Clarity, to understand how the site is used. Loaded only after your explicit consent. You can refuse — it changes nothing about your access.
• Advertising (optional, with consent): conversion measurement for our Meta ads (Facebook/Instagram) through the Conversions API. If you consent and submit an access request, your email is sent to Meta in hashed (one-way encrypted) form — never in plain text — to attribute the request. Meta is located in the United States; this communication is limited to what is strictly necessary. With that same consent, we also measure our Google Ads: Google's tag reads the click number of the ad that brought you here, and tells us only once that an account was created. No email or name is sent to Google by this tag (the page address is sent to it without your information), and it is not used to show you targeted ads. It sets the _gcl_au and _gcl_aw cookies (click number, 90 days) and, when the account is created, Google's measurement cookies (doubleclick.net domain). Google is located in the United States. If you arrive through a Google ad, we also keep that click number on our side (triago_gclid cookie, then on your account), for up to 90 days: at your first payment, that number, the amount and the date are sent to our marketing team (Gestimatech) to measure the ad at Google — never your email or your name.

To remember your choice and be able to prove it, we set a strictly necessary cookie (triago_consent_id, kept 2 years) and we log each choice — the date, the categories accepted or refused and the version of the text shown. This proof of consent is kept 3 years, then deleted.

When we send you back to the access request form (expired link, address with no account), your email travels in a strictly necessary cookie (triago_courriel_prerempli, kept 60 seconds) rather than in the page address — it is only used to fill in the field for you.

13. Changes

This policy may change. We will let you know by email of any material change before it takes effect.