Privacy Policy
Effective date: October 17, 2026
Veillea ("Veillea", "we") is a sole proprietorship operated by Joshua Almaleh, Quebec Enterprise Number (NEQ) 2282674748, PO Box 311, Hudson, Quebec J0P 0A9. This policy explains what personal information we collect through the veillea.ca website and the Veillea application at app.veillea.ca (the "Service"), why, and what your rights are. It is written to meet Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Person responsible for the protection of personal information
Joshua Almaleh, owner, is responsible for the protection of personal information at Veillea. Contact: bonjour@veillea.ca · PO Box 311, Hudson, Quebec J0P 0A9.
2. Information we collect
Account information. When you create an account: your email address, a password (stored only as a salted scrypt hash, never in readable form), your name (optional), your organization name, your preferred language, and your plan choice. We also record when the account was created, whether your email address was confirmed, and the date of your last login.
Team members. If an account owner adds a team member, we store that person's email address, name (optional) and role (owner or member).
Monitoring profiles. The keywords, excluded words, category codes (UNSPSC/GSIN), regions and sources you choose, and which alerts you have unsubscribed from. This describes what your business is looking for, and is linked to your account.
Billing information. Payments are processed by Stripe. We do not receive or store your card number. Stripe collects your payment details and billing address. We store only your Stripe customer and subscription identifiers, your plan, billing interval, subscription status, period end date and any scheduled cancellation date.
Usage and technical information. Our server logs each request with the IP address, method, page requested and response code. It does not record your browser's user agent. For logins we store only the time of your last login. Session records expire after 30 days and expired sessions are deleted. Requests reach our server through Cloudflare, which sees IP addresses and requests as our processor, under its own privacy policy. We also record which alerts were sent to which profile, and account events (for example a trial start, cancellation or trial extension).
Communications. If you write to us, we keep your message and our reply.
We do not collect sensitive personal information, and the Service is not intended for individuals under 14.
3. Why we use it
- To create and secure your account, and to log you in (session cookie, password reset, email confirmation).
- To provide the Service: match public tender notices to your profiles and send you alerts by email at the frequency of your plan.
- To manage your plan, free trial, billing and cancellation.
- To send service messages (email confirmation, password reset, alerts, billing and account notices, and a message when a subscription ends).
- To monitor the Service, prevent abuse and fix problems. The owner receives internal notices about sign-ups and subscription changes.
- To meet our legal obligations (for example accounting records).
We do not sell or rent personal information, and we do not use it for advertising. We send only tender alerts and service and account emails. We do not send marketing emails or newsletters.
4. Cookies and similar technologies
Application (app.veillea.ca): - a session cookie, required to keep you logged in. It is HttpOnly and lasts up to 30 days, or until you log out; - a language cookie that remembers your language choice, kept for up to 1 year.
Marketing site (veillea.ca): your language choice is stored in your browser's local storage.
Neither site uses analytics, advertising, tracking or error-tracking services.
No third-party fonts are loaded: both sites serve their own fonts. The live tracker on veillea.ca also contacts app.veillea.ca to fetch public counts.
5. Privacy by default
The Service collects only what it needs to work. No optional tracking is enabled. Alerts can be turned off from any alert email (unsubscribe link) or from your account.
6. Processors and transfers outside Quebec
The application and its database run on a dedicated server operated by Veillea in Quebec, Canada. The server can be reached only through Cloudflare's tunnel. Your data is stored in Quebec.
We use the following processors. They process personal information on our behalf, only for the purposes below:
| Processor | What it processes | Location |
|---|---|---|
| Stripe | Payments, billing name and address, invoices. Card numbers never reach our server. | United States and other countries |
| Resend | Transactional and alert emails: recipient addresses and message content | United States |
| Cloudflare | DNS, the tunnel to our server and the proxy. It sees IP addresses and requests. | Worldwide network |
| GitHub (Microsoft) | Hosting of the marketing site veillea.ca (GitHub Pages) | United States |
No artificial intelligence service receives your data. Notice summaries are generated on our own server.
These processors may process information outside Quebec and Canada, mainly in the United States, where it may be accessible to authorities under local law.
Before such a transfer we assess the protection it will receive, as required by section 17 of the Quebec Act. Our processors are bound by contracts that protect it. We have accepted Stripe's, Resend's and Cloudflare's data processing agreements, and we carried out a transfer assessment as Quebec's Law 25 requires.
7. Retention
We keep your personal information while your account is active.
- Free accounts (never paid): kept until you delete the account. After 12 months without a login, we email a warning 30 days before deletion. The account and its personal information are deleted no earlier than 30 days after that warning.
- Paid accounts: cancelling a paid plan, or deleting your account from your account settings, closes the account. You keep access until the end of the period already paid. Your personal information (account, team members, profiles, alert history) is deleted 7 days after that access ends.
- Failed payment: if a payment is still unpaid after a grace period of about 7 days, the account is closed, and its personal information is deleted 7 days later.
- Free accounts deleted from the account settings are deleted within 7 days.
Exceptions: we keep a minimal record for accounting and tax obligations: the workspace number, the Stripe customer ID and the subscription dates, with no name, email address or tender data, and Stripe keeps invoices and payment records for tax and accounting purposes, as long as those laws require (generally 6 years).
Logs and backups. - Server logs, including IP addresses, are deleted after 30 days. - Expired sessions are deleted. - The database is copied every night onto the same server, and each copy is deleted after 14 days. We keep no off-site backups. - So deleted data is erased from the live database 7 days after access ends, and is gone from every backup within 14 more days.
8. Your rights
You may: - ask to access the personal information we hold about you; - have it corrected if it is inaccurate, incomplete or out of date; - withdraw your consent (for example by unsubscribing from alerts or deleting your account from your account settings); - ask that it be deleted or no longer disseminated, where the law allows; - ask for a copy of the information you gave us in a structured, commonly used technological format (portability).
To exercise a right, write to bonjour@veillea.ca. We may need to verify your identity. We will reply within 30 days. You may also file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
9. Security
Passwords are hashed (scrypt), connections use HTTPS, session cookies are HttpOnly, the server is reachable only through Cloudflare's tunnel, and only the owner has administrative access. No method is perfectly secure.
10. Confidentiality incidents
If a confidentiality incident occurs involving personal information we hold, we will take reasonable measures to reduce the risk of harm and keep a register of incidents. If there is a risk of serious injury, we will notify the Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada and the people concerned, as required by law.
11. Changes
We may update this policy. The effective date at the top will change, and for significant changes we will notify account holders by email before they take effect.
12. Contact
Joshua Almaleh, person responsible for the protection of personal information: bonjour@veillea.ca · PO Box 311, Hudson, Quebec J0P 0A9.