Privacy Policy

Last updated: October 18, 2026

La Fondrie CRM is an online customer relationship management (CRM) software offered to businesses, such as photo and video studios or agencies (the “workspaces”). La Fondrie CRM is operated by Thierry Destin et Steeve Razafindretsa (“we”).

This policy explains what personal information we handle, why, with whom, for how long, and how to exercise your rights. It follows Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Two different roles

• For workspace accounts (owners, employees and contractors who sign in), we are responsible for the information.
• For the clients of a workspace (for example a studio’s couples or an agency’s clients), the business using La Fondrie CRM is responsible for their information. We only process it on that business’s behalf, following its instructions, to provide the service. Each workspace publishes its own policy, available on its clients’ page. To exercise your rights over that information, contact that business first; we will help it answer you.

2. Information we handle

• Account: name, email address, role in the workspace, sign-in history (date, IP address, browser) and active sessions.
• Content added by the workspace: contacts, inquiries, projects, quotes, contracts and electronic signatures (name, date, time, IP address), invoices and payments, messages, questionnaires, tasks, files and galleries.
• Payments: when a workspace accepts card payments, the card is entered on Stripe’s secure page. We never see or keep the card number.
• Technical data: server logs needed for security and troubleshooting.

We collect this information directly from you, from the workspace that invited you, or through the services the workspace chooses to connect (section 5).

3. Why we use it

Only to:

• provide the service: show, save, send and back up what the workspace manages;
• sign you in securely and protect the service against abuse;
• write to you about your account (sign-in links, important notices);
• meet our legal obligations.

We do not sell any personal information. We do no targeted advertising and use no advertising trackers.

4. AI assistants

A workspace can turn on AI assistants that help it write and organize its work. When it uses them, the information needed for the request is sent to Anthropic, which provides the AI model. Under its commercial terms, Anthropic does not use this data to train its models. The assistants make no automated decisions about you: every change they propose must be confirmed by a person.

5. Who we share it with

We use the following providers, bound by confidentiality and security obligations, and only as far as needed:

Some information may therefore be communicated outside Quebec and Canada. Before doing so, we assess the privacy risks and make sure the information is adequately protected there.

We may also disclose information when the law requires it, for example under a court order.

6. Data from Google

When a workspace connects Gmail or Google Calendar:

• Gmail: we only ask for permission to send emails on the workspace’s behalf. We do not read its inbox through this connection.
• Google Calendar: we read events (read only) to show them in the workspace’s calendar. We do not change them.

La Fondrie CRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is used only for features the user can see, is never sold, never used for advertising and never used to train AI models. No person reads it, except with your consent, for security, or when the law requires it. A workspace can also, without Google’s APIs, link its Gmail inbox with an app password: La Fondrie CRM can then read new emails in that inbox to spot its clients’ inquiries and replies. The workspace can remove access at any time in La Fondrie CRM (Settings › Integrations) or in its Google account.

7. Cookies

We only use the cookies needed for the service to work: the sign-in session, the proof of your email address, and the protection of the Google sign-in. The browser also keeps a few display preferences (theme, open workspace). No advertising or audience-measurement cookies.

8. How long we keep it

• Workspace information is kept while the workspace is active. Each workspace can set automatic deletion delays (for example for inquiries that never booked).
• When a workspace is deleted, its data is set aside for 30 days (to correct a mistake), then erased, except what the law requires us to keep. Encrypted backup copies disappear as they rotate.
• Technical logs are kept as long as security requires.

9. Security

Encrypted connection (HTTPS), passwords and keys of connected services encrypted, separated access between workspaces, roles that limit what each member sees, encrypted off-site copies, and a log of sensitive actions. If a confidentiality incident presents a risk of serious injury, we notify the Commission d’accès à l’information and the people concerned, as the law requires.

10. Your rights

You may ask to access your information, correct it, delete it, receive it in a structured, commonly used technological format, or withdraw your consent. We answer within 30 days. If you are not satisfied with our answer, you can contact Quebec’s Commission d’accès à l’information or the Office of the Privacy Commissioner of Canada.

11. Person in charge of the protection of personal information

Thierry Destin et Steeve Razafindretsa, copropriétaires

12. Changes

We will post any change on this page with its date. If a change is significant, we will notify workspaces by email.