1. Who we are
SignalOrange Inc. ("SignalOrange", "we", "our") is a Canadian company incorporated in Quebec. This policy describes how we collect, use, disclose and protect your personal information in connection with our websites (signalorange.ca, subdomains) and our software products (Meridian, Router and Estrade).
This policy is written under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) .
2. Person in charge of the protection of personal information
As required by Law 25, we have designated a person in charge of the protection of personal information. For any question or request about this policy or your personal information, you can reach that person at: privacy@signalorange.ca.
3. Information we collect
3.1 Information you give us
- Account: name, email address, password (hashed), organization, role.
- Billing: billing address, business number, payment information (handled by our processor Stripe — we never store card numbers).
- Content: data you enter or upload in our products (contacts, proposals, invoices, attachments, etc.).
- Communications: emails and messages exchanged with our team.
3.2 Information collected automatically
- Technical logs: IP address, user agent, timestamp, pages visited, application errors.
- Cookies: one essential session cookie to keep you signed in. No advertising cookies.
4. Purposes of collection
We use your personal information only for the following purposes:
- To provide and maintain our services, including authentication and support.
- To process payments and issue invoices.
- To communicate with you about your account, product updates and security incidents.
- To prevent fraud, abuse and unauthorized access.
- To meet our legal and regulatory obligations.
- To improve our products, based on aggregated and anonymized data.
5. Consent
We obtain your consent in a clear and specific way before we collect, use or disclose your personal information, except where the law allows us to do otherwise. You can withdraw your consent at any time by writing to privacy@signalorange.ca. Withdrawing consent may, however, prevent the use of some services.
6. Disclosure to third parties
We never sell your personal information. We disclose it only to the service providers that help us operate our services, under strict confidentiality agreements:
- Hosting: OVH Canada (Beauharnois, Quebec) and in-house servers in Canada.
- Payments: Stripe (PCI DSS Level 1 certified).
- Transactional email: dedicated SMTP servers or an approved service (e.g. Amazon SES, ca-central-1 region).
- AI providers (through Router): Anthropic, OpenAI, Google, Cohere, Mistral — with Guard turned on to filter sensitive data before it is sent. See section 9.
We may also disclose your information if the law requires it (e.g. a court order), to protect our rights, or in a business transaction (merger, acquisition) — with notice and equivalent safeguards at the acquirer.
7. Transfers outside Quebec and Canada
Some of our subprocessors (in particular the AI providers listed in section 6) may process data outside Canada, mainly in the United States and the European Union. As required by Law 25, we carry out a privacy impact assessment before any transfer outside Quebec, and we put contractual and technical measures in place (encryption in transit, protection clauses, the Guard anti-exfiltration filter) to ensure equivalent protection. The full list of our subprocessors and the jurisdictions involved is in our Data processing agreement (DPA).
8. Retention
- Active account: as long as your account is active.
- Closed account: 30 days to allow restoration, then complete deletion.
- Invoices and accounting records: 7 years (Canadian tax requirement).
- Technical logs: 90 days for diagnostics and security, then anonymized.
- Backup data: up to 90 additional days in backup systems.
9. Artificial intelligence and Router Guard
When our products use AI (summaries, suggestions, agents), requests go through our Router API, which applies Guard — an automatic filter that removes personally identifiable information (names, addresses, numbers, secrets, tokens) before anything is sent to third-party models.
We have also negotiated zero-retention agreements with Anthropic and OpenAI: data sent to these models through Router is neither kept nor used to train their models. Router usage logs stay hosted in Montreal.
10. Your rights
Under PIPEDA and Law 25, you have the following rights:
- Access: get a copy of the personal information we hold about you.
- Correction: correct any inaccurate or incomplete information.
- Deletion: ask for your information to be erased, subject to our legal retention obligations.
- Portability: receive your information in a structured, commonly used technological format.
- Withdrawal of consent: withdraw your consent at any time (see section 5).
- De-indexing: ask that some information no longer be accessible through search engines.
- Complaint: file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
To exercise any of these rights, write to privacy@signalorange.ca. We will answer within 30 days.
11. Security
We protect your information with appropriate technical and organizational measures: TLS 1.3 encryption in transit, AES-256-GCM encryption at rest for sensitive data, role-based access control, strong authentication for staff, complete access logging, encrypted backups, periodic code review and penetration testing. See our Security page for the details.
12. Privacy breaches
If a confidentiality incident presents a risk of serious injury, we will notify you without delay and contact the Commission d'accès à l'information du Québec, as required by Law 25 and PIPEDA.
13. Cookies
We use only cookies that are strictly necessary for our services to work (a session cookie for authentication). The signalorange.ca website does not use any web analytics tool. No advertising or third-party cookies.
14. Children
Our services are intended for businesses and are not directed at people under 14. If you believe a child has given us personal information without the consent of a parent or guardian, write to us and we will delete that information.
15. Changes to this policy
We may change this policy. If there is a significant change, we will notify you by email at least 30 days before it takes effect. The date of the last update is shown at the top of the page.
16. Contact us
For any question about this policy or your personal information:
- Email: privacy@signalorange.ca
- Mailing address: SignalOrange Inc., Quebec, Canada (full address available on request)