01 — Scope and roles
One policy for the website, platform, and apps.
This policy applies to fondationflow.com, app.fondationflow.com, Fondation Flow applications, and related services. “Fondation Flow,” “we,” and “our” refer to the operator of those services.
We are responsible when we determine the purposes of processing, including demo requests, account administration, security, support, and service improvement. For most lead, customer, employee, and job records, we process information for the customer company under its instructions and settings.
Are you a contractor’s customer or employee? The company that created your record is normally your first point of contact. We assist it with requests concerning information hosted in Fondation Flow.
02 — Information processed
We limit collection to what supports the requested work.
| Category | Examples | Main purposes |
|---|---|---|
| Account and company | Name, email, phone, role, company, language, settings, and authentication information. | Create accounts, verify access, manage roles, provide support, and secure the service. |
| Leads and customers | Contact details, address, source, project, budget, availability, notes, messages, appointments, and history. | Centralize requests, prequalify, follow conversations, prepare estimates, and schedule work. |
| Employees and crews | Contact details, role, skills, availability, assignments, notes, photos, hours, breaks, and approvals. | Plan crews, document work, prepare timesheets, and produce hour reports. |
| Point-in-time location | Location, accuracy, jobsite distance, and zone result when an employee clocks in or out. | Associate time with the correct job and support timesheet review. |
| Jobs and operating finances | Address, schedule, budget, cost categories, expenses, receipts, labour rates, profitability, and updates. | Run projects, track costs, prepare reports, and show operational profitability. |
| Estimates and signatures | Scope, price, options, taxes, terms, signer, consent, date, and contextual evidence. | Create, send, track, accept, and retain evidence of electronic proposals. |
| Communications | SMS, email, notifications, delivery status, preferences, and unsubscribe requests. | Respond, confirm appointments, send authorized reminders, and preserve relationship context. |
| Use and security | Technical identifiers, access logs, device, browser, errors, and administrative events. | Prevent unauthorized access, diagnose problems, audit actions, and protect accounts. |
We do not require health insurance numbers, social insurance numbers, or banking credentials for the functions described above. Fondation Flow can track payment status and work hours but is not a payroll remittance or card-processing service.
03 — Sources and purposes
Information comes from you, your company, or an authorized connection.
We receive information during registration, demo booking, signing, customer or employee use, and support. A customer company may create records for its people and customers. Leads may also arrive through services the customer connects, including advertising or communication services.
- Provide, configure, maintain, and support the services selected by the customer company.
- Authenticate users, enforce permissions, and keep each company’s information appropriately separated.
- Connect leads, estimates, appointments, jobs, crews, costs, and profit to the correct file.
- Produce AI-assisted drafts, summaries, or recommendations when a user activates the feature.
- Transmit operational and, where permitted, commercial communications.
- Prevent abuse, investigate errors, document sensitive actions, and respond to incidents.
04 — Location, AI, and communications
Sensitive functions require context and control.
GPS information is requested at the time of a jobsite clock-in or clock-out where the company has enabled location validation; the feature is not designed for continuous tracking. AI can organize information, draft text, or help qualify a lead, but users remain responsible for reviewing important outputs and decisions.
Customer companies are responsible for the legal basis, notices, consent, recipients, timing, and unsubscribe handling for communications they configure or send. See the specific location and AI communications notices for more detail.
05 — Disclosures and transfers
Access follows the service and a legitimate need.
Information may be disclosed to authorized users of the customer company, service providers supporting functions requested by the customer, professional advisers under confidentiality, a successor in a permitted transaction, or authorities where required by law.
Some processing may occur outside Quebec or Canada. Before a transfer, we assess relevant privacy factors and use contractual or organizational protections appropriate to the risk. Information may then be subject to lawful access in the other jurisdiction.
06 — Retention and safeguards
Information is retained for a defined business or legal need.
Retention depends on the record, account status, customer instructions, legal requirements, dispute needs, security, and backup cycles. Information is deleted, anonymized, or returned when the applicable purpose and retention period end, subject to reasonable technical and legal limits.
We use organizational and technical safeguards appropriate to the sensitivity, amount, purpose, and access context. No method is risk-free; customers also play an essential role by using individual accounts, suitable permissions, and protected devices.
07 — Your rights
Access, correction, withdrawal, and questions.
Subject to applicable law, you may ask whether we hold personal information about you, request access or correction, withdraw consent where processing depends on consent, or ask about a decision based exclusively on automated processing. Some limits and identity verification may apply.
When a customer company controls the record, send the request to that company first. You may also write to our privacy officer at noreply@fondationflow.com. We will route and assist with the request according to our role.
08 — Updates and complaints
A material change is explained before it takes effect.
We may update this policy as the service, practices, or law evolve. The effective date is shown on the page, and material changes receive an appropriate notice. A person may submit a complaint to our privacy officer and may also contact the competent privacy authority.
Privacy officer
A question, complaint, or access request?
Write to Fondation Flow’s privacy officer. We may need to confirm your identity before disclosing or correcting information.