Last updated · April 16, 2026 · Effective date · May 1, 2026
Privacy Policy
How we collect, use, and protect your personal information in accordance with Quebec's Bill 25 (An Act to modernize legislative provisions respecting the protection of personal information).
This Policy describes the practices of Syndic+ Inc. ("Syndic+", "we", "our") regarding the collection, use, disclosure, and retention of personal information when you use our condominium management platform offered at syndicplus.ca (the "Service"). It is drafted in accordance with the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Bill 25.
1. Roles: data controller vs. data processor
Syndic+ Inc., a corporation incorporated under the laws of Quebec, plays two distinct roles under the Act respecting the protection of personal information in the private sector (as amended by Bill 25):
**Data controller** — for personal information about our own users, prospects, and platform-level operations (account profiles, billing, support requests, marketing leads). Syndic+ determines the purposes and means of that processing and is directly accountable for it.
**Data processor** (sous-traitant) — for personal information about co-owners, board members, suppliers, and other persons that each subscribing syndicate stores on the platform (the registry, financial records, meeting minutes, document vault, etc.). The syndicate remains the data controller of that information; Syndic+ processes it on the syndicate's behalf, under the documented instructions in our Service Agreement and Data Processing Addendum.
Each syndicate is itself responsible for designating its own Privacy Officer under section 3.1 of the Act (default: the board of directors collectively, or in practice the board president; the role can be delegated in writing to a co-owner, the property manager, or an external third party). The Settings → Syndicate section of the platform provides a dedicated card for that designation; the designated person's contact information is published on the syndicate's co-owner portal as the law requires.
Our own Privacy Officer, listed in the "Contact and complaints" section below, handles only matters covered by Syndic+'s controller role (own users and own data) and our processor role (technical operations on syndicate data). They are NOT the Privacy Officer of any individual syndicate.
2. Personal information we collect
We collect only the information necessary for the purposes described in this Policy. The categories of data depend on the modules you enable and the information you or your co-owners enter.
- Identity and account: first and last name, email, phone number, hashed password, profile picture, preferred language, role on the board of directors.
- Authentication data: session tokens, passkeys, 2FA one-time codes, login history, IP address, device fingerprint.
- Units and co-owners registry: unit number, fraction (share), contact details of co-owners and tenants, voting rights, proxies.
- Syndicate financial data: budgets, common expenses, assessment notices, payments, contingency fund, self-insurance fund (Bill 141), accounting entries, financial statements.
- Documents and communications: files uploaded to the document vault, meeting minutes, announcements, co-owner requests, correspondence.
- Compliance and management: Bill 16 obligations (maintenance logbook, contingency fund study), insurance, claims, disputes, water heaters (Bill 141), declarations of co-ownership, Quebec Enterprise Number (NEQ) renewals.
- Third-party integrations: when you connect Microsoft 365, Google Drive, or Dropbox, we access only the OAuth scopes you have explicitly authorized (file read, email send, etc.).
- Payment data: we do not store any full credit card number. Stripe processes payments and transmits to us only a customer ID, the last 4 digits, the card brand, and the subscription status.
- Navigation data: pages visited, load speed, and technical errors collected by Vercel Analytics and Speed Insights, with no advertising identifier.
3. Purposes and legal basis
We use personal information only for the following purposes, in accordance with section 12 of the private sector Act:
- Contract performance: provide and maintain the Service, manage your account, bill your subscription, offer technical support.
- Syndicate legal obligations: enable your syndicate to comply with its obligations under the Civil Code of Québec and Bills 16, 25, 31, 78, 103, and 141.
- Security: detect fraudulent access, enforce two-factor authentication, trace sensitive operations in an audit log.
- Product improvement: aggregate-level analysis of feature usage (no individual marketing profiling).
- Transactional communications: send emails essential to the Service (invitations, meeting reminders, invoices), which you cannot opt out of without ceasing to use the Service.
- Marketing communications: only with your express consent in accordance with Canada's Anti-Spam Legislation (CASL). You may withdraw this consent at any time via the unsubscribe link.
4. Retention periods
In accordance with section 23 of Bill 25, we retain your information only as long as necessary for the purposes for which it was collected, then destroy or anonymize it.
- Active account data: for the duration of your subscription.
- Syndicate financial data: six (6) years after the end of the fiscal year, in accordance with the Quebec Taxation Act.
- Meeting minutes and registry documents: retained by the syndicate under the Civil Code of Québec; we delete them from our storage 90 days after account termination unless you request an export.
- Security and audit logs: 12 months.
- Backup data: automatically deleted on a 30-day rotation.
- After termination: account and data deleted after a 90-day grace period, except when longer retention is legally required.
5. Disclosure to third parties and subprocessors
We never sell your personal information. We rely on subprocessors (service providers) bound by written agreements that impose confidentiality and security obligations equivalent to ours.
| Provider | Function | Country | Data involved |
|---|---|---|---|
| Supabase (PostgreSQL hosting + storage) | Primary database and vault files | Canada (ca-central-1) | All syndicate data |
| Vercel Inc. | Next.js application hosting and performance analytics | United States (with EU/CA edge regions) | Navigation data, technical logs |
| Stripe Payments Canada, Ltd. | Payment processing and subscription management | Canada / United States | Payment data (excluding full card number) |
| Resend, Inc. | Transactional email delivery | United States | Email address, email content |
| Microsoft Corporation (Graph API) | Microsoft 365 integration (if enabled by the syndicate) | Canada / as per Microsoft tenant | As per authorized OAuth scopes |
| Google LLC (Drive API) | Google Drive integration (if enabled) | United States / as per account | As per authorized OAuth scopes |
| Anthropic PBC | AI assistant (if enabled and explicitly requested by the user) | United States | Request content only |
6. Transfers outside Quebec
Primary data is hosted in Canada (Supabase, ca-central-1 region in Montreal). Some subprocessors — notably Vercel, Stripe, and Resend — may process information in the United States. In accordance with section 17 of the private sector Act, we conducted a privacy impact assessment (PIA) before each transfer and concluded, considering the contractual and technical measures in place, that the level of protection is adequate. You can request a summary copy of these assessments from our person in charge of the protection of personal information.
7. Cookies and similar technologies
We use a limited number of cookies, all strictly necessary for the operation of the Service. We use no advertising cookies and no third-party profiling trackers.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| better-auth.session_token | Maintains your authenticated session | 7 days | Strictly necessary |
| better-auth.session_data | Stores session metadata (role, active org) | Session | Strictly necessary |
| NEXT_LOCALE | Remembers your preferred language (fr-CA / en-CA) | 1 year | Functional |
| theme | Light / dark UI theme | 1 year | Functional |
| __vercel_* | Aggregated and anonymized performance analytics | Session | Audience measurement |
8. Your rights under Bill 25
Bill 25 grants you specific rights over your personal information. You can exercise them free of charge by writing to confidentialite@syndicplus.ca. We will respond within a maximum of 30 days.
- Right of access: obtain a copy of the information we hold about you.
- Right of rectification: correct inaccurate, incomplete, or equivocal information.
- Right to de-indexation: request that your information no longer be indexed by search engines when its dissemination causes you serious harm.
- Right to portability (since September 2024): receive your data in a structured, commonly used technological format.
- Right to cease dissemination: request that a communication be stopped.
- Right to withdraw consent: applicable to any purpose for which consent was obtained.
- Right to erasure: request deletion of your data when purposes are achieved or consent is withdrawn.
- Right to information on automated decisions: know whether a decision was made solely based on automated processing and contest it.
- Right to file a complaint with the Commission d'accès à l'information (CAI).
9. Security measures
We implement organizational and technical measures proportionate to the sensitivity of the data.
- Encryption in transit (TLS 1.3) and at rest (AES-256) for all data.
- Mandatory two-factor authentication for owner and admin roles on sensitive modules (finances, accounting, compliance, team).
- Native support for passkeys (WebAuthn) to replace passwords.
- Role-based access control: strict separation between owner, admin, co-owner, and platform super-admin.
- Multi-tenant isolation: each syndicate has an organization ID that scopes every database query.
- Timestamped audit log for all sensitive operations, retained 12 months.
- Daily encrypted backups with 30-day retention.
- Documented privacy incident response process.
10. Privacy incident notification
In accordance with section 3.5 of the private sector Act, if a privacy incident presenting a risk of serious harm were to occur, we would promptly notify the Commission d'accès à l'information as well as the individuals concerned, and we would record the incident in our internal register.
11. Automated decisions
Syndic+ does not make any decision based exclusively on automated processing that would produce legal effects on an individual. Alerts, calculations, and reminders generated by the platform are purely informational — all decisions (expense approval, voting eligibility, board resolutions) are made by humans: syndicate directors and co-owners.
12. Information concerning minors
The Service is intended for condominium syndicates and adult individuals. We do not knowingly collect personal information from minors under the age of 14. If a parent or guardian becomes aware that such information has been collected, they may request its immediate deletion.
13. Changes to the Policy
We may modify this Policy to reflect changes to the Service, to our subprocessors, or to the legal framework. For material changes, we will notify you by email and via an in-app banner at least 30 days before the effective date.
14. Contact and complaints
To exercise a right, ask a question, or file a complaint regarding your personal information, please contact our person in charge of the protection of personal information:
David Sanchez, Person in charge of the protection of personal information Syndic+ Inc. Montréal, Québec, Canada Email: confidentialite@syndicplus.ca
If you feel our response is unsatisfactory, you may file a complaint with Quebec's Commission d'accès à l'information (cai.gouv.qc.ca) or, depending on your jurisdiction, with the Office of the Privacy Commissioner of Canada (priv.gc.ca).