SLK Electrical — Privacy Policy (v1)
Effective date: October 1, 2026 Applies to: app.slkelectrical.com, slkelectrical.com, and related services.
This policy is drafted for Québec's *Act respecting the protection of personal information in the private sector* (Law 25).
1. Privacy officer
Our designated privacy officer is Benjamin Slakmon. Contact: privacy@slkelectrical.com
2. What we collect
Account information: name, email address, password (stored hashed), organization name and role, language preference.
Customer Data: the project information, documents, drawings, equipment data, calculations, and other content you upload or create in the Services. Customer Data may incidentally contain personal information about your employees or contacts (e.g., names in a deliverable register). You are responsible for ensuring you have the right to provide it.
Usage and technical information: login history, pages and features used, actions taken (e.g., "task created"), device and browser type, IP address. Our product telemetry uses an allowlist: it records *that* an action happened, never the confidential content of your projects (no project names, document contents, or engineering data in analytics).
Billing information: processed by our payment processor (Stripe). We do not store full credit-card numbers.
Support communications: emails and chat messages you send us.
3. Why we collect it
- To provide, maintain, and secure the Services (account info, Customer Data).
- To process subscriptions and issue invoices (billing info).
- To understand usage and improve the product (aggregated, allowlisted telemetry).
- To provide support (support communications).
- To comply with legal obligations (e.g., tax records).
We collect only what is necessary for these purposes.
4. Where it is hosted and who processes it
Production data is hosted by Supabase (database, authentication, file storage). The application runs on Vercel. Email is sent via our transactional email provider. Error monitoring and product analytics are provided by our monitoring vendors. Payments are processed by Stripe.
Our current subprocessor list is maintained at our trust center and in docs/PRODUCTION_TRUST_CHECKLIST.md (item C2). We do not sell personal information, and we do not use Customer Data to train AI models.
Cross-border transfers. Some processors may store or process information outside Québec/Canada. Before any personal information is communicated outside Québec, we conduct a privacy impact assessment (ÉFVP) as required since September 2023, and we document the safeguards in place.
5. Retention
- Account information: kept while your account is active, deleted within 30 days
of account closure (except records we must keep by law).
- Customer Data: deleted from production within 30 days of termination or your
written request; backups age out within 7 days thereafter.
- Billing records: kept as required by tax law (generally 6 years in Canada).
- Telemetry: aggregated; raw event logs kept 90 days.
6. Your rights (Law 25)
You may, subject to legal limits:
- Access the personal information we hold about you.
- Rectify inaccurate, incomplete, or equivocal information.
- Withdraw consent to the use or communication of your information (this may
limit our ability to provide the Services).
- Request information about how we handle your data.
To exercise these rights, contact privacy@slkelectrical.com. We respond within 30 days. If you are unsatisfied, you may complain to the Commission d'accès à l'information du Québec (CAI).
7. Security
We protect personal information with encryption in transit and at rest, authentication, database row-level tenant isolation, private file storage with short-lived signed URLs, and monitoring. Access to production data is limited to personnel who need it to operate the Services.
8. Cookies and analytics
We use strictly-necessary cookies for authentication and preferences, and privacy-respecting product analytics under the allowlist described in Section 2. We do not use advertising trackers.
9. Changes
Material changes to this policy are notified at least 30 days in advance by email or in-app notice.
10. Language
This policy is provided in English and French (docs/legal/privacy-v1.md and docs/legal/privacy-v1-fr.md); the French version prevails in case of divergence for users in Québec.
11. Contact
Privacy: privacy@slkelectrical.com · General: support@slkelectrical.com SLK Électrique (Benjamin Slakmon), Québec, Canada.