Privacy

Privacy Policy — GoContrôle CRM

Last updated: 2026-10-26

1. Who we are

GoContrôle (the "Publisher", "we", "our") operates the GoContrôle CRM platform at crm.gocontrole.com.

Data Controller: GoContrôle

Privacy email: [email protected]

Showcase site: https://gocontrole.com

2. Data collected

2.1 Account data (provided by you)

Email address (login identifier)
Password (PBKDF2-SHA256 hashed, never stored in plaintext)
Preferred language (fr / en)

2.2 Platform usage data (generated by your activity)

Contacts you create or import: name, company, phone, email, address, notes, tags, pipeline status
Pipeline: opportunities, stages (New → In progress → Qualified → Won), values, dates
Tasks and follow-ups: title, description, due date, status
Activity history: logins, modifications, exports

2.3 Technical data (logs)

IP address (hashed for anonymous analytics, retained 30 days raw for security)
User-Agent, timestamps, pages visited, errors
Session identifier (cookie sha_session, HttpOnly, SameSite=Lax, 7 days)

2.4 Billing data (managed by Paddle)

We store no credit card data. Paddle (merchant of record) collects and processes:

Name, billing address, email
Payment method (card)
Invoice and payment history

See Paddle's privacy policy: https://paddle.com/privacy

2.5 Form data

Requests sent from the contact page (name, email, company, number of seats, currency, message) are stored in our database so we can handle the request.

2.6 Third-party data (sub-processors)

Cal.com: appointment data (slot, guest, notes) — see https://cal.com/privacy
Chatwoot: chat conversations, visitor metadata — see https://www.chatwoot.com/privacy-policy
Cloudflare: security logs, performance, hosting — see https://www.cloudflare.com/privacypolicy/

3. Purposes and legal bases (Law 25 / PIPEDA)

| Purpose | Legal basis | Data involved |

|---------|-------------|---------------|

| Provide the service (account, pipeline, contacts, tasks) | Contract performance (Law 25 art. 12 / PIPEDA) | Account, contacts, pipeline, tasks |

| Billing, invoices, taxes | Legal obligation + contract | Paddle data (we access read-only) |

| Security, abuse/fraud detection | Legitimate interest (Law 25 art. 13) | IP, logs, session |

| Product improvement (aggregated, anonymous) | Legitimate interest | Aggregated usage (no identifiable data) |

| Customer support (respond to requests) | Explicit consent / contract | Email, request content |

| Transactional emails (invoices, alerts, renewals) | Contract / legal obligation | Billing email |

No profiling for commercial segmentation, no data resale, no cross-site tracking.

4. Hosting and data locality

All Platform data (accounts, contacts, pipeline, tasks, logs) is hosted on Cloudflare infrastructure, in Canada.

D1 database: nam-east region (Eastern North America) — physically in Canada
Pages / Workers / R2: same region
No data transfer outside Canada performed by the Publisher

Sub-processors (Paddle, Cal.com, Chatwoot) may process data outside Canada under their own policies — DPAs (Data Processing Agreements) are signed with each.

5. Retention periods

| Data | Duration | Deletion |

|------|----------|---------|

| Active account (email, password hash) | Subscription duration + 30 days post-cancellation | Automatic at D+30 post-cancellation |

| Contacts, pipeline, tasks, notes | Subscription duration + 30 days post-cancellation | Automatic at D+30 post-cancellation |

| Contact page requests | 24 months | Automatic |

| Raw technical logs (IP, User-Agent) | 30-day rolling | Automatic |

| Security logs (failed logins, alerts) | 90 days | Automatic |

| Paddle invoices | Per Paddle policy (7 years accounting) | Managed by Paddle |

On erasure request (right to be forgotten): we delete within 30 days, except overriding accounting or tax obligations.

6. Your rights (Law 25 Quebec / PIPEDA Canada)

You have the right to:

Access: obtain a copy of your data
Rectification: correct inaccurate data
Erasure: request deletion (right to be forgotten)
Portability: receive your data in structured format (JSON/CSV)
Objection: object to legitimate-interest processing
Restriction: pause processing pending verification
Withdraw consent: for consent-based processing

Exercise: email [email protected] — response within 30 days.

Complaint: CAI (Quebec) or OPC (Canada).

7. Security

Encryption in transit: TLS 1.3 (Cloudflare)
Encryption at rest: Cloudflare D1 / R2 (AES-256)
Passwords: PBKDF2-SHA256, 100,000 iterations, unique salt per user
Sessions: HttpOnly, Secure, SameSite=Lax cookies, HMAC-signed, 7-day TTL
Rate limiting: application limits (IP address and user)
Admin access: SSH key-only, fail2ban, no passwords

8. Sub-processors

|---------------|------|----------|-----|

9. Cookies and similar technologies

9.1 What a cookie is

A cookie is a small text file placed on your device (computer, phone, tablet) when you visit a website. It allows the site to recognize your device on subsequent visits.

9.2 Cookies used on crm.gocontrole.com

GoContrôle CRM uses only strictly necessary cookies for the service to function.

|--------|------|----------|---------|

9.3 Why these cookies are strictly necessary

They let us identify you during your session, protect the platform against automated attacks and unlawful content, and keep the service available. Under Article 82 of the French Data Protection Act and Article 5.3 of the ePrivacy Directive, consent is not required for cookies strictly necessary to provide an online communication service explicitly requested by the user.

9.4 No third-party cookies

No audience analytics tool (GA4 or equivalent)
No tracking pixel
No commercial-segmentation cookie
No cross-site tracking cookie

9.5 Cookie management

You can configure your browser to block or delete these cookies, but the Platform will not work (unable to log in, Cloudflare security errors).

Chrome: chrome://settings/cookies
Firefox: about:preferences#privacy → Cookies and Site Data
Safari: Preferences → Privacy → Manage Website Data
Edge: edge://settings/content/cookies

9.6 Contact

For any cookie-related question: [email protected]

10. Minors

The Platform targets professionals (B2B). We do not knowingly collect data from minors under 14 (Law 25 threshold). If you discover that a minor provided data, contact us for immediate deletion.

11. Changes

Material changes are notified by email (billing address) at least 30 days before taking effect. The current version is dated in the header.

12. Contact

GoContrôle — Data Protection Officer

Email: [email protected]

Website: https://gocontrole.com