Privacy policy

1. Who is responsible

Informerick operates CCPP and is responsible for the personal information it holds, under Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA. The person in charge of the protection of personal information can be reached at privacy@ccpp.dev.

2. What we collect

• At signup: a username, an email address and a password, which we store only as a bcrypt hash.
• If you add them: a profile picture, your first and last name and a postal address. The name and address are required only to subscribe to a paid plan.
• When you sign in: the IP address and browser identification of each session, and the time of your last sign-in.
• The versions of these terms and of this policy you accepted, and when.

3. Why we use it

To create and secure your account, to sign you in to ccpp.dev and to the CCPP cloud products you use, to bill a paid plan, to answer your requests and to prevent abuse. We do not sell your personal information, we do not use it for advertising, and we do not build profiles of you.

4. Cookies

We set one cookie when you sign in: an essential session cookie, marked HttpOnly and Secure. It holds a random identifier; the database keeps only its SHA-256 hash. We use no advertising or tracking cookies.

5. Where it is kept

Your information and your profile picture are stored on our servers in Beauharnois, Québec, Canada. They are not sent outside Québec. A payment provider will receive what a payment needs when paid plans open; this policy will name it first.

6. Who can see it

Your username and profile picture may be shown to other users and in the CCPP cloud products. Your email, name and address are visible only to you and to the people of Informerick who need them to run the service. A CCPP cloud product receives only what the permissions you granted it allow.

7. How long we keep it

For as long as your account exists. When you close it, we delete your personal information within 30 days, except what the law requires us to keep, such as billing records. Expired sessions are deleted every hour.

8. Your rights

You may ask to access your personal information, to correct it, to receive it in a structured format, to withdraw your consent or to have it deleted. You can correct most of it yourself on your account page. For the rest, write to privacy@ccpp.dev; we answer within 30 days. You may also complain to the Commission d'accès à l'information du Québec.

9. Security

Passwords are hashed with bcrypt, sessions and tokens are stored as hashes, traffic is encrypted with TLS, and access to our servers is restricted. If an incident puts your information at risk of serious harm, we tell you and the Commission d'accès à l'information.

10. Changes

When this policy changes in a way that matters, we say so and ask you to accept the new version. The version you accepted is recorded with your account.