The On Bricole platform is operated by DEHB Solutions Technologiques Inc, 425 Rue Honoré-Mercier, G7H 3J7, Chicoutimi. Business number (NEQ) : 1182629155.
This policy explains what personal information we collect, why, who we share it with, and what you can require from us. It applies Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and the federal PIPEDA where applicable.
Privacy Officer: Barthelemy Montreuil, PDG (barthelemy.montreuil@yahoo.fr). You can reach them through the Contact page.
1. What we collect
Your account: email, password (kept as an encrypted fingerprint, never in clear text), first and last name, photo if you add one, phone number, language, plan, creation date.
Your profile: address and postal code, city, geographic coordinates of the service location, service radius, trades and categories, rates, availability, biography, photos of past work, RBQ licence where applicable.
Your activity: posted requests, submitted offers, bookings, recurring and seasonal contracts, messages, reviews written and received, favourites, saved requests, tokens and their movements, referrals.
Your payments: amounts, commissions, fees, statuses, dates, transaction identifiers at our provider. We neither see nor store your card number: it is entered directly with Stripe.
Your identity, if you request verification: document type and images submitted. These images are used only for verification and are never published.
Technical: IP address, device and browser type, app version, error logs, device identifier for push notifications, last activity.
2. Why we use it
To open your account and authenticate you; to post your requests and present them to relevant workers; to enable offers, exchanges and work scheduling; to process payments, escrow, refunds and disputes; to display a useful reputation (reviews, levels, responsiveness); to prevent fraud, bypass and abuse; to meet our legal obligations, notably accounting and tax; to notify you of events that concern you; and, with your consent, to send you news about the Platform.
We collect only what those purposes require, and we do not use your information for other purposes without telling you.
3. What this processing rests on
Most of it is necessary to perform the contract between us (you cannot be paid unless we process the payment). Some rests on a legal obligation (accounting retention). Promotional emails and identity verification rest on your consent, which you may withdraw.
4. Location
To match requests with workers, we convert an address or postal code into geographic coordinates.
Your exact position is never published. Maps show area clusters, not precise points, and coordinates stay on the server. A client sees a worker’s city, not their address.
The app may ask for your device location to pre-fill a search. This is never mandatory: decline, and everything still works from a manually entered address. You can revoke this permission in your phone settings.
5. Decisions made by a machine
Some features rely on automated processing: choosing which workers are notified of a request, assigning levels, price benchmarks per category, and detecting contact details in messaging.
You have the right to be informed when a decision concerning you is made this way, to obtain the main factors behind it, to submit your observations and to request review by a person. Write to us through the Contact page.
We do no advertising profiling and make no automated decision producing legal effects for you.
6. Who we share it with
With the other party to a contract: what is needed to work together — display name, city, profile photo, trades, reviews, and the precise address once the booking is confirmed.
Publicly: what a worker chooses to show on their public profile (biography, past work, city, trades, average rating).
With our providers, solely to operate the Platform and within the limits of their mandate:
- Stripe — payments, escrow, payouts to workers;
- Supabase — database and image storage;
- Vercel — hosting of the website and the API;
- SendGrid — sending emails;
- Twilio — sending verification codes by SMS;
- Expo — delivering push notifications;
- Google and Facebook — external account sign-in, if you use it;
- Google Maps — displaying maps;
- Open-Meteo — weather and storm alerts (no personal data: only an approximate area is sent);
- an artificial-intelligence provider — for the search assistant, which receives the text of your question, not your record;
- an error-monitoring service — to diagnose crashes.
We may also disclose information where the law requires it, to assert our rights, or to protect someone’s safety.
We do not sell your personal information and we do not rent it to anyone.
7. Outside Québec
Several of these providers process or host data outside Québec, mainly in the United States and Europe. Before entrusting information abroad, we assess the privacy-related factors and contractually require protection equivalent to Québec’s. By using the Platform, you are informed that your information may be processed outside Québec and be subject to local law there.
8. How long we keep it
While your account exists, your information stays available for you to use. After an account is closed, it is anonymised, except for records the law requires us to keep. Details are in the Data Deletion and Retention Policy.
9. Your rights
- Access — know what we hold and obtain a copy.
- Portability — retrieve your information in a structured, commonly used format: the “My data” button, in your profile on the website and in the Account section of the app, produces a complete JSON file on demand, reusable elsewhere. It contains no password or sign-in token, and no one else’s record.
- Correction — fix inaccurate or incomplete information. Some items can be changed directly in your profile; the name locks after identity verification, so a verified record cannot change holder.
- Withdrawal of consent — decline promotional emails (unsubscribe link in every message, or account setting), revoke location access, withdraw an identity verification request.
- Deletion — close your account, or ask that a specific item be erased where keeping it is no longer justified.
- Cessation of dissemination and de-indexing — ask that information stop being disseminated or that a link be de-indexed where the law allows.
We respond within 30 days. Access and portability are free. A refusal is reasoned and states your remedies.
If our answer does not satisfy you, you may complain to the Commission d’accès à l’information du Québec, or to the Office of the Privacy Commissioner of Canada where federal law applies.
10. How we protect it
Exchanges with the Platform are encrypted in transit. Passwords are stored as irreversible fingerprints. Certain sensitive information — your phone number and address — is encrypted at rest in our database, so that it cannot be read in clear text in the event of unauthorized access to the data. Your banking information is never stored by the Platform: it is processed directly by our payment provider (Stripe). Your identity documents are kept in a private, access-restricted space and are never publicly accessible. Access to production data is limited to those who need it. Amounts and commissions are recomputed server-side, and download links for your data are signed and expire within minutes. No system is infallible: we keep a register of confidentiality incidents.
11. In case of an incident
If an incident presents a risk of serious injury, we inform you without delay, along with the Commission d’accès à l’information, and take measures to limit its effects.
12. Cookies
You are not shown a consent banner, and that is deliberate: there would be nothing to decline. The site sets only cookies strictly necessary to its operation, and no trackers.
Here is the complete list:
- __Host-authjs.csrf-token — a security token preventing another site from submitting a form on your behalf. Set on first visit, unreadable by page code.
- __Secure-authjs.callback-url — remembers which page to return you to after signing in.
- authjs.session-token — your session, once signed in. It saves you from re-entering your password on every page.
- lpb_locale — the language you chose, so we don’t ask again.
In addition, only if you tick “Remember me” on the sign-in screen, your email address is kept in your browser’s local storage — on your device, never transmitted.
What we do not use: no advertising cookies, no analytics, no third-party trackers, no social network pixels. We do not follow your browsing from site to site.
The law requires prior consent only for technologies that identify, locate or profile a person. The cookies above do none of that: they make sign-in work and remember your language. You may block them in your browser, but sign-in will then stop working.
If this changes, you will know. The day we add analytics or targeted advertising, consent would be requested BEFORE anything is set, with the option to decline without losing access to the service.
Pages showing a map load Google Maps, which sends your IP address to Google (see sections 6 and 7). Other pages contact no third-party service.
13. Minors
The Platform is for people 18 and over. We do not knowingly collect information about a child. If you find that an account was created by a minor, write to us: we will close it.
14. Changes
We may amend this policy. The update date appears at the top. A significant change will be announced in the app or by email before it takes effect.
15. Contact us
Through the Contact page. Mention “personal information” in your message so it reaches the right place.