Legal information

1. Our commitment

This policy explains what personal information we collect, why, with whom we share it and what rights you may exercise. It applies to the site, the member area and all our forms, wherever you reside.

We apply to all our users, regardless of country, the highest level of protection required by the regimes to which we are subject, in particular Quebec's Law 25, Canada's PIPEDA and the European Union's General Data Protection Regulation.

2. Person responsible for the protection of personal information

The person responsible for the protection of personal information within Gestion Charles Desmarais Inc. is the person holding the highest authority in the company. Any question, or request for access, correction or withdrawal, may be addressed to them at contact@broker-ai.ai, or by mail to 854 rue Garand, Saint-Jean-sur-Richelieu (Québec) J3B 6Y8, Canada.

3. Information we collect

We collect only the information necessary for the purposes described in section 4. Specifically:

• Account — email address, password (stored only in encrypted form and never readable by us), first name, last name.
• Profile, if you choose to complete it — your brokerage name, profile picture and banner image.
• Purchase — plan purchased, date of purchase, account status. Your card details are entered directly with our payment provider and never pass through our servers.
• Progress — the lessons you mark as completed yourself, in order to display your advancement. You can unmark them at any time.
• Kit openings — the date on which you first open each of your kits. This record is written by our servers, is used solely to apply our refund guarantee, and can be neither modified nor deleted by you — which is what makes it a fair basis for both parties. You may request a copy of it by writing to us.
• Contact and application forms — first name, last name, email, phone, city, professional situation, experience, business volume, current brokerage, topics of interest, preferred contact method and time, timeline, referral source and free-form message.
• Technical data — IP address, device and browser type, language, pages viewed, security and error logs.

We collect no sensitive information within the meaning of applicable laws (health, biometrics, origin, opinions, orientation). We make no decision producing legal effects concerning you based solely on automated processing, and we carry out no advertising profiling.

4. Why we collect it

• To create and manage your account, authenticate you and secure access.
• To process your purchase, calculate applicable taxes, issue your receipt and grant access to your plan's content.
• To display your progress through your kits.
• To check, from the kits you have opened, whether a refund request meets the conditions of our guarantee.
• To respond to your requests, questions and the forms you send us.
• To send you communications related to your account and purchases (confirmations, service notices, content updates).
• To send you commercial communications, only where you have consented.
• To secure the platform, prevent fraud and abuse, and comply with our legal and tax obligations.
• To understand how the site is used in order to improve it. With your consent, this measurement relies on a pseudonymous identifier specific to your device, which allows visits from the same browser to be recognized — never your identity.

We never use your information for a new purpose incompatible with those above without informing you and obtaining your consent where the law requires it.

5. Consent and lawful basis

Depending on the case, we process your information because it is necessary to perform the contract between us, because a legal obligation requires it, because we have a legitimate interest in securing and improving the service, or because you have consented.

Where we rely on your consent, it is requested clearly, separately and through a positive action on your part. You may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal, or your access to the content you have purchased.

6. Cookies and audience measurement

We use cookies that are strictly necessary for the site to function: maintaining your authentication session, remembering your language and security. These cookies cannot be disabled without preventing the site from working, and serve no advertising purpose.

For audience measurement we use Google Analytics, which tells us how many people visit the site, where they come from and which pages they view. We also report to it that a request was submitted through our form, so we can tell which traffic sources bring requests — without sending it the content of that request. This data is processed by Google outside Quebec.

This service is only loaded AFTER your consent, obtained through a banner allowing refusal as easily as acceptance: until you accept, no measurement cookie is set and no data is sent to Google. Declining does not limit your browsing in any way. If you withdraw your consent, measurement stops immediately and any cookies already set are deleted.

You may change your choice at any time using the button below, and configure your browser to block or delete cookies.

We do not sell any data and do not set any third-party advertising cookies that would allow you to be tracked across other sites.

7. Who we share it with

We never sell, rent or trade your personal information. We disclose it only to the providers that enable us to operate the service, bound by contract, authorized to process it solely on our instructions and for the intended purpose alone:

• Supabase — database, authentication and storage of uploaded files (kit images, documents, profile pictures).
• Vercel — website hosting and delivery, including the images built into it.
• Cloudflare — video hosting and delivery.
• Stripe — payment processing, tax calculation and receipt issuance.
• Google — audience measurement (Google Analytics), only if you have consented to it (see section 6).

We may also disclose information where required by law, to respond to a request from a competent authority, to assert our rights, or in the context of a corporate reorganization or sale — in which case this policy would continue to apply and you would be informed.

8. Hosting and international transfers

Our providers operate infrastructure located outside Quebec, in particular in Canada, the United States and Europe. Your information may therefore be stored or processed in a country whose protection regime differs from that of your place of residence, and may be subject to that country's laws.

Before entrusting information to a provider located abroad, we assess the adequacy of the protection offered and frame the transfer with appropriate contractual commitments, including standard contractual clauses where required.

9. Retention period

• Account and profile — for the life of the account, then up to twelve months after its closure.
• Proof of purchase and accounting records — for the period required by applicable tax legislation, generally seven years.
• Requests submitted through forms — up to thirty-six months after the last exchange, so that we can follow up and demonstrate your consent.
• Technical and security logs — twelve months at most.
• Audience-measurement cookies (“_ga”, “_ga_…”) — twenty-four months at most from your last visit, or immediately if you withdraw your consent.
• Audience measurements retained by Google — up to fourteen months, according to our account's retention setting.

Upon expiry of these periods, the information is destroyed or irreversibly anonymized.

10. Security

We implement technical and organizational measures proportionate to the sensitivity of the information: encryption of communications, password encryption, access partitioning through database-level security rules, restriction of administrative access to those who need it, and logging of sensitive operations.

As no system is infallible, we cannot guarantee absolute security. In the event of a confidentiality incident presenting a risk of serious injury, we will notify the individuals concerned and the competent authorities within the time limits prescribed by law, and we maintain an incident register.

11. Your rights

Wherever you reside, you may exercise the following rights with us:

• Access — obtain confirmation that we hold information about you and receive a copy of it.
• Correction — have inaccurate, incomplete or ambiguous information corrected.
• Deletion — request destruction of information whose purpose has been fulfilled, subject to our legal retention obligations.
• Withdrawal of consent — stop, at any time, processing based on your consent, in particular commercial communications.
• Portability — receive, in a structured and commonly used technological format, the information you have provided to us.
• Objection and restriction — object to certain processing or request that it be restricted.
• De-indexing — request that dissemination of information cease, or that a link giving access to it be de-indexed, where the conditions set out by law are met.

To exercise a right, write to contact@broker-ai.ai. We respond free of charge within thirty days. We may ask you to confirm your identity before acting, so as not to disclose your information to a third party.

12. Region-specific rights

• Quebec — you may file a complaint with the Commission d'accès à l'information du Québec if you consider that your rights have not been respected.
• Rest of Canada — you may refer the matter to the Office of the Privacy Commissioner of Canada.
• European Economic Area and United Kingdom — you have the rights provided by the GDPR, including the right to lodge a complaint with the supervisory authority in your country.
• United States — depending on your state, you may have additional rights, in particular the right to know what categories of information are collected, to request their deletion, and to opt out of their sale or sharing. We do not sell or share your information for advertising purposes.

13. Commercial communications

We send you commercial communications only where you have consented or where applicable law permits it because of our business relationship. Every message clearly identifies its sender, provides a valid contact address and includes a free unsubscribe link, processed within ten business days at the latest.

Unsubscribing from commercial communications does not stop messages necessary to the service, such as purchase confirmations, security notices and information about your account.

14. Minors

The platform is intended for professionals and is not directed at persons under eighteen years of age. We do not knowingly collect information concerning a minor; if such a case is reported to us, the information is deleted without delay.

15. Changes to this policy

We may amend this policy to reflect changes in the service or in regulations. The date of the last update appears at the top of the document. Any substantial change is brought to your attention by a notice on the platform or by email before it takes effect.