Privacy Policy — Gestion Onyxia

English translation provided for convenience. In case of difference, the French version prevails.

Last updated: November 4, 2026

Gestion Onyxia is an online application that helps cleaning companies manage their schedules, their employees' attendance, the products to order for each location, their clients' messages and their invoices. It is offered by Eric Campeau, doing business as Gestion Onyxia (NEQ 2249818370) ("Gestion Onyxia", "we").

This policy explains, in plain terms, what personal information goes through Gestion Onyxia, why, where it is kept, for how long, and what your rights are. It complies with Québec's Act respecting the protection of personal information in the private sector.

In short

Your data is hosted in Québec (OVHcloud, Beauharnois), along with its backup copies.
Nothing is sold: no advertising, no profiling, no geolocation.
For the employees and clients of a subscribing cleaning company, that company is responsible: we process their information on its behalf.
Three of the application's services are outside Québec: sending emails (Resend, United States), paying the subscription (Stripe, United States) and our mailbox (Zoho, in Canada).
When an employee taps "Directions" or "Waze", the cleaning address goes to Google or Waze.
Onyxia support enters your account only if the owner opens it, and the owner sees each entry and each change made by support. To fix an error, a masked copy of your data (no names or contact details) may be read by an artificial intelligence assistant (Anthropic, United States).
A company's data is kept for 30 days after the end of its subscription (until the date we give it by email and on screen), then deleted within the following 15 days.
You can view, correct or get a copy of your information: we reply within 30 days.

1. Who is responsible for what

Two different situations:

Subscribing cleaning companies (our customers) use Gestion Onyxia to manage their employees and their clients. For this information, the subscribing company is responsible. We process it only on its behalf, under a written agreement, and never for any other purpose. If you are an employee or a client of a cleaning company that uses Gestion Onyxia, please address your questions to that company first; we will help it answer you.
Information about the subscribing companies themselves (the name and contact details of the owner or the coordinator, the billing of the subscription): here, Gestion Onyxia is responsible.

2. Person in charge of the protection of personal information

Eric Campeau, owner Email: info@gestiononyxia.ca · Phone: 514 475-5027

3. The information collected

For whom	What information	Why
Owner or coordinator of the subscribing company	Name, email, phone, city, company name, enterprise number (NEQ, optional), GST and QST numbers (optional), username and password; the language chosen for their screen and emails (French or English); if they open Onyxia support access, their choice and the support history (section 5)	Open and administer the account, bill the subscription, reach you, send the "forgot password" link, help you when you ask
Employees of the subscribing company	First name, last name, phone, email (optional), username and password; the 4-digit PIN they choose to display the alarm codes, if they have any; work schedule; arrival and departure times on site (clock-in); the changes the company makes to their schedule (which cleaning, what changed, when; never the text of a note or an address) and the time the employee taps “OK, I've seen it”, which the company sees; the corrections the company makes to their hours and the time they saw them, which the company sees; tasks checked off; products scanned; absences (period and reason: illness, vacation or other, with an optional note); the notes they leave on a contract for the other employees (the text, their first name, the date) and, if they wish, a photo of the premises attached to a note (reduced, without the GPS position); the language chosen for their screen (French or English)	Organize the work, confirm attendance on site, count the products used, replace an absent employee, give the week's hours to the company's accountant
Clients of the subscribing company (contact persons)	Name of the client company, name of the contact person, phone, email; address and instructions for the premises cleaned; messages sent to the company and its replies; shopping list and the contact details of the suppliers the client adds to it; invoices and credit notes (with the billing address and the purchase order number, if any); the language of their portal and emails (French or English), chosen by the person or entered by the company	Plan the cleanings, display the client portal, answer their messages, prepare quotes and invoices, order the products for their premises, keep their shopping list and let them write to their suppliers from their own email (Onyxia sends them nothing)
Future clients (quotes)	Name of the company, contact person, phone, email, address, city and postal code of the premises, the company's note	Prepare and give the quote; create the client if they accept it
Suggestions sent to Gestion Onyxia	What is asked, why, the urgency, who sent it, Eric's answer	Improve the application and answer the company
Alarm code for the clients' premises, entered by the company	The code itself, encrypted with a key kept separately (a backup or a copy of the data never contains it in clear); the log of who displayed, changed or opened it, and which employees the company gave or removed access to (the person, the contract, the date and time; never the value of the code)	Let the employees the company gives access to, contract by contract, get in and arm the alarm: they see this code at any time, until the company removes their access; let management manage it and know who saw it. Never seen by the client, an employee without this access or Onyxia support; never in an email, an export or the demo.
The subscriber's product suppliers	Company name, email and phone, and the name of its owner or manager; for DMT without a customer number, also the fact that the company is on a trial of Onyxia	Send product orders
Website visitor who fills in the "Any questions? Eric calls you back" form	Name, company, phone, email (optional), team size, message	Call you back to answer your questions. The request is sent to us by email (by Resend, see section 5) and kept in our mailbox; nothing is recorded in the application. We use it for nothing else. Your IP address is kept in memory for about one hour, to block rapid repeat submissions. The application doesn't write it to any file.
Person to whom Gestion Onyxia gave a trial code, before October 31, 2026	The name of their company (or their name) and, if they give it, their phone number	Give them their code and recognize them if they sign up. If the code is not used, erased 30 days after it expires (section 7); if it is used, kept with their company's data.
Website visitor who clicks "Try the demo"	No information is requested. What you type in your copy of the fictitious demo company, and your IP address (to limit the number of demos per day)	Let you try the application without signing up. Your copy and everything you typed in it are deleted automatically 24 hours after it is created; do not enter real personal information in it. No email is sent from a demo.
Visitor of the gestiononyxia.ca website	The truncated IP address (its last part is erased before it is written), the page viewed (without what follows the “?” in the address), the date and time, the browser, the site you came from (its name only) and technical details of the request (for example its response code, size and duration)	Count the site's visits and see which pages interest people (statistics). Done on our server in Québec; no cookies; nothing is shared with anyone. The application (app.gestiononyxia.ca) is not counted.
Anyone who signs in	IP address, date and time, type of browser and the site the request comes from (its name only), at each successful or refused sign-in, password change or administrative action	Security: block intrusion attempts and investigate an incident

The language chosen (French or English) is used only to display the application, to write emails in that language and to prepare the documents given to the person (invoices, quotes, access card).

What we do not do:

No geolocation. Clock-in records the time, not the phone's position.
The camera is used to read a barcode, directly on the phone, and, if the employee wishes, to attach a photo of the premises to a note. This photo is reduced and never has the GPS position; it is seen by management and the contract's employees, never by the client, and is never sent by email; it is erased with its note, with the contract, or with the company's data after the end of the subscription (section 7). No other image or video is sent or kept.
No social insurance number, date of birth or banking information of employees: the application does not ask for them, and it collects no wages.
No advertising or audience-measurement cookies. Only five cookies, needed for the service to work: the one that keeps the session open (up to 30 days for management, 90 days for employees and clients, ended sooner by "Sign out", the removal of the access or a password change); for those who try the demo, the one that finds their demo copy for 24 hours; the one that keeps the language on the device for one year (it contains only "fr" or "en"), set when you tap "English" or "Français", open the demo in English or open an access link the company prepared in English; and, for management, the one that remembers for one year that the explanations at the top of the pages were read, to fold them away (it contains only "1"); and, for whoever just retyped their password (or, for an employee, their PIN) to display an alarm code, the one that remembers it for 5 minutes (1 minute for an employee's PIN, deleted as soon as they leave the “Codes” tab) (it contains only the internal number of their account and its expiry time, signed).
In the browser, the application also keeps the application's files (so it opens faster), the date the invitation to install it on the phone was dismissed and, for the tab only, the language tapped before signing in (sent at sign-in to be kept on the person's record). A time punch that couldn't be sent stays on the phone for up to 10 days (the time, the contract and the employee's internal number), then it is deleted the next time the application is opened; a scan left without an answer, for the tab only.
No selling, renting or advertising use of the information. No profiling.
Passwords and PINs are never stored in plain text: only a fingerprint is kept.

4. Consent and use

We use the information only for the purposes described above. For any other purpose, we would ask for your consent. By default, the application's settings are the ones that best protect privacy: nothing is made public, and each subscribing company sees only its own data (isolation verified by automated tests at every update).

Within a subscribing company, each person sees only what concerns them. An employee sees their day and the instructions for the premises assigned to them, with the notes left by the other employees of those premises (never shown to the client). A client sees the cleanings for their own premises (the employee's first name, their arrival and departure times, the tasks done or not), their messages, their shopping list, their suppliers and their invoices. The reason for an absence (for example an illness) is shown only to management. Management sees its whole company, except the shopping list and suppliers that a client keeps for itself.

5. Where the information is, and who else has access to it

Hosting: in Québec. The application and its data are on an OVHcloud server located in Beauharnois (Québec). Backup copies are encrypted before leaving the server and kept in another OVHcloud storage space, also in Beauharnois (Québec).
Sending emails: in the United States. The application's emails (orders to suppliers, replies to clients, "forgot password" link, notices to the company and to Gestion Onyxia) are sent by Resend, Inc., whose servers are in the United States. Resend receives only what is needed to deliver the email: the recipient's address, their name if it appears in the message, and the content of the email. A privacy impact assessment was carried out before using this service.
Subscription payment: with Stripe. When the subscriber pays for the subscription online, the payment is made on the pages of Stripe (Stripe Payments Canada, Ltd., a subsidiary of Stripe, Inc., whose servers are located, among other places, in the United States). Stripe receives the company name, the owner's name, email and phone, and itself collects the payment method (card or bank account). A privacy impact assessment was carried out for this service. Gestion Onyxia never sees or keeps any card or bank account number; the application keeps only a Stripe identifier, the status of the subscription (active, payment declined, ended), the monthly price and the next payment date. The subscription's invoices and receipts are sent by Stripe. Stripe is PCI DSS Level 1 certified; its privacy policy: https://stripe.com/en-ca/privacy. This section does not concern the invoices that the subscriber makes for its own clients: they do not go through Stripe.
Emails you write to us: in Canada. Messages sent to our addresses (info@, support@) and our replies are kept by Zoho Corporation, in its Canadian data centre (Toronto, with a backup copy in Montréal, according to Zoho). Zoho only keeps our mailbox; it has no access to the application. According to its own rules, a small number of employees of the Zoho group may access it remotely, including from outside Canada, under control, to fix an error or for technical support. A privacy impact assessment was carried out for this service; the written agreement with Zoho is being signed.
The server. Only Eric Campeau has access to the server, and only for maintenance, a security investigation or the support a subscriber asks for.
Onyxia support, only with the owner's permission. To help you, or to do the setup with you, Gestion Onyxia enters a subscribing company's account only if its owner opens access, in My account ("Need help?"), except for security or when the law requires it: the owner chooses "View only" or "View and fix", and whether support can see absence reasons and the Hours page. The owner receives an email when they open access, when support enters and at the end; each entry and each change (what and, where applicable, which client, contract or employee) is recorded in the support history, which the owner sees in My account. The owner can remove access at any time; it also closes when support ends the help, or by itself after 30 minutes without activity. Support sends nothing to the subscriber's clients or suppliers (no invoice, no email, no order); its other corrections (a cleaning changed or cancelled, for example) show in the client's portal, like the owner's. It has no access to the subscription, the data export or passwords: for the setup, it can create the access link of an employee or a client (recorded in the history), but it never sees a password. If it changes the company's email, the old address is notified right away.
To fix an error: a masked copy. If a problem must be reproduced, and only while support access is open, Gestion Onyxia may make a copy of the company's data masked on the server before it leaves: no name, no city, no phone, no email, no address, no free text (notes, instructions, messages), no absence reasons if the owner did not allow them, and never the "illness" reason of an absence. What remains: dates, times, amounts and quantities, the application's choices, the product catalogue, the first three characters of the postal code and the links between records. If a single name of a person, client or contract, an address, a phone number or an email of the company remained, the copy would be refused. It is used only to reproduce and fix the error, on our computers and with our programming tools, including an artificial intelligence assistant (Claude, by Anthropic, in the United States): these tools only ever see the masked copy. It is recorded in the support history and deleted from the server and our computers at the latest 30 days later.
No one else. No information is disclosed to a third party without consent, unless the law requires it. One exception: when an employee taps "Directions" or "Waze", the cleaning address is sent to Google or Waze to map the route.

6. Security

Encrypted connection (HTTPS) required.
Passwords and PINs protected by a fingerprint; automatic lockout after several failed attempts (a PIN failed 10 times in a row is erased); password change required at the first sign-in with a temporary password.
Changing or resetting a password signs out all other devices.
Server protected by a firewall, automatic security updates, administrative access only with an encrypted key.
Backup every day; off-server copies encrypted; restoration tested regularly.
A company whose data has been deleted is entered in a deletion register. If we ever have to restore a backup copy made before the deletion, its data is removed from the restored copy before the service resumes: it never comes back into the application.

No measure is perfect. In the event of a confidentiality incident presenting a risk of serious injury, we notify the Commission d'accès à l'information and the persons concerned, as the law requires, and we keep a register of incidents. If an incident affects a subscribing company's data, we notify it without delay, since it is responsible for the information about its employees and clients.

7. How long the information is kept

Information	Period
Data of a subscribing company (employees, clients, schedules, clock-ins, orders, invoices, etc.)	During the subscription, then 30 days after it ends (to allow it to be exported, and so that its clients can download their documents from their portal: until the date given by email and on screen), then deleted within the following 15 days
Daily backup copies, on the server	30 days, then destroyed automatically
Daily backup copies, off the server (encrypted, OVHcloud, Beauharnois)	Up to 12 months, then destroyed automatically
Copy made just before an update of the application	30 days, then deleted automatically
Deletion register	As long as backup copies made before the deletion exist (13 months at most), then deleted; its own backup copies, at most 12 months later. It contains only the company's internal number, its name and the deletion date, no other data.
Proof that an erased company accepted the terms	3 years after the deletion (the time limit to sue), then deleted; its backup copies, at most 12 months later. It contains only the company's internal number, its name, the deletion date, and the date and version of the terms accepted.
Copy of the deletion certificate given to the company	Like the register: 13 months at most. It contains the company's name, its internal number, the name and email of its contact person, and the dates.
Sign-in logs (IP addresses)	12 months, then deleted automatically
Visit log of the gestiononyxia.ca website (truncated IP address)	90 days at most, then deleted automatically
Alarm code for the premises	As long as the company keeps it; erased with its data
Alarm-code log (who displayed, changed or opened it; never its value)	12 months, then deleted automatically
Reason for an absence (illness, vacation, other) and the employee's note	13 months after the absence ends, then erased automatically (the dates remain)
Trial code never used: the person's name and phone number	30 days after the code expires (90 days after it is given), then erased automatically
"Forgot password" link	30 minutes, single use
Onyxia support history (openings, entries, changes, end), visible to the owner in My account	12 months, then deleted automatically
Masked copy made to fix an error (no name or contact details)	30 days at most, then deleted from the server and our computers
Onyxia support entry link	10 minutes, single use
Subscription invoices (our own invoices to subscribers)	6 years, for our tax obligations
Improvement suggestions sent by a subscriber	During the subscription
Changes to an employee's schedule and the time they saw them (“Your schedule changed”)	14 days, then forgotten automatically

Backup copies are used only to restore the application after a problem. No one consults them otherwise. What is deleted (a company's data, or information at the end of its retention period) remains in the copies already made until they are destroyed when they expire (12 months at most). The deletion register prevents a restoration from bringing it back. On request, we provide a deletion certificate.

The subscribing company remains responsible for keeping its own invoices for the time required by tax laws, and the information used to make a decision about a person (for example their hours) for at least one year after that decision, as the law requires: it can export them at any time, and up to 30 days after its subscription ends.

8. Your rights

You may request:

access to the information about you;
its correction if it is inaccurate, incomplete or equivocal;
its communication in a structured, commonly used technological format (portability);
the withdrawal of your consent to a use, and the deletion of information that is no longer necessary;
that the dissemination of information cease, or that a link attached to your name be de-indexed, in the cases provided by law (Gestion Onyxia publishes no personal information);
details on how your information is used and protected.

How: write to the person in charge (section 2). If you are an employee or a client of a subscribing company, you may also contact that company directly. We reply in writing within 30 days. The request is free of charge, except for reasonable fees for a transcription or reproduction, which we will tell you about in advance. If we refuse, or do not reply within that time, you may submit the disagreement to the Commission d'accès à l'information du Québec within the following 30 days.

Complaint: write first to the person in charge; we acknowledge receipt and reply within 30 days. If the answer does not satisfy you, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

9. Changes

We publish any change to this policy on this page, with its date. Subscribing companies are notified by email at least 30 days before a significant change.