Privacy

Who is responsible

The company responsible for the information described here is Consuly Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422, which operates offra.

The person responsible for the protection of personal information is Philippe Dallaire, fondateur, reachable at confidentialite@offra.ca.

What we hold

• Business contact details — company name, a publicly published email address, and the web address where we found it. Sometimes the name and role of the person that address belongs to, or a telephone number, when they appear on the same page.

  We keep the URL, an excerpt of the page and the date of consultation for every address. That is the implied-consent basis CASL provides for, and it has to be demonstrable rather than asserted.

• Public SEAO history — the bids and contracts already published by the Government of Quebec.

  This is open data under CC-BY 4.0. It concerns companies, not people.

• The emails sent — the subject and the exact text of each message as it was delivered, along with the delivery and bounce notices.

  Written once, never modified. If you ever ask us what we wrote to you, the answer has to be the message and not a reconstruction.

• Page views — the date, the browser, and a fingerprint of the IP address.

  For those views the IP address is not kept as it is: it is turned into a salted, irreversible fingerprint, in line with Law 25's minimisation principle. We use neither tracking pixels in emails nor advertising cookies. Site analytics is a separate thing, and it is left to you: see below.

• The consent register, and its exception — every unsubscribe and every express consent: the exact text you were shown, the page, the date, and the IP address in clear.

  This is the only place an IP address is not turned into a fingerprint, and it is deliberate: this register exists to prove that a decision was made, by somebody, at a given moment. An irreversible fingerprint would prove nothing.

• Appointments — if you book a call: your name, your email and the booking details.

• Purchases — the billing email address, the amount, the billing address and, if you provide them, your tax numbers.

  Card numbers never pass through our servers: payment is handled by Stripe, which is the controller for that data. We keep Stripe's full response, because in a chargeback it is that response that stands. If you start a payment without finishing it, we keep the email address you entered.

• Account — the email address you sign in with, a name if you gave one and, if you sign in with Google, your profile photo.

• Your workspace content — the documents you upload, in private storage, with their names and the text we draw from them; your library, which may hold CVs — including the PDF export of a LinkedIn profile you upload there — or a resolution naming people; the text of a public web page you ask us to read to describe a project; your company profile and its contact details; your bid history and the outcome reasons you enter; your saved searches; and, to find what fits a task, passages of your library and of your past submissions, each with its numerical representation.

  Each workspace is sealed off: what you upload is never shown to another customer or read for one, and a search only covers the passages of your own workspace. A passage is erased with what it was taken from. A public tender document you import is copied into your workspace. Offra never signs in to LinkedIn or any other account to fetch a profile: it reads only the file you upload. Reading a document requires sending it to the providers named below.

• Your conversations with the assistants — the questions asked about a tender, the exchanges behind an in-depth answer and those with the help assistant, with the rating you give them.

  A help conversation is kept after your account is deleted, with no link to it: it documents a support request. The anonymous conversations of the chatbot on our public site are erased after 90 days.

• The security log — every significant action in your workspace: who, what, when, with the IP address and browser used.

  It is a security record: it is never altered and has no time limit. When an account is deleted, the person's name, email, IP address and browser are erased from it; the actions remain.

• Error reports — when the application hits an error: your email, the page, the browser and the technical description of the error.

  Erased automatically after 180 days.

Where this information comes from

Three origins, and they do not obey the same rules.

What you give us yourself. Your workspace content, your messages to the assistants, your billing address, the name and email on an account: we hold them from you, at the moment you give them. It is the only category collected directly from the person concerned, and you can always choose to upload nothing — an analysis is produced entirely without.

What a colleague gives us about you. An administrator inviting someone into their workspace types that person's address. We then hold only that address and the proposed role, we use it to send one invitation, and the link it contains expires after seven days. Declining the invitation, or simply ignoring it, creates no account: write to us and we delete the address without waiting for it to expire. In the same way, our team may create an account at your address during a demonstration you asked for.

What we find on the open web. SEAO publishes no bidder contact details. Every address we hold was therefore found elsewhere, and how it may be found is constrained.

• Published addresses only. An address is recorded only if the exact string appeared on a page we consulted. The URL, an excerpt of that page and the date are kept with it — three mandatory fields, without which the record cannot exist.
• Never a guessed address. No address reconstructed from a first name and a domain. That is not an internal policy but an impossibility: there would be no page to cite, so no record to create.
• No purchased lists, no enrichment provider. Including for checking that an address exists: we query the mail server directly rather than uploading our records to a third party.
• The crawler declares itself and limits itself. It respects robots.txt, identifies itself with a way to reach us, spaces its requests and reads no more than a dozen pages per site.

Who else is involved

Each for one function only. We do not sell, rent or trade any data.

Supabase

Database, accounts and sign-in links. Also holds the documents you upload, in private storage: a file leaves it only through our application, for a member of the workspace that holds it.

Stripe

Payment, taxes, billing address and tax numbers.

Resend

Sending emails, sign-in emails included, and delivery notices.

Google Workspace

A second sending path, from a named business mailbox, so that you can simply reply.

Google (sign-in)

Only if you choose “Continue with Google”: Google sends us your name, your email address and your profile photo, to open your account and sign you in. Nothing else, and we send it no data.

Cal.com

Booking a call. Receives your name, your email and your company name, to prefill the form.

Mistral AI

Converts the documents you upload to text. Receives the full content of each file — specifications, pricing schedule, past bid — because there is no way to read part of one without sending it. Also computes the numerical representation that finds, by meaning, what your firm has already written that fits a task: for that it receives the text of your library entries, of answers already written, of passages from the files of your past submissions and of the requirement the task describes; the representations it returns to us are kept in your workspace. It is the only one of these providers established in the European Union.

OpenRouter, and the hosts Fireworks, Together, Wafer and Cloudflare

Run the artificial-intelligence model that reads your documents and drafts for you: analysis, compliance matrix, answers, recommendation and assistants. They then receive the text of your documents, your questions and conversations, your company profile and your library; for the help assistant, also the names and emails of your workspace's members. They also draft our prospecting emails, from a company's name, its public history and the name of the person the message is addressed to.

OpenRouter, and the hosts Anthropic, Amazon Web Services and Google Cloud

Run Anthropic's Claude model, which reads the tender documents you have analysed and picks out their requirements, dates and clauses. They then receive the text of those documents.

Groq

Takes over when the previous model does not answer, and then receives the same data; also cleans up some text before it is displayed. It also reads a person's name and role out of the page excerpt we have already kept, and the email address in it. The model reads a page we consulted; it invents no contact details.

Serper.dev

Looks up a company's official website. Receives a company name and a municipality.

Exa

Looks up a company's official website, like the previous service, and runs the web searches behind an in-depth answer. Receives a company name and a municipality, or a short search query written from the tender — never your documents.

Have I Been Pwned

Checks, when you choose a password, that it does not appear in a known breach. Receives, from your browser, the first five characters of a fingerprint of that password — never the password, nor enough to rebuild it.

Umami

Site analytics, with no cookie and without identifying you. Receives the page viewed and its title, the previous page, your browser, its language and your screen size. Your browser sends the measurement to it directly, so Umami receives your IP address, which it uses to infer your approximate location and says it never stores.

Google (Tag Manager, Analytics)

Only if you have accepted. It then receives the pages you view and sets cookies in your browser. Nothing from Google is loaded before that click, and you can change your mind at any time.

PostHog

Measurement of how the application is used — not the site — to learn which features help and which confuse, and so our team can see whether a new workspace is finding its way during its free trial. Receives the pages of the application you open, the element you click without its text, a few named actions such as opening a tab or applying a filter, the technical errors you run into, and an identifier for your account and for your workspace with its plan, when its free trial ends and when it was created. Our team reads back only totals per workspace — how many notices opened, which tabs, how many days of use — never the detail of your clicks. Never your name or email, what you type, or the content of your submissions: the words of a search and the links that act as a key are masked before sending, and no session is recorded. Your browser sends the measurement itself, so PostHog receives your IP address.

Railway

Application hosting.

Outside Quebec

Consuly Pte. Ltd. is headquartered in Singapore, and the providers above run their infrastructure outside Quebec, mainly in the United States — with the exception of Mistral AI, established in France. Your information is therefore stored and processed there.

We tell you because Law 25 requires it, and because it is structural rather than accidental: it follows from the choice of providers, not from a hosting detail.

The same holds for analytics. What leaves Quebec for Umami is deliberately thin — a page, a previous page, a browser, a screen size — and leaves directly from your browser, with its IP address, which Umami says it does not keep. What leaves for Google leaves only with your agreement, and stops when you withdraw it. What leaves the application for PostHog is kept just as short: an account identifier rather than a name, pages and clicks rather than their content.

Artificial intelligence and training

Your workspace content trains no model.

Neither ours nor those of the providers that read it for us. At OpenRouter, every request from the application requires a host that does not keep the data to train a model; Groq and Mistral AI exclude it through their terms or our settings with them. Exa, which receives only short search queries, may use them to improve its engine: that is why no document is sent to it.

Our own forecasting models learn from public tender data, never from what your workspace contains.

Finding what your firm has already written is not training either: the index that does it serves only the searches of your own workspace, and a passage leaves it with what it was taken from.

For how long

We do not publish a retention period the code does not apply. Here is the real state of it.

• Some things erase themselves. Error reports after 180 days, technical processing logs after 90 days, conversations with the chatbot on our public site after 90 days, and an unused demonstration workspace after 14 days. The rest is kept as long as it serves the reason it was collected for — or until you ask us to remove it.
• Four things are kept permanently, and deliberately. The consent register, the unsubscribe list, the text of the messages sent and the security log. These are compliance or security documents: their whole purpose is to prove what was done, and at what moment we stopped.
• Deleting a document erases it. The file, its record and the text we drew from it are erased on the spot. What an analysis had already taken from it — a requirement, a drafted answer — stays in your dossier until you edit it or delete the dossier, and a copy may survive for a while in our host's backups.
• When a subscription ends, nothing is erased. Your workspace content is kept, inaccessible, until you subscribe again or ask us to delete it.
• The unsubscribe link does not expire. It stays valid if you change your mind. A sign-in link expires after an hour; an invitation or activation link, after seven days.

What you can require

• Stop receiving anything. The unsubscribe link at the bottom of every email acts immediately, with no sign-in and no confirmation.

  CASL allows ten business days; handling it in the request itself removes the question. The unsubscribe register accepts neither modification nor deletion — it is a legal document.

• Access, correction, withdrawal. Write to us and we will send you what we hold about you, correct it or delete it.

  Two exceptions, stated plainly. The consent and unsubscribe register is kept, because its purpose is to prove that we stopped writing to you. And the security log keeps the actions, without your name or contact details. An erasure request addressed here can also cover your help conversations.

• Portability. You can ask for the information you gave us in a structured, commonly used technological format.

• Complain. If our answer does not satisfy you, you can take it to the Commission d'accès à l'information du Québec.

Cookies and analytics

There is a banner, and it asks one question: do you accept Google Analytics. Everything else in this section is true whether you answer yes or no.

• The basic measurement, for everyone. We count page views with Umami, which sets no cookie, writes nothing in your browser and follows you on no other site. A visitor there is a fingerprint computed from your IP address and your browser, and renewed at the start of every month: the next month, the same person is somebody else. The script is served from offra.ca, but it is your browser that sends the measurement to Umami; your IP address lets it infer your approximate location and, according to Umami, is never stored.
• Google Analytics, only if you accept it. Nothing from Google is loaded before you click “Accept”. If you do, Google Tag Manager and Google Analytics set cookies that recognise you from one visit to the next. Refusing is one click, in the same place, at the same size and in the same words as accepting — and clicking nothing at all counts as refusing.
• You can change your mind. The “Cookies” link at the bottom of every page reopens the question. If you withdraw your agreement, we withdraw the consent with Google and delete its cookies immediately; the code already loaded in the open tab stops at the next page load. We say so rather than pretending otherwise.
• A browser that has already answered. If it sends the “Global Privacy Control” signal, we record it as a refusal and do not show you the banner. You have already expressed the choice; asking again would be the opposite of respecting it.
• The pages that are not measured at all. The ones whose link was sent to you personally: the unsubscribe, the booking, and the application pages a personal link opens. The address of those pages is itself the key that opens them, so it is passed to nobody — not to Google, not to Umami, even if you accepted everything. The company name you type into the subscription form does not leave either.
• The other cookies. Your session cookie, set when you sign in to your account and shared with the application so that you do not have to sign in again moving from one to the other. And, since the site became bilingual, your language: it is written only when you click the FR/EN button, never on arriving at a page, and it is shared with the application so that you do not have to choose again after signing in. It contains two letters. Your light or dark theme choice and your answer to the banner stay in your browser and never reach us. In the application, usage is measured with PostHog (see “Who else is involved”): it keeps a random identifier there, in a cookie and in your browser's storage, to link your visits together. It serves no advertising and does not follow you to any other site, and a browser that sends the “Global Privacy Control” or “Do Not Track” signal is not measured there at all. Your browser also keeps a few display preferences and your drafts in progress there.
• No tracking in emails. Our prospecting emails are plain text, with no HTML version. The application's emails — reminders, invoices, invitations and alerts — also have a simple HTML version, with no tracking pixel. No link passes through a redirector, which holds for the unsubscribe link too.
• No advertising. No ad network, no social network pixel, no advertising cookie, and nothing that serves to profile you. Typefaces are served from our own servers, so your browser does not contact Google to display them.

Privacy incidents

We keep a register of privacy incidents. If an incident presents a risk of serious harm, we notify the Commission d'accès à l'information and the people concerned without delay, as Law 25 requires.

Automated decisions

Our models assess tenders, not people, and the decision that matters, whether or not to bid, remains entirely yours.

Only one decision about you is taken without human involvement: the help assistant blocks itself for a few minutes when a model judges that repeated messages are trying to get around its rules. A person is notified, and you can write to us to have a person review the decision and hear your observations.

Contact us

For any question about the protection of personal information, or to exercise one of the rights above, write to confidentialite@offra.ca.

A change to this page takes effect on publication, with a new effective date.

Consuly Pte. Ltd. — Offra par Consuly Pte. Ltd - 68 Circular Road, #02-01, 049422, Singapore